Popups and Trojan.Virtumonde - Page 2

Ried · 12-27-2007, 09:42 PM

Yes, John. Reinstalling those programs is the best way to move forward with this. Those programs had been infected and there apparently were no backups left for us to move to fix them. For example:

Quote:

C:\qoobox\Quarantine\C\Program Files\Windows Defender\ MSASCui.exe.vir ------> AdWare.Win32.Virtumonde.cli skipped

Make sure you uninstall them first via the Add/Remove programs panel, reboot, then reinstall.

----------------------------------------------------------

Let's tidy up a bit as well. The following procedure will clear out ComboFix.exe, as well as the backups and quarantines created by the fix. It will also reset your System Restore by flushing out previous restore points (which contain the infections) and create a new restore point.

Click Start > Run and copy/paste, or type the following bolded text into the Run box and click OK:

ComboFix /u

--------------------------------------------------------------------

Launch Spybot S&D and click 'Recovery'. Purge all items.

--------------------------------------------------------------------

Also, check your SunJava and make sure it will update.

Test out the system and let me know how it's running in a couple of days.

SportSter · 12-27-2007, 09:49 PM

Thank you VERY MUCH, Ried, for helping me with this.

I will do as you suggested and report back to you here in this thread in few days.

Again, I really appreciate your help and will make sure to recommend your forum to all my colleagues and friends.

All the best for 2008!

John

Ried · 12-27-2007, 09:55 PM

You're welcome, John. You were a pleasure to work with.

Best to you as well. See you in a few days.

SportSter · 12-30-2007, 03:40 PM

Hi Ried,

Just letting you know that everything is good with my PC. Thanks again for all your help.

Happy New Year!

John

Ried · 12-30-2007, 03:49 PM

Great to hear that, John.

Let's tidy up a bit now. The following procedure will clear out ComboFix.exe, as well as the backups and quarantines created by the fix. It will also reset your System Restore by flushing out previous restore points (which contain the infections) and create a new restore point.

Click Start > Run and copy/paste, or type the following bolded text into the Run box and click OK:

ComboFix /u

--------------------------------------------------------------------

To help protect your computer in the future I recommend that you get the following free programs if you do not already have them:

McAfee Site Advisor--free version. The folks there check out websites and based on their findings, rate it as Safe, Unknown, Caution, or Bad.

SpywareBlaster 3.5.1 to help prevent spyware from installing in the first place. Install & update SpywareBlaster with the latest definitions. After you have updated, click the button - enable protection for all unprotected items.

It will block any bad ActiveX from running in Internet Explorer and Firefox if it's listed in their database (which you should update frequently). To view their database and list of restricted sites, launch the program and click on each of the tabs on the main display page.

IESpyAD Zoned Out to block access to malicious websites so you cannot be redirected to them from an infected site or email. This severely impairs attempts to infect your system as it basically prevents any downloads (Cookies etc) from the sites listed, although you will still be able to connect to the sites.

Update, and scan with your onboard Anti Malware and Anti Virus programs regularly. Without regular updates you will not be protected when new malicious programs are released.

In light of your recent issue, I'm sure you'd like to avoid any future infections. Please take a look at these well written articles:

PC Safety and Security--What Do I Need?

HOW DID I GET INFECTED IN THE FIRST PLACE? by Tony Klein
THE ANTI-SPYWARE TUTORIAL
MAKING INTERNET EXPLORER SAFER
Understanding and Using Firewalls

**Be very wary with any security software that is advertised in popups or in other ways. They are not only usually of no use, but often have malware in them.

-----------------------------------------------------

Follow the list above and the potential for infection will reduce dramatically.

Happy New Year.

12-27-2007, 09:49 PM	#22 (permalink)
SportSter Registered User Join Date: Dec 2007 Posts: 20 OS: XPsp2 MCE	Re: Popups and Trojan.Virtumonde Thank you VERY MUCH, Ried, for helping me with this. I will do as you suggested and report back to you here in this thread in few days. Again, I really appreciate your help and will make sure to recommend your forum to all my colleagues and friends. All the best for 2008! John

12-27-2007, 09:55 PM	#23 (permalink)
Ried Assistant Manager, TSF Academy; Moderator/Analyst Security Team Join Date: Jan 2005 Location: Ohio Posts: 20,048 OS: WinXP and Vista	Re: Popups and Trojan.Virtumonde You're welcome, John. You were a pleasure to work with. Best to you as well. See you in a few days. __________________ Member of ASAP since 2005 Member of UNITE since 2006 "It is one life whether we spend it laughing or weeping." "Take the time to laugh--it is the music of the soul."

12-30-2007, 03:40 PM	#24 (permalink)
SportSter Registered User Join Date: Dec 2007 Posts: 20 OS: XPsp2 MCE	Re: Popups and Trojan.Virtumonde Hi Ried, Just letting you know that everything is good with my PC. Thanks again for all your help. Happy New Year! John

12-30-2007, 03:49 PM	#25 (permalink)
Ried Assistant Manager, TSF Academy; Moderator/Analyst Security Team Join Date: Jan 2005 Location: Ohio Posts: 20,048 OS: WinXP and Vista	Re: Popups and Trojan.Virtumonde Great to hear that, John. Let's tidy up a bit now. The following procedure will clear out ComboFix.exe, as well as the backups and quarantines created by the fix. It will also reset your System Restore by flushing out previous restore points (which contain the infections) and create a new restore point. Click Start > Run and copy/paste, or type the following bolded text into the Run box and click OK: ComboFix /u -------------------------------------------------------------------- To help protect your computer in the future I recommend that you get the following free programs if you do not already have them: McAfee Site Advisor--free version. The folks there check out websites and based on their findings, rate it as Safe, Unknown, Caution, or Bad. SpywareBlaster 3.5.1 to help prevent spyware from installing in the first place. Install & update SpywareBlaster with the latest definitions. After you have updated, click the button - enable protection for all unprotected items. It will block any bad ActiveX from running in Internet Explorer and Firefox if it's listed in their database (which you should update frequently). To view their database and list of restricted sites, launch the program and click on each of the tabs on the main display page. IESpyAD Zoned Out to block access to malicious websites so you cannot be redirected to them from an infected site or email. This severely impairs attempts to infect your system as it basically prevents any downloads (Cookies etc) from the sites listed, although you will still be able to connect to the sites. Update, and scan with your onboard Anti Malware and Anti Virus programs regularly. Without regular updates you will not be protected when new malicious programs are released. In light of your recent issue, I'm sure you'd like to avoid any future infections. Please take a look at these well written articles: PC Safety and Security--What Do I Need? HOW DID I GET INFECTED IN THE FIRST PLACE? by Tony Klein THE ANTI-SPYWARE TUTORIAL MAKING INTERNET EXPLORER SAFER Understanding and Using Firewalls **Be very wary with any security software that is advertised in popups or in other ways. They are not only usually of no use, but often have malware in them. ----------------------------------------------------- Follow the list above and the potential for infection will reduce dramatically. Happy New Year. __________________ Member of ASAP since 2005 Member of UNITE since 2006 "It is one life whether we spend it laughing or weeping." "Take the time to laugh--it is the music of the soul."