Tom's Guide | Tom's Hardware | Tom's Games | PC Safety Suite

Computing.Net > Forums > Security and Virus > virtumonde + trojans reinfecting

Computer Problems? Computing.Net has over 1,000,000 posts about all things technology related! Click here to start participating now! Also, check out the New User Guide.

virtumonde + trojans reinfecting

Reply to Message Icon

Name: paige123
Date: July 20, 2007 at 08:58:18 Pacific
OS: winxp
CPU/Ram: 512
Product: hp pavilion a527x
Comment:

Please help - I have tried numerous antispyware, antivirus, antitrojan, fixes and have even gone into the registry and deleted many keys...I still keep getting reinfected with:

virtumonde, abetterinternet and the following trojans:

downloader.generic5.qb, sheur.zq, generic5.pup, dialer.hww, dropper.small.29.e & downloader.generic4.iqo

Any advise would be greatly appreciated



Google Ads

Response Number 1
Name: XpUser4Real
Date: July 20, 2007 at 10:16:20 Pacific
+1
Reply:

Try the symantec removal:
http://www.symantec.com/security_re...

Hopefully my advice will help you...Please post back with your results as it will help others.



Response Number 2
Name: paige123
Date: July 20, 2007 at 15:57:53 Pacific
+1
Reply:

Thank you for your response. I actually tried that one and it is still infected. Any other suggestion?



Response Number 3
Name: paige123
Date: July 20, 2007 at 15:58:50 Pacific
+1
Reply:

Thank you. I actually tried that one and it is still infected. Any other suggestion?



Response Number 4
Name: Abnormal
Date: July 20, 2007 at 16:28:43 Pacific
+1
Reply:

VundoFix by Atribune

Hijackthis help forums.
Alliance of Security Analysis Professionals



Response Number 5
Name: paige123
Date: July 21, 2007 at 22:25:24 Pacific
+1
Reply:

Thanks again. The two tool & fix work and find a lot of files on my computer however I still keep getting reinfected. I am running in safe mode with networking and if I leave my computer on for a few hours the same files are found again and again.

Is reformatting my computer my only option?



Related Posts

See More



Response Number 6
Name: XpUser4Real
Date: July 21, 2007 at 22:38:51 Pacific
+1
Reply:

have you turned off system restore and scanned?

Hopefully my advice will help you...Please post back with your results as it will help others.



Response Number 7
Name: paige123
Date: July 21, 2007 at 23:32:26 Pacific
+1
Reply:

How would you turn off system restore?

I've only run the programs in safemode...I've tried 3 tool/fixes now, avg, spybot, adware and a few other...it takes several hours to run them all and by the time I'm finished running them all I'm back to square one...




Response Number 8
Name: paige123
Date: July 21, 2007 at 23:37:49 Pacific
+1
Reply:

Just one other peice of info for the record - my java software was out of date and I've heard that it exploits that. I've since that time updated to be current.



Response Number 9
Name: XpUser4Real
Date: July 22, 2007 at 07:33:11 Pacific
+1
Reply:


How to turn off system restore http://support.microsoft.com/kb/310405

Hopefully my advice will help you...Please post back with your results as it will help others.



Response Number 10
Name: XpUser4Real
Date: July 22, 2007 at 07:36:43 Pacific
+1
Reply:

also try this free online scan while restore is turned off
http://www.spywareinfo.com/xscan.php
and remove all it finds

What anti-virus are you using?

Hopefully my advice will help you...Please post back with your results as it will help others.



Response Number 11
Name: paige123
Date: July 22, 2007 at 12:08:47 Pacific
+1
Reply:

I used AVG...
I'll give the restore a try and the scan. Thanks for all your help!



Response Number 12
Name: paige123
Date: July 22, 2007 at 12:18:41 Pacific
+1
Reply:

I can't seem how to scan with the scanner at http://www.spywareinfo.com/xscan.php it is telling me I need to update and then there is no trial...only buy.



Response Number 13
Name: XpUser4Real
Date: July 22, 2007 at 12:22:05 Pacific
+1
Reply:

Thanks for letting me know, I sent an email to the company and reported the problem.

You may have to pass on that one till I get back to you....sorry.

Hopefully my advice will help you...Please post back with your results as it will help others.



Response Number 14
Name: paige123
Date: July 22, 2007 at 12:22:17 Pacific
+1
Reply:

ok it seems to be running now - will get back with update...seems to be catching reg entriews which makes me happy.



Response Number 15
Name: XpUser4Real
Date: July 22, 2007 at 12:26:24 Pacific
+1
Reply:

great....remove all it finds.....I'll be waiting for your reply

Hopefully my advice will help you...Please post back with your results as it will help others.



Response Number 16
Name: DoctorV23
Date: July 22, 2007 at 13:29:33 Pacific
+1
Reply:

A-sqaured free: http://www.emsisoft.com/en/software...
TrojanHunter:http://www.misec.net/
-these are really imortant.



Response Number 17
Name: paige123
Date: July 22, 2007 at 17:31:08 Pacific
+1
Reply:

I THINK the system restore shutdown + the xscan worked. Haven't yet tried ascan but I tried trojan hunter a few days ago.

I'm not 100% convinced yet...a few times in the past things looked good but then I found virtumondo in spybot again. I'll report back in a while but...so far everything that I run seems to come up clean. :) I'm very grateful for this help!



Response Number 18
Name: XpUser4Real
Date: July 22, 2007 at 20:36:13 Pacific
+1
Reply:

Thanks for posting back! Turn your system restore back on again.....Let's keep our fingers crossed and hopefully all is well.

A-sqaured free is a long and tedious scan and trojan hunter....not too sure on that one....LOL.

Hopefully my advice will help you...Please post back with your results as it will help others.



Response Number 19
Name: paige123
Date: July 22, 2007 at 21:43:55 Pacific
+1
Reply:

Okay...things seem to be better but I found virtumonde once again in spybot just a few minutes ago. :( I'm starting to think it's impossible to get rid of it. I've tried about 12 different programs now.

It seems that there are way less problems after running that xscan - at least it can be managed ..I guess I should be hesitant to do online banking and using credit cards until I completely get rid of the problem? Do you think it's safe?



Response Number 20
Name: XpUser4Real
Date: July 22, 2007 at 21:47:24 Pacific
+1
Reply:

did you try this removal?
http://spyware-removal.thrcomputer....

Hopefully my advice will help you...Please post back with your results as it will help others.



Response Number 21
Name: XpUser4Real
Date: July 22, 2007 at 21:54:07 Pacific
+1
Reply:

What is your AV?

Try this, download Avast free http://www.avast.com/eng/download-a...
to your desktop. Disable the AV you are presently using, install Avast and let it do a bootscan on reboot. Move EVERYTHING it finds to the chest and when it is done. run your Spybot scan again and see if the problem still remains.

Hopefully my advice will help you...Please post back with your results as it will help others.



Response Number 22
Name: paige123
Date: July 22, 2007 at 22:22:42 Pacific
+1
Reply:

I downloaded a-squared & am doing the deep cleaning...the fast one found some things so I'm trying the deep one too - it is vvvvery slow like you said though. It might take all night.

"did you try this removal?
http://spyware-removal.thrcomputer....

I think I saw a manual remove similar to this...none of those entries were in my registry or windows.

I use AVG antivirus. Will try the one you suggested too.

In the past I've had spyware and virus and it has never been a real issue...maybe going into the registry and deleted a few things and running a few scans and presto...but for some reason this virtumonde is sooo difficut to get rid of! I read somewhere that it records keystrokes so I'm thinking it might not be a good idea to sign into places with my passwords. I'm not really sure how they use the info...



Response Number 23
Name: www
Date: July 22, 2007 at 23:20:47 Pacific
+1
Reply:

one of the newer vundo infections installs a rootkit. in regular mode download and run http://www.f-secure.com/blacklight/ blacklight.

there is more info on it at
http://wiki.castlecops.com/Vundo_Ro...
edit;
(they say the atribune vundo fix will remove the rootkit. as of may 2007)

you can also try http://www.grisoft.com/doc/download...

http://free.grisoft.com/doc/5390/us...

hope you and XPuser4real get rid of it. that one is a bugger.

(you'll also have to disable restore again, and when clean enable)



Response Number 24
Name: paige123
Date: July 29, 2007 at 10:42:04 Pacific
+1
Reply:

UPDATE: No more spyware!!!

I'm not sure jut what did it but I followed all the advise on this thread and it is now gone.

THANK YOU EVERYONE FOR YOUR HELP! A special thanks to XpUser4Real for sticking it out with me! :)



Response Number 25
Name: XpUser4Real
Date: July 29, 2007 at 11:11:59 Pacific
+1
Reply:

You are MOST welcome! Thanks for posting back!

Some Help in Posting a Message in computing.net
Hopefully my advice will help you...Please post back with your results as it wi



Response Number 26
Name: paige123
Date: August 2, 2007 at 20:09:49 Pacific
+1
Reply:

It came back :(

I guess I will have to reformat when I get some time.



Google Ads
Reply to Message Icon

service and controller ap... how to disable the proper...



Post Locked

This post is quite old and has been locked from receiving new replies. Please create a new posting instead.


Go to Security and Virus Forum Home


Google Ads


Results for: virtumonde + trojans reinfecting
Virtumonde, Trojan-gen, and more... www.computing.net/answers/security/virtumonde-trojangen-and-more/23974.html

persistent trojan infection www.computing.net/answers/security/persistent-trojan-infection/19841.html

no icons or start menu www.computing.net/answers/security/no-icons-or-start-menu/22212.html