Thread: Virtumonde Strikes again
View Single Post
•
•
Join Date: Jan 2009
Posts: 6
Reputation: LittleWolf is an unknown quantity at this point 
Solved Threads: 0
LittleWolf LittleWolf is offline Offline
Newbie Poster

Re: Virtumonde Strikes again

 
0
  #4
Jan 13th, 2009
Thanks for taking up my case, Crunchie, from what I've read on the other posts, you've saved a lot of computers. Vundo slayer, perhaps?

Malwarebytes' Anti-Malware 1.32
Database version: 1647
Windows 5.1.2600 Service Pack 3

1/13/2009 5:56:03 AM
mbam-log-2009-01-13 (05-56-03).txt

Scan type: Full Scan (C:\|D:\|F:\|)
Objects scanned: 94772
Time elapsed: 22 minute(s), 31 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 4
Registry Keys Infected: 22
Registry Values Infected: 5
Registry Data Items Infected: 2
Folders Infected: 1
Files Infected: 22

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
C:\WINDOWS\system32\urqRLbbB.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\vxeccn.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\apmnbhll.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\lqtnsg.dll (Trojan.Vundo.H) -> Delete on reboot.

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{848aa774-66ae-4841-b7ff-c72b1a349b75} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{848aa774-66ae-4841-b7ff-c72b1a349b75} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{e12c56b2-6fcb-4f0f-bc99-11acdd585226} (Trojan.Vundo.H) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{e12c56b2-6fcb-4f0f-bc99-11acdd585226} (Trojan.Vundo.H) -> Delete on reboot.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{e12c56b2-6fcb-4f0f-bc99-11acdd585226} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{848aa774-66ae-4841-b7ff-c72b1a349b75} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\cdmyidd.securitytoolbar (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{cd24eb02-9831-4838-99d0-726d411b1328} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{f20da564-9254-49fe-a678-cc3cef172252} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{a26503fe-b3b8-4910-a9dc-9cbd25c6b8d6} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{a26503fe-b3b8-4910-a9dc-9cbd25c6b8d6} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{a26503fe-b3b8-4910-a9dc-9cbd25c6b8d6} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{a26503fe-b3b8-4910-a9dc-9cbd25c6b8d6} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\cdmyidd.securitytoolbar.1 (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Installer\UpgradeCodes\2dda3201767c34b46a72671d26d39178 (Rogue.AntiSpywareBot) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\2dda3201767c34b46a72671d26d39178 (Rogue.AntiSpywareBot) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\xpreapp (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\spybotdeletingb3678 (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\spybotdeletingd6585 (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{a26503fe-b3b8-4910-a9dc-9cbd25c6b8d6} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{a26503fe-b3b8-4910-a9dc-9cbd25c6b8d6} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\c:\documents and settings\all users\start menu\programs\antispywarebot\ (Rogue.AntiSpywareBot) -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\urqrlbbb -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\urqrlbbb -> Delete on reboot.

Folders Infected:
C:\Documents and Settings\Jas\Application Data\AntispywareBot (Rogue.AntiSpywareBot) -> Quarantined and deleted successfully.

Files Infected:
C:\WINDOWS\system32\lqtnsg.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\urqRLbbB.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\BbbLRqru.ini (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\BbbLRqru.ini2 (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ejtdhrpc.dll_old (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\cprhdtje.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\guxxheid.dll_old (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\diehxxug.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\vxeccn.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\apmnbhll.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\Documents and Settings\Jas\Local Settings\Application Data\CyberDefender\cdmyidd.dll (Trojan.BHO) -> Quarantined and deleted successfully.
C:\Documents and Settings\Jas\Local Settings\Temp\seneka373d.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Jas\Local Settings\Temporary Internet Files\Content.IE5\E58G5ICN\index[1] (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Jas\Local Settings\Temporary Internet Files\Content.IE5\E58G5ICN\index[2] (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\Documents and Settings\Jas\Local Settings\Temporary Internet Files\Content.IE5\WE5O6IVB\upd105320[1] (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Jas\Local Settings\Temporary Internet Files\Content.IE5\WE5O6IVB\upd105320[3] (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\rcsjcdhr.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ysqxkv.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\odmljwxm.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\drivers\seneka.sys (Trojan.TDSS) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\drivers\senekatucbadlt.sys (Trojan.TDSS) -> Delete on reboot.
C:\WINDOWS\system32\senekagdvnjddw.dll (Trojan.Agent) -> Quarantined and deleted successfully.



------------------------------

I also found this other log, of a quick scan I didn't ask for.

Malwarebytes' Anti-Malware 1.32
Database version: 1647
Windows 5.1.2600 Service Pack 3

1/13/2009 6:23:30 AM
mbam-log-2009-01-13 (06-23-30).txt

Scan type: Quick Scan
Objects scanned: 16940
Time elapsed: 1 minute(s), 25 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)


Thanks!
Reply With Quote