How to get rid of Virtumonde.sci

14 years ago

A Spybot Search and Destroy scan reports virtumonde.sci. I have clicked "fix it" and the program reports it has done so but when I rescan with the same program, this Trojan (their term) shows up again. Recently I have been having trouble closing down my computer and have had to actually turn the power off in order to log off. IÂve also been getting frequent messages that Microsoft has encountered a problem and has to close a program.

My wake up call began yesterday when I booted. I noticed that the McAfee icon indicated I had a problem. I opened the Security Center and it showed that I was unprotected. I have an HP running XP Media Center with SP2. My Comcast cable connection includes McAfee Security Suite. That Suite is configured for automatic updates.

Not realizing how this problem would grow, I didnÂt note the exact message I got but essentially I had to re-download McAfee. BUT, in trying to do that another message said I had to update with Microsoft. Microsoft is set to automatically notify me of updates. I had installed a Microsoft validation program quite a while ago.

I went through the required steps and once McAfee reported being in full protection mode I updated Easy Cleaner, Spybot Search and Destroy, Malwarebytes, and Superantispyware. I then switched to Safe Mode.

With Easy cleaner I deleted Unnecessary Files, and cleared Files, Cookies and History.

The Spybot scan found the virtumonde.sci trojan. I clicked Spybot to fix it.

Malwarebytes did a full scan. No malicious items were detected.

Superantispyware did a complete scan. Only tracking cookies were found. They were removed and quarantined.

The Recycle Bin was emptied.

I restarted in regular mode.

To get the warm fuzzies, I rescanned with Spybot and the virtumonde.sci was there again.

I came to this forum and found recommendations for the ESET online scanner. I did that and it found some items but in trying to copy the results I lost them.

SoÂI tried TrendMicroÂs Housecall. I downloaded their kernel and the scan was completed. I didnÂt immediately have the program do its thing and clicked on other tabs, thinking it would tell me more. I lost the scan results. IÂve since tried to rescan with Housecall but keep getting a message that "An error occurred while trying to transfer data from the Internet. Do you want TrendMicro Housecall to try againÂ" I have to click "Cancel" about 7 times before the message box closes.

IÂve repeated the whole process a second time (updating the malware programs, switching to safe mode, etc.). On the 2nd try I copied the files Spybot found before I had Spybot fix them and also after the fix. TheyÂre long but if theyÂre helpful, I can post them.

What are other steps I should I take to try to rid my computer of this malware?

Thanks for reading - June

Sort by:Oldest

Comments (9)

zep516
14 years ago
Please download Malwarebytes' Anti-Malware to your desktop. Click here
Double Click mbam-setup.exe to install the application.
Â Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
Â If an update is found, it will download and install the latest version.
Â Once the program has loaded, select "Perform Full Scan", then click Scan.
Â The scan may take some time to finish,so please be patient.
Â When the scan is complete, click OK, then Show Results to view the results.
Â Make sure that everything is checked, and click Remove Selected.
Â When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
Â The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Â Copy&Paste the entire report in your next reply.
Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediately.
zep516
14 years ago
Run malwarebytes again, post a log
Related Discussions
Fire Ants: How do I know I have them and how do I get rid of them
Q
Comments (2)
Fire ants make mounds and not holes. The mounds start out small and become larger as the colony population increases. These mounds look rather innocent until you disturb them, and ALL of the ants boil out of the mound all at once. Again, there is never a discernible hole. I never worry about ants in my yard and garden, other than fire ants. Fire ants can be a problem for humans, pets, bird nests, beneficial insect eggs and larvae, and such.
...See More
how to get rid of a groundhog
Q
Comments (27)
Vaherbmom THANK YOU!! meldy_nva Pine-Sol! The smell is overpowering but makes so much sense!! I was going to run a hose about 10’ into their hole and funnel a quart of ammonia followed by a quart of bleach. Bend the hose into the hole and cover it with dirt but the exhaust is so much cleaner:) The University uses dry ice at the same time on multiple holes covered with A LOT of wet dirt and then they hold. They standby because the students would remove the dry ice (the non home owners felt it to be cruel) My issue is living between immigrants that believe animals have a place in the world. They do! But not when they damage your property! So she continued to feed them by dumping her table scraps and compost in the alley behind our houses. She felt differently when her yard was excavated for a sewerline break. The workers explained that the absence of support structures caused it to snap. I have used conibear traps in the attic for squirrels, just be careful to do so when there is no chance youll be leaving behind unfed helpless babies. For folks that have groundhogs in open fields contact your local Jack Russell Terrier club. They might have to dig a hole or two to get the dogs out but GO TO GROUND is what JRTs were bred to do. My 16lb baby caught the 30lb animal she was feeding and I left it for her to bury so she could see what she created. Point being if your neighbors arent on board, theyll just comeback later. 16lb JRT foot, 30lb groundhog under the first step closest to the ground. JRT 1: Chuck 0
...See More
Side note to getting rid of bermuda-How do you get rid of Oxalis?
Q
Comments (9)
The common yellow oxalis we have here has tiny "bulbules" (sp?), which lurk 12 -18 inches under the ground. You can easily pull up the plants, of course, but those tiny bulb things stay under the soil, and up it comes again. I once had a gardener who decided to eradicate it from a flower bed which is about 12 feet long and 6 feet wide. He actually dug up the top 2 feet of soil, and sifted it by hand to get all of the tiny bulbs out. That worked for the first year, but by 2-3 years after he did that, back the oxalis came. So, being lazy, what I do is just admire it in the Spring, except where it is trying to smother other plants. Then just pull it out around those plants. By late Spring here it has died down, and I pretend it is gone. Of course, it comes up again the next Spring. It is one of our first blooming plants to bloom (starts Jan/Feb), so I just regard it as such and let it be mostly. One of my cats likes to eat it (we used to eat it as children - we called it "sour grass"). Jackie
...See More
How to Get Get Rid Of Potamogeton Aquatic Plants In My Pond?
Q
Comments (0)
I have a large pond. It's about an acre in size and every year there are massive amounts of potamogeton aquatic plants that spring up in the water. Every year I cut them down with an underwater weed cutter. Is there a more permanent way to get ride of the potamogeton? I'm so tired of attacking them every year. They threaten to turn my pond into a swamp.
...See More
zep516
14 years ago
I think spybot is finding a left over registry entry, next time you run malwarebytes disable all your security, if Teatimer is running disable it, if you are using Adware SE, uninstall it, if the computers stable flush all the system restore points by turning system restore off reboot turn system restore back on and create a restore point,

Run the cleaner below:

Download ATF Cleaner by Atribune to your Desktop.

Note: Vista users must use Run As Administrator
Â Under Main: Select Files to Delete choose: Select All.
Â Click the Empty Selected button.
Â If you use Firefox browser click Firefox at the top and choose: Select All
Â Click the Empty Selected button.
If you would like to keep your saved passwords click No at the prompt.
Â If you use Opera browser click Opera at the top and choose: Select All
Â Click the Empty Selected button.
If you would like to keep your saved passwords click No at the prompt.
Â Click Exit on the Main menu to close the program.

Run spybot again.
zep516
14 years ago
Post the log from spybot if it cont. to find Virtumonde.sci
tholt4
14 years ago
I was running McAfee Security Suite at the time my PC began having numerous popups. AdAware and Spybot detected nothing.
I purchased Webroot Spysweeper which detected Virtumonde (and other trojans)and quarantined them. Problem solved. Have since dumped McAfee and changed over to Webroot Internet Security Essentials (which includes Spysweeper).
zep516
14 years ago
****Malwarebytes should have no problem removing Virtumonde, that's whats kind of strange and that's why I think it's a left over registry entry, or one of the programs (Spyware) is putting the entry back in the registry on reboot,

AdAware SE is noted for this it takes a snap shot of the registry and places them back on reboot that's why I asked user to uninstall it if they have it.

Before we download yet more software we need to see the spybot log to to see where spybot is finding Virtumonde.
zep516
14 years ago
It's sort of like this problem in the link below,

Here is a link that might be useful: keep-finding-adware
juneroses Z9a Cntrl Fl
Original Author
14 years ago
I reran Malwarebytes (the 3rd run) as instructed. It reported "The scan completed successfully. No malicious items were detected."

I have a copy of the happy details which I can post here if you still want to see them.

I rescanned with Spybot and this time it gave me the bright green all-okay check mark and made no mention of virtumonde.sci.

I retried the TrendMicro Housecall and it made its way through all the C and D files and I think through the grayware/spyware category when it came to a halt and the dreaded box appeared saying "An error occurred while trying to transfer data from the Internet. Do you want Trend Micro Housecall to try resendingÂ". I did retry several times but the box reappeared repeatedly. At the time, the progress tab on the left showed the program was "updating security check information".

Trying to learn what I could, I clicked on the results tab and it showed ADWARE_MEMWATCHER (98 infections) but the program and computer were frozen there and I could only close the browser.

I did have AdAware installed on my computer but uninstalled it in July 2008. I uninstalled using the Add/Remove feature, I uninstalled because of a thread in this forum related to compatibility issues between Spybot and AdAware.

Anyway, I digress, but IÂm relating these events in the order they appeared.

I came back to this forum to report and saw additional instructions about disabling TeaTimer, etc. In trying to find out how to do so, I was in Spybot and clicked on the recovery tab. There I found a backup for virtumonde.sci.

The system wouldnÂt allow copy and paste of what it was saving in backup so I copied it manually (and hopefully without error).

Browser helper object
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\(AAAE832A-5FFF-4661-9C8F-369692D1DCB9)

The above was listed 4 times for

1/4/09 9:57:00 AM
1/30/09 10:33:44 PM
1/31/09 5:07:20 PM
1/31/09 7:14:07 PM

The following was also listed once:

Class ID
HKEY_CLASSES_ROOT\CLSID\(AAAE832A-5FFF-4661-9C8F-369692D1DCB9)
1/4/09 9:57:01 AM

Should I still run the ATF Cleaner?

Thanks so much for your help - June
zep516
14 years ago
"Should I still run the ATF Cleaner"?

I would..

How to get rid of Virtumonde.sci

Comments (9)

zep516

zep516

Related Discussions

zep516

zep516

tholt4

zep516

zep516

juneroses Z9a Cntrl Fl
Original Author

zep516

COMPANY

BUSINESS SERVICES

GET HELP

CONNECT WITH US

How to get rid of Virtumonde.sci

Comments (9)

Related Discussions

juneroses Z9a Cntrl FlOriginal Author

COMPANY

BUSINESS SERVICES

GET HELP

CONNECT WITH US

juneroses Z9a Cntrl Fl
Original Author