Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

VirtumondeDLL [CLOSED]


  • This topic is locked This topic is locked

#1
Pham

Pham

    New Member

  • Member
  • Pip
  • 1 posts
help me plzz!!! :) i have virtumonde. Here is my KAV Online scanner log:

KASPERSKY ONLINE SCANNER REPORT
Monday, June 09, 2008 3:53:50 AM
Operating System: Microsoft Windows XP Professional, Service Pack 3 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 9/06/2008
Kaspersky Anti-Virus database records: 841128
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
C:\
D:\
E:\

Scan Statistics:
Total number of scanned objects: 58297
Number of viruses found: 6
Number of infected objects: 9
Number of suspicious objects: 0
Duration of the scan process: 00:53:06

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\Pham Tuan Anh\Application Data\Mozilla\Firefox\Profiles\kgebqccq.default\cert8.db Object is locked skipped
C:\Documents and Settings\Pham Tuan Anh\Application Data\Mozilla\Firefox\Profiles\kgebqccq.default\flashgot.log Object is locked skipped
C:\Documents and Settings\Pham Tuan Anh\Application Data\Mozilla\Firefox\Profiles\kgebqccq.default\formhistory.dat Object is locked skipped
C:\Documents and Settings\Pham Tuan Anh\Application Data\Mozilla\Firefox\Profiles\kgebqccq.default\history.dat Object is locked skipped
C:\Documents and Settings\Pham Tuan Anh\Application Data\Mozilla\Firefox\Profiles\kgebqccq.default\key3.db Object is locked skipped
C:\Documents and Settings\Pham Tuan Anh\Application Data\Mozilla\Firefox\Profiles\kgebqccq.default\parent.lock Object is locked skipped
C:\Documents and Settings\Pham Tuan Anh\Application Data\Mozilla\Firefox\Profiles\kgebqccq.default\search.sqlite Object is locked skipped
C:\Documents and Settings\Pham Tuan Anh\Application Data\Mozilla\Firefox\Profiles\kgebqccq.default\urlclassifier2.sqlite Object is locked skipped
C:\Documents and Settings\Pham Tuan Anh\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Pham Tuan Anh\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Pham Tuan Anh\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Pham Tuan Anh\Local Settings\Application Data\Mozilla\Firefox\Profiles\kgebqccq.default\Cache\_CACHE_001_ Object is locked skipped
C:\Documents and Settings\Pham Tuan Anh\Local Settings\Application Data\Mozilla\Firefox\Profiles\kgebqccq.default\Cache\_CACHE_002_ Object is locked skipped
C:\Documents and Settings\Pham Tuan Anh\Local Settings\Application Data\Mozilla\Firefox\Profiles\kgebqccq.default\Cache\_CACHE_003_ Object is locked skipped
C:\Documents and Settings\Pham Tuan Anh\Local Settings\Application Data\Mozilla\Firefox\Profiles\kgebqccq.default\Cache\_CACHE_MAP_ Object is locked skipped
C:\Documents and Settings\Pham Tuan Anh\Local Settings\Historique\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Pham Tuan Anh\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped
C:\Documents and Settings\Pham Tuan Anh\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Pham Tuan Anh\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\Pham Tuan Anh\ntuser.dat.LOG Object is locked skipped
C:\Program Files\Eset\cache\CACHE.NDB Object is locked skipped
C:\Program Files\Eset\infected\4LZR0ZDA.NQF Infected: Trojan.Win32.DNSChanger.cah skipped
C:\Program Files\Eset\infected\AIOCADAA.NQF Infected: not-a-virus:Monitor.Win32.Perflogger.cb skipped
C:\Program Files\Eset\infected\EVEI51AA.NQF/windowshk.dll Infected: not-a-virus:Monitor.Win32.Perflogger.ca skipped
C:\Program Files\Eset\infected\EVEI51AA.NQF/rinst.exe Infected: not-a-virus:Monitor.Win32.Perflogger.163 skipped
C:\Program Files\Eset\infected\EVEI51AA.NQF/windows.exe Infected: not-a-virus:Monitor.Win32.Perflogger.163 skipped
C:\Program Files\Eset\infected\EVEI51AA.NQF RAR: infected - 3 skipped
C:\Program Files\Eset\infected\EVEI51AA.NQF PE-Crypt.XorPE: infected - 3 skipped
C:\Program Files\Eset\infected\WM5V4SAA.NQF Infected: Trojan.Win32.DNSChanger.bkb skipped
C:\Program Files\Eset\logs\virlog.dat Object is locked skipped
C:\Program Files\Eset\logs\warnlog.dat Object is locked skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{9FA88749-ED4C-4E7C-9C60-70A8A508BE78}\RP2\change.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\ljJcDWMD.dll.vir Infected: Trojan.Win32.Monder.gen skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
D:\System Volume Information\_restore{9FA88749-ED4C-4E7C-9C60-70A8A508BE78}\RP2\change.log Object is locked skipped

Scan process completed.
  • 0

Advertisements


#2
koko_crunch

koko_crunch

    Trusted Helper

  • Retired Staff
  • 1,751 posts
Hello Pham and Welcome to Geeks to Go!

Sorry for the delay. We've been quite busy this week. :)

Anyways, we very much would like to help you with your problem but you must post a HijackThis log first. This will aid us in determining what type of malware infection(s) you may have on your system.

To do so,

Click here to download HJTInstall.exe
  • Save HJTInstall.exe to your desktop.
  • Doubleclick on the HJTInstall.exe icon on your desktop.
  • By default it will install to C:\Program Files\Trend Micro\HijackThis .
  • Click on Install.
  • It will create a HijackThis icon on the desktop.
  • Once installed, it will launch Hijackthis.
  • Click on the Do a system scan and save a logfile button. It will scan and the log should open in notepad.
  • Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log.
  • Come back here to this thread and Paste the log in your next reply.
  • DO NOT have Hijackthis fix anything yet. Most of what it finds will be harmless or even required.

Edited by koko_crunch, 13 June 2008 - 02:34 PM.

  • 0

#3
koko_crunch

koko_crunch

    Trusted Helper

  • Retired Staff
  • 1,751 posts
Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP