Infested w. Virtumonde, Mebroot, TDSServ, Spyware Guard 2008 (page 2)

kstubbs · 2008-12-12T20:19:58+00:00

My PC was infected by Spyware Guard 2008 about 10 days ago (at least Spyware Guard 2008 was the first one I noticed). The malware persistently pops up fake scan result windows & Windows Security Center windows & repairs registry entries & program files quicker than I can regedit & delete. It blocks my access to security websites & intercepts outgoing mail to those sites while falsely making Outlook appear to have sent the messages. I tried to install Spyware Doctor, but couldn't register it to activate its repair facilities because http://www.pctools.com was blocked. I was able to run a Spyware Doctor full scan with rootkit checking on, which indicates extensive infection by Virtumonde, Mebroot, TDSServ, Spyware Guard 2008, and several trojan downloaders (Small.BUY, VB.AWJ, xpre). The scan also lists unnamed hidden files in c:\windows, c:\windows\system32, c:\windows\Temp, and c:\Documents and Settings\[user]\Local Settings\Temp. The registry entries for TDSServ seem to indicate that i

Odd dude

December 18, 2008, 5:59 AM UTC

My bad - had a syntax error.

I did not run Combofix /u yet.

GOOD

Right click upload.bat and choose edit, copy and paste this then save:

@ECHO OFF

::

:: As requested in the following thread:

:: http://malwareremoval.com/forum/viewtopic.php?p=382225#p382225

::

:: Pleased to serve you :-)

::

::

::    ~ Odd dude

::

FOR %%G IN (





c:\qoobox\quarantine\c\windows\system32\awtUKabx.dll.vir







C:\Qoobox\Quarantine\C\windows\system32\sufabuwu.exe.vir

C:\Qoobox\Quarantine\C\windows\system32\tipenuno.exe.vir

C:\Qoobox\Quarantine\C\windows\system32\nulapawa.exe.vir

C:\Qoobox\Quarantine\C\windows\system32\zotemiso.exe.vir





) DO Zip.exe -Sq UploadThis %%G

Zip.exe -mq UploadThis %0

Then rerun upload.bat

It should work fine now...
Please upload the zip as instructed in my previous post.
Let me know you have uploaded the file and then you can run combofix /u

Thank you for being so cooperative. You are one of the most helpful users I have ever encountered

kstubbs

December 18, 2008, 4:11 PM UTC

That script worked & I uploaded the zip file per your instructions. I've got some errands to run now, so I'll uninstall ComboFix later today.

Thanks once again for all your help. Before this incident, I had no idea how sophisticated malware has grown. I have a lot of respect for people like you who fight it by developing countermeasures & guiding people like me through recovery.

kstubbs

December 18, 2008, 4:19 PM UTC

One more question: can/should I also remove SmitfraudFix.exe and GMER?

Odd dude

December 18, 2008, 8:33 PM UTC

Thanks once again for all your help. Before this incident, I had no idea how sophisticated malware has grown. I have a lot of respect for people like you who fight it by developing countermeasures & guiding people like me through recovery.

No problem