Cannot get rid of Virtumonte/Vundo and trojans

[alan5577]

My computer is affected by several viruses.

I originally tried to run your product several times but the viruses kept comming back.

I then read your forum and did what it said.

I (hope that I) have followed the directions correctly.

My MBAM SCAN

-----------------------------------------------------------------

Malwarebytes' Anti-Malware 1.30

Database version: 1433

Windows 5.1.2600 Service Pack 3

11/28/2008 5:48:58 PM

mbam-log-2008-11-28 (17-48-58).txt

Scan type: Quick Scan

Objects scanned: 63126

Time elapsed: 3 minute(s), 32 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 1

Registry Keys Infected: 0

Registry Values Infected: 1

Registry Data Items Infected: 3

Folders Infected: 0

Files Infected: 1

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

C:\WINDOWS\system32\savobaro.dll (Trojan.Vundo) -> Delete on reboot.

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zadidatebo (Trojan.Agent) -> Quarantined and deleted successfully.

Registry Data Items Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Vundo) -> Data: c:\windows\system32\savobaro.dll -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo) -> Data: c:\windows\system32\savobaro.dll -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Vundo) -> Data: system32\savobaro.dll -> Quarantined and deleted successfully.

Folders Infected:

(No malicious items detected)

Files Infected:

C:\WINDOWS\system32\savobaro.dll (Trojan.Vundo) -> Delete on reboot.

---------------------------------------------------------------------------------------------

MY PANDA ACTIVE SCAN

;*************************************************************************

***

********************************************************************************

*

**********************

ANALYSIS: 2008-11-29 10:10:46

PROTECTIONS: 1

MALWARE: 26

SUSPECTS: 0

;*******************************************************************************

********************************************************************************

*

*******************

PROTECTIONS

Description Version Active Updated

;===============================================================================

================================================================================

=

===================

Symantec Antivirus Corporate Edition 9.0 No Yes

;===============================================================================

================================================================================

=

===================

MALWARE

Id Description Type Active Severity Disinfectable Disinfected Location

;===============================================================================

================================================================================

=

===================

00034347 dialer.su Dialers No 0 Yes No hkey_local_machine\software\microsoft\windows\currentversion\uninstall\switch

00048526 spyware/web3000 Spyware No 0 Yes No c:\windows\hh.ico

00139059 Cookie/Traffic Marketplace TrackingCookie No 0 Yes No C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\jt68c4rq.default\cookies-1.txt[.trafficmp.com/]

00139059 Cookie/Traffic Marketplace TrackingCookie No 0 Yes No C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\jt68c4rq.default\cookies-1.txt[.trafficmp.com/]

00139059 Cookie/Traffic Marketplace TrackingCookie No 0 Yes No C:\Documents and Settings\Dan\Cookies\dan@trafficmp[2].txt

00139060 Cookie/Casalemedia TrackingCookie No 0 Yes No C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\jt68c4rq.default\cookies-1.txt[.casalemedia.com/]

00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No C:\Documents and Settings\Guest\Application Data\Mozilla\Firefox\Profiles\xf8tj1fa.default\cookies.txt[.atdmt.com/]

00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\jt68c4rq.default\cookies-1.txt[.atdmt.com/]

00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No C:\Documents and Settings\Dan\Cookies\dan@atdmt[2].txt

00145405 Cookie/RealMedia TrackingCookie No 0 Yes No C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\jt68c4rq.default\cookies-1.txt[.247realmedia.com/]

00145457 Cookie/FastClick TrackingCookie No 0 Yes No C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\jt68c4rq.default\cookies-1.txt[.fastclick.net/]

00145457 Cookie/FastClick TrackingCookie No 0 Yes No C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\jt68c4rq.default\cookies-1.txt[.fastclick.net/]

00145738 Cookie/Mediaplex TrackingCookie No 0 Yes No C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\jt68c4rq.default\cookies-1.txt[.mediaplex.com/]

00145738 Cookie/Mediaplex TrackingCookie No 0 Yes No C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\jt68c4rq.default\cookies-1.txt[.mediaplex.com/]

00167749 Cookie/Toplist TrackingCookie No 0 Yes No C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\jt68c4rq.default\cookies-1.txt[.toplist.cz/]

00167753 Cookie/Statcounter TrackingCookie No 0 Yes No C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\jt68c4rq.default\cookies-1.txt[.statcounter.com/]

00167753 Cookie/Statcounter TrackingCookie No 0 Yes No C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\jt68c4rq.default\cookies-1.txt[.statcounter.com/]

00167753 Cookie/Statcounter TrackingCookie No 0 Yes No C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\jt68c4rq.default\cookies-1.txt[.statcounter.com/]

00167753 Cookie/Statcounter TrackingCookie No 0 Yes No C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\jt68c4rq.default\cookies-1.txt[.statcounter.com/]

00167753 Cookie/Statcounter TrackingCookie No 0 Yes No C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\jt68c4rq.default\cookies-1.txt[.statcounter.com/]

00167753 Cookie/Statcounter TrackingCookie No 0 Yes No C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\jt68c4rq.default\cookies-1.txt[.statcounter.com/]

00167753 Cookie/Statcounter TrackingCookie No 0 Yes No C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\jt68c4rq.default\cookies-1.txt[.statcounter.com/]

00168048 Cookie/Overture TrackingCookie No 0 Yes No C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\jt68c4rq.default\cookies-1.txt[.perf.overture.com/]

00168076 Cookie/BurstNet TrackingCookie No 0 Yes No C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\jt68c4rq.default\cookies-1.txt[.burstnet.com/]

00168076 Cookie/BurstNet TrackingCookie No 0 Yes No C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\jt68c4rq.default\cookies-1.txt[.burstnet.com/]

00168097 Cookie/BurstBeacon TrackingCookie No 0 Yes No C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\jt68c4rq.default\cookies-1.txt[www.burstbeacon.com/]

00169190 Cookie/Advertising TrackingCookie No 0 Yes No C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\jt68c4rq.default\cookies-1.txt[.advertising.com/]

00170495 Cookie/PointRoll TrackingCookie No 0 Yes No C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\jt68c4rq.default\cookies-1.txt[.ads.pointroll.com/]

00170495 Cookie/PointRoll TrackingCookie No 0 Yes No C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\jt68c4rq.default\cookies-1.txt[.ads.pointroll.com/]

00170495 Cookie/PointRoll TrackingCookie No 0 Yes No C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\jt68c4rq.default\cookies-1.txt[.ads.pointroll.com/]

00170495 Cookie/PointRoll TrackingCookie No 0 Yes No C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\jt68c4rq.default\cookies-1.txt[.ads.pointroll.com/]

00170554 Cookie/Overture TrackingCookie No 0 Yes No C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\jt68c4rq.default\cookies-1.txt[.overture.com/]

00170556 Cookie/RealMedia TrackingCookie No 0 Yes No C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\jt68c4rq.default\cookies-1.txt[.realmedia.com/]

00170556 Cookie/RealMedia TrackingCookie No 0 Yes No C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\jt68c4rq.default\cookies-1.txt[.realmedia.com/]

00172221 Cookie/Zedo TrackingCookie No 0 Yes No C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\jt68c4rq.default\cookies-1.txt[.zedo.com/]

00172221 Cookie/Zedo TrackingCookie No 0 Yes No C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\jt68c4rq.default\cookies-1.txt[.zedo.com/]

00173520 Cookie/Bluestreak TrackingCookie No 0 Yes No C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\jt68c4rq.default\cookies-1.txt[.bluestreak.com/]

00207338 Cookie/Target TrackingCookie No 0 Yes No C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\jt68c4rq.default\cookies-1.txt[.target.com/]

00207338 Cookie/Target TrackingCookie No 0 Yes No C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\jt68c4rq.default\cookies-1.txt[.target.com/]

00325830 Cookie/Bridgetrack TrackingCookie No 0 Yes No C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\jt68c4rq.default\cookies-1.txt[citi.bridgetrack.com/]

00325830 Cookie/Bridgetrack TrackingCookie No 0 Yes No C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\jt68c4rq.default\cookies-1.txt[citi.bridgetrack.com/]

00456116 Adware/Antivirus2009 Adware No 0 Yes No C:\Documents and Settings\Dan\Local Settings\Temporary Internet Files\Content.IE5\4ZNMQGJC\freescan[1].htm

01048936 Generic Malware Virus/Trojan No 0 Yes No C:\System Volume Information\_restore{81B97F51-08EC-4BF7-B467-C437DF027378}\RP6\A0002200.dll

03508074 Adware/Zenosearch Adware No 0 Yes No C:\WINDOWS\system32\rswnw64l.exe.bak

03548697 Trj/Clicker.ALY Virus/Trojan No 1 No No C:\WINDOWS\system32\g73.exe[■%%\²ºÇ]

03930908 Bck/Hupigon.AZG Virus/Trojan No 1 No No C:\download\psp_video_express.exe[PQDVD_PSP.exe]

;===============================================================================

================================================================================

=

===================

SUSPECTS

Sent Location

[alan5577]

Sorry, I see I posted this on the incorrect forum. I have reposted it.