Virtumonde computer virus anyone?

[WishingOnAStar]

Anyone have this? Did you successfully get rid of it??
My spy-ware and ad-aware programs keep picking it up, but say they can't get rid of all it b/c, I guess, it's always in use or something.
My computer is running incredibly slow and I'm sure that's why.

I don't want to blindly use a removal program off the internet. I'm hoping someone has had some experience with this.

TIA

 

[flipturngirl]

hmn never heard of it

 

[WishingOnAStar]

I wish I never had- believe me!

 

[tropical depression]

it looks like a tough little sucker- multiple processes, .dll's, and registry changes.

 

[WishingOnAStar]

it looks like a tough little sucker- multiple processes, .dll's, and registry changes.

Exactly! And I'm about ready to just buy a new computer!! LOL

I'm just so afraid of using the wrong program to fix and, in the process, make things worse!

 

[HonestAbe]

Try this.

http://www.symantec.com/security_response/writeup.jsp?docid=2003-120914-4108-99&tabid=3

Also, on the regedit part if it says it's in use press the F8 key on your keyboard after you have restarted your computer either right before or as quick as you can when you see the Windows XP splash screen with the little scrolling bar and then boot into safe mode. Then you login locally and run the reg clean up.

You should also try Spybot Search and Destroy as well as AdAware. Just google them and you'll find them. It will see the junk and tell you it needs to rescan at the next startup and let it do it's thing.

Or you could box it up and send it to me and I'll clean it for you for a minimal fee

 

[tropical depression]

try pulling up the task manager and killing:
kopCFEWV.exe
castlecops[1].exe
unknown.exe
svci.exe
psdrv.exe

then run your spyware/adware apps

man, I don't miss the old spyware/virus removal games at all.

 

[starwood]

Go to this site http://forums.whatthetech.com/forums.html. They do wonders with cleaning up your computer. First you download a file called Hijack This and when you first post your problem you post your log. They will then take you step by step through the process of cleaning your computer. They cleaned mine a few times and I just got finished cleaning up DS's. He had the Virusprotect Pro virus.

 

[WishingOnAStar]

I am going to work on all this tomorrow when the kids are in school.
Thank you for the ideas. I'll let you know if it works.

 

[WishingOnAStar]

Okay, I've done everything but the Hijack This thing. Everytime a virus program (McAfee, Spybot and Ad-Aware) runs it finds it, but can't delete 2 parts of it:
executable
c:\\windows\system32\awtsp.dll
c:\\windows\system32\yayxwwu.dll

I guess I'm off to the Hijack This site. If nothing there works, I'm throwing it in the trash!! LOL

 

[WishingOnAStar]

Update: Just wanted to let you all know that the Hijack This site ROCKS!!! After 2 days, several posts, and lots of downloads and log reports, they COMPLETELY fixed my problem!!!

Thank you, thank you starwood for letting me know about that site!!

 

[starwood]

I'm so glad they helped. They have done wonders for me.

 

[aprilgail2]

Go to this site http://forums.whatthetech.com/forums.html. They do wonders with cleaning up your computer. First you download a file called Hijack This and when you first post your problem you post your log. They will then take you step by step through the process of cleaning your computer. They cleaned mine a few times and I just got finished cleaning up DS's. He had the Virusprotect Pro virus.

Thanks for this post!!! I have the virtumonde virus along with some others and the person that is working with me on that site is AWESOME. They have me sending them all kinds of logs and they go through them and tell me what to do next, already I am not getting any kinds of pop ups I was getting-it seems they think I want to meet girls in my area, see naked girls or that I want to gamble with the kinds of pop ups I was getting!!!
Can I ask how much you donated to the site when you were finished, or what you think a average donation would be???

 

[crazelion]

I was just about post go castle cops.com The computer cops and do everything say before download hijackthis. I did there malware removal programs just clean up my computer tonight from J/S Downloader.agent virus. I love this forum.

 

[WishingOnAStar]

Thanks for this post!!! I have the virtumonde virus along with some others and the person that is working with me on that site is AWESOME. They have me sending them all kinds of logs and they go through them and tell me what to do next, already I am not getting any kinds of pop ups I was getting-it seems they think I want to meet girls in my area, see naked girls or that I want to gamble with the kinds of pop ups I was getting!!!
Can I ask how much you donated to the site when you were finished, or what you think a average donation would be???

I tried to donate $ but it said they don't accept donations any longer. I was willing to donate $100 because I figured it would have cost me WAY more to have someone in here to do it. It was very time consuming.

 

[mandy200587]

Popping in here and can I make a suggestion? Ditch McAfee or Norton, both have ways of viruses getting past their defense system. There are loopholes. Use AVG the free version for virus scan. I ran into a problem with Norton where it had a glitch and had me thinking there was a virus on my computer and there wasn't.

 

[aprilgail2]

I tried to donate $ but it said they don't accept donations any longer. I was willing to donate $100 because I figured it would have cost me WAY more to have someone in here to do it. It was very time consuming.

really?? They have a paypal link on the page, I have not tried it out but i saw it there...I will have to check it out.

 

[WishingOnAStar]

really?? They have a paypal link on the page, I have not tried it out but i saw it there...I will have to check it out.

Yeah, the guy that was helping me had the link in his signature. I clicked on it and it said that they no longer accept donations. When I mentioned it to him, he said that was true and he had to change his signature (which he promptly did).