My Damn Computer Is Still Broken & I'm Sick of It. Here Are All The Details. Halp. (1 Viewer)

[ur_inner_child]

Halp me.

I'm using PC-Cillin
I have Spybot and Ad-aware etc

ADW_VIRTUMOND.CG is the virus name that keeps coming up and the action that can be taken is "deny access". :burn: ie nothing happens
It NEVER goes away.

I looked at forums etc on this virus and I don't understand the mumbo jumbo.

Every now and then I get a C+++ Buffer Overun message (or something along those lines. It's bound to come up eventually so I'll keep you posted)

Hijackthis Log (yeah jumb I know what it is now) is here:

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 10:28:46 PM, on 14/05/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\SYSTEM32\SVCHOST.EXE
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\EXPLORER.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PCCTLCOM.EXE
C:\Program Files\D-Link\AirPlus G\AirGCFG.exe
C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
C:\Program Files\Trend Micro\Internet Security 2006\pccguide.exe
C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\PROGRAM FILES\SECURITY TASK MANAGER\SPYPROTECTOR.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\VALVE\STEAM\STEAM.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\TMPFW.EXE
C:\PROGRAM FILES\LOGITECH\SETPOINT\SETPOINT.EXE
C:\Program Files\Common Files\Logitech\khalshared\KHALMNPR.EXE
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PCCMAIN.EXE
C:\PROGRA~1\TRENDM~1\INTERN~1\PCCLOG.EXE
C:\PROGRAM FILES\MOZILLA FIREFOX\FIREFOX.EXE
C:\Documents and Settings\Chris\My Documents\HJT\HiJackThis_v2.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 203.26.206.131:553
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {2A8175F8-BB8E-49FD-B9FA-6A5EAA45A48D} - C:\WINDOWS\system32\ssqpq.dll
O2 - BHO: (no name) - {483CC496-D041-4545-8D9E-2D64294F97B2} - C:\WINDOWS\system32\efccaaw.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {67C55A8D-E808-4caa-9EA7-F77102DE0BB6} - C:\WINDOWS\system32\mittjcwh.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Norton Internet Security - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [SW20] C:\WINDOWS\system32\sw20.exe
O4 - HKLM\..\Run: [SW24] C:\WINDOWS\system32\sw24.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [D-Link AirPlus G] C:\Program Files\D-Link\AirPlus G\AirGCFG.exe
O4 - HKLM\..\Run: [ANIWZCS2Service] C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 2006\pccguide.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [Spy Protector] C:\PROGRAM FILES\SECURITY TASK MANAGER\SPYPROTECTOR.EXE /autostart
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Steam] C:\Valve\Steam\Steam.exe -silent
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Orb] "C:\Program Files\Orb Networks\Orb\bin\OrbTray.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Logitech SetPoint.lnk = ?
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://aolsvc.aol.com/onlinegames/bejeweled2/popcaploader_v10.cab
O20 - Winlogon Notify: efccaaw - C:\WINDOWS\SYSTEM32\efccaaw.dll
O20 - Winlogon Notify: ssqpq - C:\WINDOWS\system32\ssqpq.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: ANIWZCSd Service (ANIWZCSdService) - Alpha Networks Inc. - C:\Program Files\ANI\ANIWZCS2 Service\ANIWZCSdS.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe

--
End of file - 10042 bytes

Halp.

Possible sex to teh winnar.

 

[Serius]

hmm have you ever had norton installed? because i once had it and i hated it, used up too much resources and it was basically spyware.

I just see Symantec and cringe

O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec

So whats the symptoms, whats the specs on your comp comon woman you are a mod you should know the rules!
http://community.boredofstudies.org/123/central/56511/stuff-rules-please-read-before-posting.html

the virus looks like spyware to me, did adaware find anything?

 

[Raginsheep]

http://kb.trendmicro.com/solutions/search/main/search/solutionPrint.asp?solutionID=26306

2 secs on google next time

 

[ur_inner_child]

Re: My Damn Computer Is Still Broken & I'm Sick of It. Here Are All The Details. Ha

http://kb.trendmicro.com/solutions/search/main/search/solutionPrint.asp?solutionID=26306

2 secs on google next time

yeah I did that first, but that virtumondo.exe it tells me to download doesn't work. The file isn't there.

Or am I missing something entirely?

 

[ur_inner_child]

Re: My Damn Computer Is Still Broken & I'm Sick of It. Here Are All The Details. Ha

hmm have you ever had norton installed? because i once had it and i hated it, used up too much resources and it was basically spyware.

I just see Symantec and cringe



So whats the symptoms, whats the specs on your comp comon woman you are a mod you should know the rules!
http://community.boredofstudies.org/123/central/56511/stuff-rules-please-read-before-posting.html

the virus looks like spyware to me, did adaware find anything?

I rarely go into this forum and mingle with you nerds I kid! <3

System Overview

Operating System Microsoft Windows XP Home Edition Service Pack 2 (Build 2600)

System Memory 2049.0

Processor Speed 3014.7

DirectX Version 9.0c

Display Device MSI NX7900 GT (NVIDIA GeForce 7900 GT)

Display Memory 256.0

Display Driver 6.14.10.8419

Sound Device Realtek HD Audio output

Sound Driver 5.10.0.5397



Operating System Information
Microsoft Windows XP Home Edition Service Pack 2 (Build 2600)

Internet Explorer Information
Version 7.00.5730.0011


System Device Information
Processor
Intel Intel(R) Pentium(R) D CPU 3.00GHz 3014.7 Mhz

Memory
System Total 2049.0
Virtual Total 2047.9
Pagefile Total 4096.0

Snapshot
System Available 2048.0
Virtual Available 1991.4
Pagefile Available 4096.0

Monitor Information
Monitor Name Plug and Play Monitor
Refresh Rate 60 Hz

Network Card Information
Name Broadcom NetLink (TM) Gigabit Ethernet - Packet Scheduler Miniport
IP Address 10.1.1.2
Subnet Mask 255.0.0.0
Gateway 10.1.1.1
Primary WINS Server N/A
DHCP 10.1.1.1

Media Device Information
Mass Storage Devices
Type Removable
File System N/A
Total Space 0 Bytes
Free Space 0 Bytes

Mass Storage Devices
Type Fixed
File System NTFS
Total Space 232.9 GB
Free Space 47.7 GB

Mass Storage Devices
Type CD / DVD Drive
File System UDF
Total Space 674.5 MB
Free Space 0 Bytes

DirectX Information
Version 9.0c
Long Version 4.09.0000.0904

Display Device (Primary Only)
MSI NX7900 GT (NVIDIA GeForce 7900 GT)
Device
Description MSI NX7900 GT (NVIDIA GeForce 7900 GT)
Manufacturer NVIDIA Corporation
GUID D7B71E3E-41D1-11CF-D277-60260EC2CD35

Driver
Version 6.14.10.8419
Module nv4_disp.dll
Date 3-7-2006

Memory
Local 256.0
Local 242.6
Non-Local 376.0
Texture 618.6

Enough specs?

Oh and ad-aware hasn't found anything Neither has spybot which just picks up cookies.

 

[Raginsheep]

Re: My Damn Computer Is Still Broken & I'm Sick of It. Here Are All The Details. Ha

Tried this one?

http://www.trendmicro.com/vinfo/grayware/ve_graywareDetails.asp?GNAME=ADW_VIRTUMONDO.G&VSect=Sn

 

[mr_brightside]

Re: My Damn Computer Is Still Broken & I'm Sick of It. Here Are All The Details. Ha

god dammit stef. stop looking at pornography sites.
They mess up yr puterz.

 

[ur_inner_child]

Re: My Damn Computer Is Still Broken & I'm Sick of It. Here Are All The Details. Ha

oh oh and security task manager thingo

I've googled the top three and they're apparently the problem (ie pretty bad). I tried to remove it (throught the security task manager) but it doesn't work and I've tried it in safe mode.

They're apparently browser extensions for IE (which i steer clear of. I've been using firefox for the last two months).

Here is a sexy pic.

 

[ur_inner_child]

Re: My Damn Computer Is Still Broken & I'm Sick of It. Here Are All The Details. Ha

Tried this one?

http://www.trendmicro.com/vinfo/grayware/ve_graywareDetails.asp?GNAME=ADW_VIRTUMONDO.G&VSect=Sn

Such a huge long set of instructions with words I don't understand.

I might have to put an hour or two aside to fix it hey

 

[ur_inner_child]

Re: My Damn Computer Is Still Broken & I'm Sick of It. Here Are All The Details. Ha

god dammit stef. stop looking at pornography sites.
They mess up yr puterz.

itz an addictshon lulz

 

[Raginsheep]

Re: My Damn Computer Is Still Broken & I'm Sick of It. Here Are All The Details. Ha

Just click on "Download the fixtool"

USING TREND MICRO FIXTOOL

Trend Micro has released a fixtool that automatically removes this grayware from affected systems. Download the fixtool, and then extract and run FIX_VIRTUMONDO.EXE.

 

[ur_inner_child]

Re: My Damn Computer Is Still Broken & I'm Sick of It. Here Are All The Details. Ha

Just click on "Download the fixtool"

will let you know if that works.

This isn't actually my computer (but the boyfriend's and I live with him) and I'm pretty sure he's done this but I'll give it a shot

<3

 

[jumb]

Re: My Damn Computer Is Still Broken & I'm Sick of It. Here Are All The Details. Ha

will let you know if that works.

This isn't actually my computer (but the boyfriend's and I live with him) and I'm pretty sure he's done this but I'll give it a shot

<3

Haha, your boyfriend was looking up porn on it cause you can't satisfy him.

 

[CSI: CRIMES ™]

Re: My Damn Computer Is Still Broken & I'm Sick of It. Here Are All The Details. Ha

hmm i had something like that very similar, it wasn't due to porn though


there's this tech site i go to thats very helpful and most of my computer woes has been solved due to help from tuts there.


http://www.techspot.com/vb/topic58138.htmlViruses/Spyware/Malware, preliminary removal instructions.

How to get rid of Symantec/Norton (for good!!)


hope it helps

 

[Shotgun Wedding]

Re: My Damn Computer Is Still Broken & I'm Sick of It. Here Are All The Details. Ha

BAI A MAC LULZ

I think this is too techy even for me... Possibly because I am not really lookign closely.

 

[cl3nta]

Re: My Damn Computer Is Still Broken & I'm Sick of It. Here Are All The Details. Ha

just format your drive then stay off the porn

 

[Bacilli]

Have you tried scanning the computer online at http://housecall.trendmicro.com/ while in safemode?

Sounds as if the key is still within the registry
thus the anti-virus program failed to remove the virus completely.

Also, logon to the recovery console, and when the C:/> prompt has loaded, type: CHKDSK /R (then hit enter)

Once completed, go back to the C:/> prompt and type, SFC SCANNOW /F

Hit enter and listen next time.

 

[cb205]

Try downloading Avast (availble from avast.com or filehippo) and doing a boot scan.
Very useful program.

 

[HotShot]

Re: My Damn Computer Is Still Broken & I'm Sick of It. Here Are All The Details. Ha

So what happened?

If you are really having problems.

1. Backup everything.
2. Format and reinstall Win XP.
3. Install AVG, Comodo Firewall & Spybot Search Destry + Adaware
4. Use Firefox with NoScript

5. WATCH PORN ALL YOU LIKE!!!

 

[ur_inner_child]

Re: My Damn Computer Is Still Broken & I'm Sick of It. Here Are All The Details. Ha

Yeah what I said I would try didn't work. Apparently it's been tried already.

I spoke to another boser and they advised AVG and Windows Defender. Everything seems to be in running order. AVG found 4 trojan horses and were able to get rid of them (other virus software found them but couldn't get rid of them) and Windows Defender was able to get rid of ADW_VIRTUMOND.CG when other adware fixing programs could not. The buffer overun apparently is someone trying to patch IE and just didn't hide the error? I don't know if I'm quoting that right.

It's not my computer. I only use it and complain about it because my laptop is officially gone. By gone, I mean, it's pretty old, and it's probably time for a new one, considering its like the millionth time something has broken (cable ribbon, cd drive, etc). But yeah, forcing all users of this comp to use firefox! I even deleted the IE icon

Thanks guys I suppose its just a matter of what softwares you have? Anyway, <3. I had enough of random shutdowns, corrupted files, lagging, surprise porn etc.