Restart problem may be related to virtumonde

[lenny24]

Hi, I too am having the restart issue.  This happened shortly after avast successfully intercepted two trojans that came from a website. I deleted them on the spot when I got the warning message but then I decided to run a full virus and spybot scan to be safe. Avast detected nothing but spybot detected the virtumonde thing. I believe I deleted it, but the system seems to boot up slowly now and I get the restart system error every time from avast.

I saw another person mention virtumonde and I think that is the problem and not what the other person was saying about adobe acrobat. I don't even have adobe update on my system and I am having this problem.

[lenny24]

Here is a bit more info, the website thinks the attack came from a third party ad source and not from their site, but regardless I was bombarded by:

Two trojans that avast successfully intercepted.

Virtumonde which made it through and installed, but was soon thereafter successfully removed by spybot.

Internet Speed Monitor which caused a bunch of pop ups & IE to start on its own.

I removed the Internet speed monitor through add / remove which has happened before, and the two trojans never installed.

The only thing that made it through was Virtumonde, which although apparently now removed from my system, has left avast seemingly messed up with the restart error. Also I have tried full avast uninstall and reinstall and it does not solve this issue. 

[FreewheelinFrank]

Check for the new hidden files of Vundo using the tool essexboy mentioned here:

http://forum.avast.com/index.php?topic=32297.msg269971#msg269971

What browser were you using? Is everything on your computer up to date? These drive-by downloads usually require out of date, un-patched and vulnerable software to be present.

Scan with Secunia Software Inspector to reveal any security weaknesses.

[lenny24]

Check for the new hidden files of Vundo using the tool essexboy mentioned here:

http://forum.avast.com/index.php?topic=32297.msg269971#msg269971

What browser were you using? Is everything on your computer up to date? These drive-by downloads usually require out of date, un-patched and vulnerable software to be present.

Scan with Secunia Software Inspector to reveal any security weaknesses.

I tried everything you mentioned and nothing helped. I even tried system restore but for whatever reason, even though system restore had been on and the system volume information folder had a bunch of restore points, after the vermonde infection it was empty.  I use firefox and all software was up to date. I am a pretty knowledgeable user and this has me completely lost. It would seem the Virtumonde was successfully removed by Spybot, but it left a lot of damage in its wake. My hunch is the registry hotkeys and some other things were altered during the infection that cause the current issue with avast restart needed and the now seemingly slow Windows boots. Haven't ahad an issue like this in years, usually spybot and avast do the trick immediately. 

[Lisandro]

Virtumonde? This link could give a little help.
http://www.symantec.com/security_response/writeup.jsp?docid=2003-120914-4108-99&tabid=3

[oldman]

The tool described in the essexboy's post will produce a list of altered files. You will be able to see which programs are corrupted.

this link will take you to his post and the tool link.

http://forum.avast.com/index.php?topic=32297.msg269932#msg269932

[lenny24]

Thanks, though I tried that one before and it didn't work. I did find something else that seems to work, here is more of an update:

It seems the infection can be caused in a number of ways including having Sun java 1.5 or earlier.

I tried a program by a company named atribune called Vundofix. Vundofix detected and removed a ton of Virtumonde files on my system that neither spybot nor avast could detect at all. It seemed to remove all but one .dll file, but I am still getting the avast start error and the boot is still slow but definitely better then before.

Whatever this problem is it is definitely related to a new more potent virtumonde infection. Looks like avast has some work to do to fix whatever virtumonde messed up. I still think the issue is probably related to damage in the windows / avast registry. I am rescanning now to see if Vundofix redetects the files, if I don't post in a few minutes it means the second scan was clean and the best first step to solving this issue is to get Vundofix to at least get rid of the virus and then go from there with resolving the other issues.

[lenny24]

Nope, the VundoFix scan seems to redetect the files. I am going to try another method, where VundoFix detects and shows exact location of infected Virtumonde files, then I will try to find this dos boot deletion program I used to have that can delete files before windows boot. That may get rid of this.

[Lisandro]

I will try to find this dos boot deletion program I used to have that can delete files before windows boot. That may get rid of this.

Just take care. Some files, even infected, are needed to boot.
I recommend you backup your data and documents...

[lenny24]

Just take care. Some files, even infected, are needed to boot.
I recommend you backup your data and documents...

Hang on, here is a list of all the files in question, let me know if any are critical before I boot delete them. lol 

c:\windows\system32\opnopur.dll
c:\windows\system32\qtutv.ini
c:\windows\system32\qtutv2.ini
c:\windows\system32\vtutq.dll
c:\windows\system32\vtutq.exe

I think they are all crap files, it seems the list of bad files is about 40% less then the original scan so the first time fixed some of them and improved it a little. If these files look good to delete I will try the boot delete next.

[Lisandro]

All crap...

[lenny24]

Great deleting now, will let you know what happens, hopefully this may be the start of a fix to this whole Virtumonde avast restart issue.

[lenny24]

Alright here is the update, this is a MAJOR problem

Vundofix deletes the files, then on restart it says it cannot start the virus as specifies in the windows registry (Anyone know how I can turn it off in the registry? where it is?)

then on next reboot all the Vundo / Virtumonde files are back. In addition to the ones listed hkcmd.exe and igfxpers.exe are also back.

What's most incredible is that even my boot-delete tool, which until now has deleted everything, cannot seem to remove these Vundo files?

Any ides? Anyone? This is definitely the cause of the slow boot and avast problems.

I am going to try the symantec vundo removal tool next....

Edit: Update As expected symantec didn't even detect anything. The only thing that can even detect it is Vundofix by atribune, but that tool isn't able to delete it. Any ideas on how to deactivate it from registry? Where the system 32 start up keys are?

[Lisandro]

What's most incredible is that even my boot-delete tool, which until now has deleted everything, cannot seem to remove these Vundo files?

Rootkit technology... I suggest you visit this page http://www.antirootkit.com/software/index.htm for antirootkit detection, removal & protection.
Comparison test here: http://www.informationweek.com/software/showArticle.jhtml?articleID=196901062&pgno=1&queryText=

Full computer on-line scanning:
Kaspersky
Trendmicro housecall
Ewido
F-Secure
Spysweeper

[lenny24]

What's most incredible is that even my boot-delete tool, which until now has deleted everything, cannot seem to remove these Vundo files?

Rootkit technology... I suggest you visit this page http://www.antirootkit.com/software/index.htm for antirootkit detection, removal & protection.
Comparison test here: http://www.informationweek.com/software/showArticle.jhtml?articleID=196901062&pgno=1&queryText=

Full computer on-line scanning:
Kaspersky
Trendmicro housecall
Ewido
F-Secure
Spysweeper

Great info thanks, I am trying something called trojanhunter 5.0 by mischele or something software which according to wiki, is the only program that can handle the latest version of this vundo thing. If that doesn't work I will try one of these rootkit detectors next. Will any of this stuff be incorporated into avast eventually? I will try to find out how to deactivate the virus in the registry too if it's possible and nothing above works.

Edit: Trojanhunter did not work, this must be a very new and very bad version of vundu / virtumonde. I tried that other file by the forum user and nothing seemed to happen.