Okay, so I got virtumonde a few days ago, no idea how but whatever. I have tried my best to follow Osiris' spyware removal guide but my pc wont run some of the programs, whether this is because of the virus or my pc being very old I don't know, but I did what I could.
Having run smitfraudfix, trojan remover, vundofix and virtumundo-be-gone, i have got rid of the bulk of the problem files (I think), the background has gone, the screensaver has gone, and a lot of the bad files have been deleted, but I think virtumonde is still on my system. Any help in purging it would be very much appreciated (I especially can't figure out how to remove the .dll which is associated with winlogon)
Here is my Hijackthis log, and virtumundo be gone log if it's helpful:
HIJACKTHIS LOG
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:19:21, on 01/10/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Norton Internet Security\ISSVC.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\system32\bgsvcgen.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\System32\wltrysvc.exe
C:\WINDOWS\System32\bcmwltry.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Owner\Application Data\Simply Super Software\Trojan Remover\rmnA.exe
C:\Documents and Settings\Owner\Application Data\Simply Super Software\Trojan Remover\rmnA.exe
C:\Program Files\HijackThis\HijackThis.exe
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
Lycos - meet you there
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll
O2 - BHO: (no name) - {6815E408-7C40-4F62-8004-57F61939B1E1} - C:\WINDOWS\system32\awtsPFWq.dll (file missing)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: CNisExtBho Class - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: SidebarAutoLaunch Class - {F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D} - C:\Program Files\Yahoo!\browser\YSidebarIEBHO.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O3 - Toolbar: MSN Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar\01.01.1629.0\en-gb\msntb.dll
O3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\yt.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exe /boot
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [Suite] regedit -s c:\windows\temp\adj_hp.reg (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [ctfmon.exe] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [Suite] regedit -s c:\windows\temp\adj_hp.reg (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: BT Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Money Viewer - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.tesco.net
O15 - Trusted Zone: *.line6.net
O16 - DPF: Yahoo! Go Fish -
http://download2.games.yahoo.com/gam...ts/y/zt3_x.cab
O16 - DPF: Yahoo! Spades -
http://download2.games.yahoo.com/gam...ts/y/st3_x.cab
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) -
http://messenger.zone.msn.com/binary...r.cab27571.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) -
http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} -
http://ak.imgfarm.com/images/nocache...tup1.0.0.8.cab
O16 - DPF: {205FF73B-CA67-11D5-99DD-444553540006} (CInstall Class) -
http://www.errorguard.com/installation/Install.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) -
http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) -
http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) -
https://webdl.symantec.com/activex/symdlmgr.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -
http://update.microsoft.com/microsof...?1140981894092
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) -
http://messenger.zone.msn.com/binary...t.cab27571.cab
O16 - DPF: {B020B534-4AA2-4B99-BD6D-5F6EE286DF5C} (Symantec Download Bridge) -
https://a248.e.akamai.net/f/248/5462...l/SymDlBrg.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) -
http://messenger.msn.com/download/Ms...Downloader.cab
O16 - DPF: {C606BA60-AB76-48B6-96A7-2C4D5C386F70} (PreQualifier Class) -
http://www.sc-server1.bt.com/broadba...ivePreQual.cab
O16 - DPF: {CD995117-98E5-4169-9920-6C12D4C0B548} (HGPlugin9USA Class) -
ijji - Where Gamers Unite!
O16 - DPF: {CE69F98F-2AF3-4306-BAC6-A79070EDA1B4} (Zylom Loader Object) -
http://eu.download.games.yahoo.com/z...ylomloader.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) -
http://www.shockwave.com/content/bej...ploader_v6.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) -
http://messenger.zone.msn.com/binary...n.cab27571.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: B's Recorder GOLD Library General Service (bgsvcgen) - B.H.A Corporation - C:\WINDOWS\system32\bgsvcgen.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver - HP - C:\WINDOWS\System32\HPHipm09.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: WLTRYSVC - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe
O23 - Service: YPCService - Yahoo! Inc. - C:\WINDOWS\system32\YPCSER~1.EXE
--
End of file - 11888 bytes
VIRTUMUNDO BE GONE LOG
[10/01/2008, 20:59:35] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\Owner\Desktop\VirtumundoBeGone.exe" )
[10/01/2008, 20:59:43] - Detected System Information:
[10/01/2008, 20:59:43] - Windows Version: 5.1.2600, Service Pack 2
[10/01/2008, 20:59:43] - Current Username: Owner (Admin)
[10/01/2008, 20:59:43] - Windows is in NORMAL mode.
[10/01/2008, 20:59:43] - Searching for Browser Helper Objects:
[10/01/2008, 20:59:43] - BHO 1: {02478D38-C3F9-4EFB-9B51-7695ECA05670} (Yahoo! Toolbar Helper)
[10/01/2008, 20:59:43] - BHO 2: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (AcroIEHlprObj Class)
[10/01/2008, 20:59:43] - BHO 3: {0966F3D5-C170-42B2-91CC-DBFDC77E9625} ()
[10/01/2008, 20:59:43] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/01/2008, 20:59:43] - Checking for HKLM\...\Winlogon\Notify\yayxuuSi
[10/01/2008, 20:59:43] - Found: HKLM\...\Winlogon\Notify\yayxuuSi - This is probably Virtumundo.
[10/01/2008, 20:59:43] - Assigning {0966F3D5-C170-42B2-91CC-DBFDC77E9625} MSEvents Object
[10/01/2008, 20:59:43] - BHO list has been changed! Starting over...
[10/01/2008, 20:59:43] - BHO 1: {02478D38-C3F9-4EFB-9B51-7695ECA05670} (Yahoo! Toolbar Helper)
[10/01/2008, 20:59:43] - BHO 2: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (AcroIEHlprObj Class)
[10/01/2008, 20:59:43] - BHO 3: {0966F3D5-C170-42B2-91CC-DBFDC77E9625} (MSEvents Object)
[10/01/2008, 20:59:43] - ALERT: Found MSEvents Object!
[10/01/2008, 20:59:43] - BHO 4: {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} (Yahoo! IE Services Button)
[10/01/2008, 20:59:43] - BHO 5: {7E853D72-626A-48EC-A868-BA8D5E23E045} ()
[10/01/2008, 20:59:43] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/01/2008, 20:59:43] - No filename found. Continuing.
[10/01/2008, 20:59:43] - BHO 6: {9ECB9560-04F9-4bbc-943D-298DDF1699E1} (CNisExtBho Class)
[10/01/2008, 20:59:43] - BHO 7: {9F698CB1-A589-4989-8246-DC0392250153} ()
[10/01/2008, 20:59:43] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/01/2008, 20:59:43] - Checking for HKLM\...\Winlogon\Notify\awtsPFWq
[10/01/2008, 20:59:43] - Key not found: HKLM\...\Winlogon\Notify\awtsPFWq, continuing.
[10/01/2008, 20:59:43] - BHO 8: {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} (CNavExtBho Class)
[10/01/2008, 20:59:44] - BHO 9: {F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D} (SidebarAutoLaunch Class)
[10/01/2008, 20:59:44] - BHO 10: {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} ()
[10/01/2008, 20:59:44] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/01/2008, 20:59:44] - Checking for HKLM\...\Winlogon\Notify\mnyviewer
[10/01/2008, 20:59:45] - Key not found: HKLM\...\Winlogon\Notify\mnyviewer, continuing.
[10/01/2008, 20:59:45] - Finished Searching Browser Helper Objects
[10/01/2008, 20:59:45] - *** Detected MSEvents Object
[10/01/2008, 20:59:45] - Trying to remove MSEvents Object...
[10/01/2008, 20:59:46] - Terminating Process: IEXPLORE.EXE
[10/01/2008, 20:59:46] - Terminating Process: RUNDLL32.EXE
[10/01/2008, 20:59:46] - Disabling Automatic Shell Restart
[10/01/2008, 20:59:46] - Terminating Process: EXPLORER.EXE
[10/01/2008, 20:59:47] - Suspending the NT Session Manager System Service
[10/01/2008, 20:59:47] - Terminating Windows NT Logon/Logoff Manager
[10/01/2008, 20:59:48] - Re-enabling Automatic Shell Restart
[10/01/2008, 20:59:48] - File to disable: C:\WINDOWS\system32\yayxuuSi.dll
[10/01/2008, 20:59:48] - Renaming C:\WINDOWS\system32\yayxuuSi.dll -> C:\WINDOWS\system32\yayxuuSi.dll.vir
[10/01/2008, 20:59:48] - File successfully renamed!
[10/01/2008, 20:59:48] - Removing HKLM\...\Browser Helper Objects\{0966F3D5-C170-42B2-91CC-DBFDC77E9625}
[10/01/2008, 20:59:48] - Removing HKCR\CLSID\{0966F3D5-C170-42B2-91CC-DBFDC77E9625}
[10/01/2008, 20:59:48] - Adding Kill Bit for ActiveX for GUID: {0966F3D5-C170-42B2-91CC-DBFDC77E9625}
[10/01/2008, 20:59:48] - Deleting ATLEvents/MSEvents Registry entries
[10/01/2008, 20:59:48] - Removing HKLM\...\Winlogon\Notify\yayxuuSi
[10/01/2008, 20:59:48] - Searching for Browser Helper Objects:
[10/01/2008, 20:59:48] - BHO 1: {02478D38-C3F9-4EFB-9B51-7695ECA05670} (Yahoo! Toolbar Helper)
[10/01/2008, 20:59:48] - BHO 2: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (AcroIEHlprObj Class)
[10/01/2008, 20:59:48] - BHO 3: {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} (Yahoo! IE Services Button)
[10/01/2008, 20:59:48] - BHO 4: {7E853D72-626A-48EC-A868-BA8D5E23E045} ()
[10/01/2008, 20:59:48] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/01/2008, 20:59:48] - No filename found. Continuing.
[10/01/2008, 20:59:48] - BHO 5: {9ECB9560-04F9-4bbc-943D-298DDF1699E1} (CNisExtBho Class)
[10/01/2008, 20:59:49] - BHO 6: {9F698CB1-A589-4989-8246-DC0392250153} ()
[10/01/2008, 20:59:49] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/01/2008, 20:59:49] - Checking for HKLM\...\Winlogon\Notify\awtsPFWq
[10/01/2008, 20:59:49] - Key not found: HKLM\...\Winlogon\Notify\awtsPFWq, continuing.
[10/01/2008, 20:59:49] - BHO 7: {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} (CNavExtBho Class)
[10/01/2008, 20:59:49] - BHO 8: {F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D} (SidebarAutoLaunch Class)
[10/01/2008, 20:59:49] - BHO 9: {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} ()
[10/01/2008, 20:59:49] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/01/2008, 20:59:49] - Checking for HKLM\...\Winlogon\Notify\mnyviewer
[10/01/2008, 20:59:49] - Key not found: HKLM\...\Winlogon\Notify\mnyviewer, continuing.
[10/01/2008, 20:59:49] - Finished Searching Browser Helper Objects
[10/01/2008, 20:59:49] - Finishing up...
[10/01/2008, 20:59:49] - A restart is needed.
[10/01/2008, 21:00:03] - Attempting to Restart via STOP error (Blue Screen!)
Thank you in advance
Tryed everything to get rid of virtumonde and failed 
Re: Tryed everything to get rid of virtumonde and failed 
), and trojan remover has stopped shouting at me that it's infected. So yeah, seems fine
Linear Mode
