Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Help: Vundo and Dropper Virus and Computer Reboots


  • Please log in to reply
2 replies to this topic

#1 jplayer

jplayer

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:07:28 PM

Posted 25 January 2009 - 07:34 PM

Hi,

I need some help cleaning my computer. I ran an executable that someone sent me. I thought it was safe because I ran my Symantec Anti-Virus on the file before I launched it. Unfortunately it looks like it dropped some viruses on my machine. :thumbsup:

After restarting my computer it looked like it was installing something but I couldnt get any programs to run (IE, Antivirus, etc). I rebooted again and this time, the computer kept restarting the desktop (i.e. it looks like the Windows startup would complete, I would see the Desktop icons and then it would go blank and then start again).

I took my drive out of my laptop and installed it as an external drive on another machine and ran my Symantec Virus Scan. It found the following viruses (I only did a log and did not run Quarantine or Delete)


cogad.exe W32.Spybot.Worm F:\Documents and Settings\Player\Application Data\cogad\ Infected

bluesky.exe Trojan.Dropper F:\Documents and Settings\Player\Desktop\ Infected

winlogin.exe Downloader F:\Documents and Settings\Player\Local Settings\Temp\ Infected

apstpldr.dll[1].htm Downloader F:\Documents and Settings\JPlayer\Local Settings\Temporary Internet Files\Content.IE5\MBA36XER\ Infected

index[1] Trojan.Vundo F:\Documents and Settings\JPlayer\Local Settings\Temporary Internet Files\Content.IE5\MBA36XER\ Infected

mywyxngk.exe Trojan.Vundo F:\ Infected



I installed my drive back into my laptop and after reading some of the posts here I tried rebooting into Safe Mode so that I could run HijackThis. However in Safe Mode, the Windows Startup keeps rebooting (starts in Black Screen Safe Mode Screen, then I see the Windows Desktop, 5 secs later, it goes back to the Black Safe Mode Screen).

I cant seem to execute any programs before the Windows login restarts. Any help is greatly appreciated.

Also I need to know how to rid these viruses. I am a bit skeptical about letting Symantec Antivirus program do it as it didnt seem to detect it when I scanned the original file (bluesky.exe)

JP

BC AdBot (Login to Remove)

 


#2 Orange Blossom

Orange Blossom

    OBleepin Investigator


  • Moderator
  • 36,944 posts
  • ONLINE
  •  
  • Gender:Not Telling
  • Location:Bloomington, IN
  • Local time:08:28 PM

Posted 25 January 2009 - 09:10 PM

Moving from HiJack This forum to Am I Infected as there are no logs. ~ OB
Help us help you. If HelpBot replies, you MUST follow step 1 in its reply so we know you need help.

Orange Blossom

An ounce of prevention is worth a pound of cure

SpywareBlaster, WinPatrol Plus, ESET Smart Security, Malwarebytes' Anti-Malware, NoScript Firefox ext., Norton noscript

#3 jplayer

jplayer
  • Topic Starter

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:07:28 PM

Posted 26 January 2009 - 03:44 PM

Hi,

Just a followup from my original post.

I see a number of programs recommended to be run..like MalwareBytes AntiMalware. As mentioned I cant run it on my own laptop as the login keeps resetting itself but can I take my HD out and put it on another machine as an external drive and then run it from there?

In theory I can read and write files from the bad HD. So I can try manually removing the infected files but I dont know which ones to remove.

Any help is greatly appreciated. It is hard to diagnose the problem when the computer keeps restarting the login process.

JP




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users