Jump to content


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.


Another Trojan Vundo Disaster

  • Please log in to reply
1 reply to this topic

#1 mayerda13


  • Members
  • 4 posts
  • Local time:04:27 AM

Posted 15 February 2009 - 11:30 PM

Hi all...again,

A couple of weeks ago I was infected with the Trjoan Vudno Variant MS Juan problem. I did the steps provided and it was removed. However, after the cleaning, my computer was never the same. Slow speeds, if I was to switch from Microsoft Word to Firefox it would take a while for it to switch and become stable. Also, sometimes, I will get redirected to another site. Video streaming is harder and time consuming now as well. I ran all the spyware/malware searchers only to come up empty handed. Now, for some reason, they state I have the Trojan Vundo H problem. Here are my MBAM and SAPW logs. If further information is needed please tell me and I will post asap.

Malwarebytes' Anti-Malware 1.34
Database version: 1765
Windows 5.1.2600 Service Pack 3

2/15/2009 10:34:00 PM
mbam-log-2009-02-15 (22-34-00).txt

Scan type: Full Scan (C:\|D:\|)
Objects scanned: 111724
Time elapsed: 33 minute(s), 45 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 4
Registry Keys Infected: 17
Registry Values Infected: 2
Registry Data Items Infected: 2
Folders Infected: 0
Files Infected: 11

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
C:\WINDOWS\system32\phyicdio.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\qoMgebBq.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\lgxojz.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\awttTLcY.dll (Trojan.Vundo.H) -> Delete on reboot.

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{55e99fe7-4ab4-438c-aacf-a2356de2b365} (Trojan.Vundo.H) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{55e99fe7-4ab4-438c-aacf-a2356de2b365} (Trojan.Vundo.H) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo.H) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\awtttlcy (Trojan.Vundo.H) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo.H) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{bc254055-b047-4451-b228-559a3c1e0e75} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{bc254055-b047-4451-b228-559a3c1e0e75} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{55e99fe7-4ab4-438c-aacf-a2356de2b365} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{bc254055-b047-4451-b228-559a3c1e0e75} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\instkey (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\a0097942 (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo.H) -> Delete on reboot.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\qomgebbq -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\qomgebbq -> Delete on reboot.

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\system32\qoMgebBq.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\qBbegMoq.ini (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\qBbegMoq.ini2 (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\awttTLcY.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\lgxojz.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\phyicdio.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\oidciyhp.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\Documents and Settings\D Mayer\Local Settings\Temporary Internet Files\Content.IE5\EPTI7HVU\upd105320[1] (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\Documents and Settings\D Mayer\Local Settings\Temporary Internet Files\Content.IE5\EPWUHIKV\divx20[1] (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Documents and Settings\D Mayer\Local Settings\Temporary Internet Files\Content.IE5\IHN010WP\index[1] (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\erbqwapy.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

SUPERAntiSpyware Scan Log

Generated 02/15/2009 at 11:26 PM

Application Version : 4.25.1012

Core Rules Database Version : 3760
Trace Rules Database Version: 1722

Scan type : Complete Scan
Total Scan Time : 00:38:52

Memory items scanned : 529
Memory threats detected : 0
Registry items scanned : 5171
Registry threats detected : 7
File items scanned : 18181
File threats detected : 0


BC AdBot (Login to Remove)


#2 quietman7


    Bleepin' Janitor

  • Global Moderator
  • 50,952 posts
  • Gender:Male
  • Location:Virginia, USA
  • Local time:05:27 AM

Posted 16 February 2009 - 09:27 AM

Your MBAM log indicates some files will be deleted on reboot. If MBAM encounters a file that is difficult to remove, you need to restart the computer so the malware can be fully removed. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware. If you have not rebooted, make sure you do this. When done, rescan again with MBAM (Quick Scan) in normal mode and check all items found for removal. Don't forgot to check for database updates through the program's interface (preferable way) before scanning. Then click the Logs tab and copy/paste the contents of the new report in your next reply. If you did reboot, then rescan again anyway and post a new log.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users