Trojan.Vundo.H removal problem/ Moved

I read another post where you gave instructions on how to remove this using ATF Cleaner; SuperAntispyware Free and IceSword.. I downloaded those programs and started following the instructions. Problem is, I think the virus is preventing SuperAntispyware from installing...I have gone through an apparent installation in normal mode and then rebooted to safe mode but when I try to launch the program the install screens come up again instead of the program launching. Can you help?

I should add that I have two computers connected to the same wireless intenet cable hookup. One of the computers is infected with the virus and cannot access the internet..the other computer (which I am using now) is apprarently not infected. So, I downloaded the antispyware programs to a flash disk on the good computer and used that to load the programs into the infected computer which is a Dell laptop.

Edited by flaboy925, 16 April 2009 - 01:58 PM.

As no logs have been posted, I am shifting this topic from the specialized HiJack This forum to the Am I Infected forum.

PLEASE DO NOT NOW POST LOGS unless a log is specifically requested.

Using the same method of transferring the application, start out with mbam instead
-----------------------

The process of cleaning your computer may require you to temporarily disable some security programs. If you are using SpyBot Search and Destroy, please refer to Note 2 at the bottom of this page.

Please download Malwarebytes Anti-Malware and save it to your desktop.
alternate download link 1
alternate download link 2

• Make sure you are connected to the Internet.
• Double-click on mbam-setup.exe to install the application.
• When the installation begins, follow the prompts and do not make any changes to default settings.
• When installation has finished, make sure you leave both of these checked:
  • Update Malwarebytes' Anti-Malware
  • Launch Malwarebytes' Anti-Malware
• Then click Finish.

MBAM will automatically start and you will be asked to update the program before performing a scan.

• If an update is found, the program will automatically update itself.
• Press the OK button to close that box and continue.
• If you encounter any problems while downloading the updates, manually download them from here and just double-click on mbam-rules.exe to install.

On the Scanner tab:

• Make sure the "Perform Quick Scan" option is selected.
• Then click on the Scan button.
• If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
• The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
• When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
• Click OK to close the message box and continue with the removal process.

Back at the main Scanner screen:

• Click on the Show Results button to see a list of any malware that was found.
• Make sure that everything is checked, and click Remove Selected.
• When removal is completed, a log report will open in Notepad.
• The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
• Copy and paste the contents of that report in your next reply and exit MBAM.

Note:
-- If MBAM encounters a file that is difficult to remove, you may be asked to reboot your computer so it can proceed with the disinfection process. Regardless if prompted to restart the computer or not, please do so immediately. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware.

Note 2:
-- MBAM may make changes to your registry as part of its disinfection routine. If you're using other security programs that detect registry changes (like Spybot's Teatimer), they may interfere with the fix or alert you after scanning with MBAM. Please disable such programs until disinfection is complete or permit them to allow the changes. To disable these programs, please view this topic: How To Temporarily Disable Your Anti-virus, Firewall And Anti-malware Programs

Since my initial post I was able to delete the four files that Maleware could not delete. I did that using IceSword since I knew the file names I could find them that way. Then I ran Malewarebytes quick scan and the SuperAntiSpyware complete scans and they both came back with no infected files. So, I thought I had the problem solved. I rebooted the computer and launched IE but I cannot get a live site and get the same web address produced by the virus which is: "http://go.microsoft.com/fwlink/?Link Id=74005". Also, I cannot change the default home address from the one in quotes..I can type in a new one but then it automatically changes back. I know you want to see logs but the logs show no infected files and I cannot get internet access on the infected computer to send them. Can you help with this?

Please see previous post...can you suggest what should I do now?

Please download Dr.Web CureIt, the free version & save it to your desktop. DO NOT perform a scan yet.

Reboot your computer in "Safe Mode" using the F8 method. To do this, restart your computer and after hearing your computer beep once during startup (but before the Windows icon appears) press the F8 key repeatedly. A menu will appear with several options. Use the arrow keys to navigate and select the option to run Windows in "Safe Mode".

Scan with Dr.Web CureIt as follows:

• Double-click on launch.exe to open the program and click Start. (There is no need to update if you just downloaded the most current version
• Read the Virus check by DrWeb scanner prompt and click Ok where asked to Start scan now? Allow the setup.exe to load if asked by any of your security programs.
• The Express scan will automatically begin.
  (This is a short scan of files currently running in memory, boot sectors, and targeted folders).
• If prompted to dowload the Full version Free Trial, ignore and click the X to close the window.
• If an infected object is found, you will be prompted to move anything that cannot be cured. Click Yes to All.
• When complete, click Select All, then choose Cure > Move incurable.
  (This will move any detected files to the C:\Documents and Settings\userprofile\DoctorWeb\Quarantine folder if they can't be cured)

• Now put a check next to Complete scan to scan all local disks and removable media.
• In the top menu, click Settings > Change settings, and UNcheck "Heuristic analysis" under the "Scanning" tab, then click Ok.
• Back at the main window, click the green arrow "Start Scanning" button on the right under the Dr.Web logo.
• When the scan is complete, a message will be displayed at the bottom indicating if any viruses were found.
• Click "Yes to all" if asked to cure or move the file(s) and select "Move incurable".
• In the top menu, click file and choose save report list.
• Save the DrWeb.csv report to your desktop.
• Exit Dr.Web Cureit when done.
• Important! Reboot your computer because it could be possible that files in use will be moved/deleted during reboot.
• After reboot, post the contents of the log from Dr.Web in your next reply. (You can use Notepad to open the DrWeb.cvs report)

garmanma - my internet access has been blocked by this virus so i cannot get on the internet to download as you suggest. can you suggest something i might do to unblock my browser so that i can download and follow your instructions?

http://go.microsoft.com/fwlink/?Link Id=74005 is the Microsoft search site. I doubt if a virus would direct you there
I would double-check your connection settings

You can try this

Log on as an administrator, go Start > Run and type: "cmd". In the window that appears type: "netsh winsock reset". When the program is finished, you will receive the message: "Successfully reset the Winsock Catalog. You must restart the machine in order to complete the reset." Close the command box and reboot your computer.

Go Start > Run > type: "cmd" In the window that appears type: "ipconfig /flushdns". Close the command box.

Go Start > Control Panel > Network Connections. Right click on your default connection, usually Local Area Connection or Dial-up Connection if you are using Dial-up, and and choose Properties. Double-click on the Internet Protocol (TCP/IP) item. Select the radio button that says "Obtain DNS servers automatically". Reboot.

Warning: Some Internet Service Providers need specific DNS settings. You need to make sure that you know if such DNS settings are required before you make this change.

Hi, thanks for responding.....I was able to do everything you suggested.....when I rebooted, the internet connection showed as connected (wireless) but the same screen came up saying "internet explorer cannot display the webpage"...the home page I use is google.com and it shows in the address bar. I then went to internet options to see what the default hope page is and it shows up as "http://go.microsoft.com/fwlink/?LinkId=69157"...same as before but the number at the end is different. When I type in other web addresses in the address window it comes back "IE cannot display the page"....What now?

I'm confused. In your first post you said you downloaded the tools to a flash drive and transfered them to the infected computer.
Why not do that with DR Web?
It sure would be nice to know what 4 files this IceSword deleted

I only use the flash drives once because I am concerned about going back to my uninfected computer with a flash drive that has been in the infected one...maybe that is being overly cautious?? They cost me $20 each.

There were a number of infected files on the first MalWareBytes run but they all deleted on reboot except for four. Those are the four files I deleted with Icesword:

Files:

1. C:\WINDOWS\system32\kiuiuwr.dll (Trojan.vundo.H)

Registry Keys:

1. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{23a86b28-33a9-4214-90b8-adaa63c861c8} (Trojan.Vundo.H)


2. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\notify\lderthkg (Trojan.Vundo.H)

3.HKEY_CLASSES-ROOT\CLSID\{23a86b28-33a9-4214-90b8-adaa63c861c8} (Trojan.vundo.H)

Can you use Safe mode w/networking?

Hmmmmm...don't know how to do that...I have a Dell desktop and a Dell laptop (infected) hooked up to a wireless router. Will safe mode on the laptop keep the virus from infecting the desktop if it otherwise has the capability to do so?

Will safe mode on the laptop keep the virus from infecting the desktop

Your router will

Reboot the computer and just after the initial screen, start tapping the F8 key
Another screen will come up offering various boot choices
Using the up/down arrow keys, select safe mode w/networking
You should then be able to go online to download what you need