Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Firefox being redirected to random pages/ AVG reads Trojan Vundo


  • Please log in to reply
17 replies to this topic

#1 stepbarnes

stepbarnes

  • Members
  • 21 posts
  • OFFLINE
  •  
  • Local time:02:22 PM

Posted 18 December 2009 - 02:44 PM

Hi there! My Firefox is being redirected and I have popups on a consistent basis. I have the free version of AVG, and it has scanned TrojanHorse Vundo.JG and TrojanHorse Vundo.JF . AVG scans and scans, but it continues to reappear!

Need help! ;)

BC AdBot (Login to Remove)

 


#2 MATTSPCHELP

MATTSPCHELP

  • Members
  • 196 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Leicester, United kingdom
  • Local time:08:22 PM

Posted 18 December 2009 - 02:46 PM

download and run VundoFix
Microsoft Certified Desktop Support Technician

#3 stepbarnes

stepbarnes
  • Topic Starter

  • Members
  • 21 posts
  • OFFLINE
  •  
  • Local time:02:22 PM

Posted 18 December 2009 - 03:35 PM

Ran it....it came up with nothing.

#4 MATTSPCHELP

MATTSPCHELP

  • Members
  • 196 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Leicester, United kingdom
  • Local time:08:22 PM

Posted 18 December 2009 - 03:38 PM

Next things next download Malware bytes and scan
Microsoft Certified Desktop Support Technician

#5 stepbarnes

stepbarnes
  • Topic Starter

  • Members
  • 21 posts
  • OFFLINE
  •  
  • Local time:02:22 PM

Posted 18 December 2009 - 03:51 PM

I keep getting an error when trying to open the program:
Unable to execute file: c:\Program Files\Malwarebytes'Anti-Malware\mbam.exe
CreateProcess failed; code 2.
The system cannot find the file specified.

#6 MATTSPCHELP

MATTSPCHELP

  • Members
  • 196 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Leicester, United kingdom
  • Local time:08:22 PM

Posted 18 December 2009 - 03:56 PM

Download and run
Rkill.exe http://download.bleepingcomputer.com/grinler/rkill.exe
Rkill.com http://download.bleepingcomputer.com/grinler/rkill.com
Rkill.scr http://download.bleepingcomputer.com/grinler/rkill.scr
Rkill.pif http://download.bleepingcomputer.com/grinler/rkill.pif

you should see a black window open and close

then try and open malware bytes ,

Edited by MATTSPCHELP, 18 December 2009 - 03:58 PM.

Microsoft Certified Desktop Support Technician

#7 stepbarnes

stepbarnes
  • Topic Starter

  • Members
  • 21 posts
  • OFFLINE
  •  
  • Local time:02:22 PM

Posted 18 December 2009 - 04:17 PM

Did that. Still getting the same error message. :thumbsup:

#8 MATTSPCHELP

MATTSPCHELP

  • Members
  • 196 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Leicester, United kingdom
  • Local time:08:22 PM

Posted 18 December 2009 - 04:23 PM

Easy workaround is, download a randomized renamed mbam.exe version from here.

Place the renamed mbam.exe in the Program Files\Malwarebytes' Anti-Malware folder on the infected PC and launch the renamed file.
Then malwarebytes should run.

In some cases, it will be needed to rename the random named mbam.exe to explorer.exe (this for example when you are also dealing with "Security Tool" or another fake scanner - you can actually bypass whatever it blocks by renaming the program/ exe file you want to run, to explorer.exe).

Once the renamed mbam.exe runs,
First step is to click the update tab in order to download the latest updates.

Then run a quick scan and let Malwarebytes quarantine what it found.
Reboot afterwards.
Microsoft Certified Desktop Support Technician

#9 stepbarnes

stepbarnes
  • Topic Starter

  • Members
  • 21 posts
  • OFFLINE
  •  
  • Local time:02:22 PM

Posted 18 December 2009 - 04:28 PM

where do i find the randomized renamed version?

#10 MATTSPCHELP

MATTSPCHELP

  • Members
  • 196 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Leicester, United kingdom
  • Local time:08:22 PM

Posted 18 December 2009 - 04:31 PM

woops forgot to link you http://mbam.malwarebytes.org/program/random.php
Microsoft Certified Desktop Support Technician

#11 stepbarnes

stepbarnes
  • Topic Starter

  • Members
  • 21 posts
  • OFFLINE
  •  
  • Local time:02:22 PM

Posted 18 December 2009 - 04:32 PM

Error code: 707 (3,0) when I try to download.

#12 stepbarnes

stepbarnes
  • Topic Starter

  • Members
  • 21 posts
  • OFFLINE
  •  
  • Local time:02:22 PM

Posted 18 December 2009 - 04:35 PM

And ComboFix is not available for download....lol....just my luck!

#13 MATTSPCHELP

MATTSPCHELP

  • Members
  • 196 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Leicester, United kingdom
  • Local time:08:22 PM

Posted 18 December 2009 - 04:36 PM

If this is after the install and it attepts to updat this could be a proxy issue aswell

check the following

In Internet Explorer: Tools Menu -> Internet Options -> Connections Tab ->Lan Settings > uncheck "use a proxy server" and check to "Automatically detect settings".
Also, remove the reference to 127.0.0.1:5555 under the "use a proxy server" settings before you uncheck it there.
In Firefox in Tools Menu -> Options... -> Advanced Tab -> Network Tab -> "Settings" under Connection.
Microsoft Certified Desktop Support Technician

#14 stepbarnes

stepbarnes
  • Topic Starter

  • Members
  • 21 posts
  • OFFLINE
  •  
  • Local time:02:22 PM

Posted 18 December 2009 - 04:41 PM

Nope, won't even let me install it/ Tried several times. Still getting the 707 error message. Proxy settings are on auto detect for Firefox

#15 stepbarnes

stepbarnes
  • Topic Starter

  • Members
  • 21 posts
  • OFFLINE
  •  
  • Local time:02:22 PM

Posted 18 December 2009 - 04:56 PM

Please help. This is my school computer. Eeeeek!




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users