Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Trojan.vundo


  • Please log in to reply
11 replies to this topic

#1 RyPkr_99

RyPkr_99

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:03:39 PM

Posted 09 December 2005 - 07:02 PM

Can't post in the adware/malware section. I guess I don't have enough posts or something. Here's my problem...

I have the winfixer2005 adware (trojan.vundo). I read the tutorial and printed and and was ready to go.

First thing is reboot to safe mode... I do that and it freezes. I boot, hit f8, choose safe mode. Windows loads, I pick my user, then it goes to the background with "safe mode" in all 4 corners and some giberish across the top but never loads anything else. I let it sit there for 5 minutes... nothing, ctr alt delete and nothing is crashed.

I tried multiple times but can't get it to boot... Any help guys?


Mod Edit: Moved to the appropriate forum. ~tg~

Edited by tg1911, 09 December 2005 - 11:41 PM.


BC AdBot (Login to Remove)

 


m

#2 acklan

acklan

    Bleepin' cat's meow


  • Members
  • 8,529 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Baton Rouge, La.
  • Local time:02:39 PM

Posted 10 December 2005 - 09:05 AM

You should scan under Administrator.
"2007 & 2008 Windows Shell/User Award"

#3 MFDnSC

MFDnSC

    Ret. Director I/T


  • Members
  • 4,310 posts
  • OFFLINE
  •  
  • Local time:03:39 PM

Posted 10 December 2005 - 11:00 AM

Try this - the safe mode problem happens because the Vundo code is so poorly written

Adware-Virtumundo Removal Tool v1.2 (Associated with WinFixer Popups)

Note: This tools does not remove the WinFixer application. WinFixer alone does not cause popups or disrupt the system. If WinFixer was installed on your system because Adware or a Trojan Downloader installed it without your permission, please remove it using the Add/Remove Programs Control Panel Applet.

If Virtumundo is not found, the tool will exit showing the log file.

If Virtumundo is found it will do the following:
Version 1.1
Create a Date/Time Stamped log file (VBG.TXT) on the All Users profile's Desktop.
Kill Internet Explorer and Explorer processes.
Rename the infected files with a .Vir extension (this is disable them from being run)
Remove the Browser Helper Object registry key
Adds a registry value to block file from running in Internet Explorer again.
Remove the Winlogon Notify registry key
Automatically restart the computer (via STOP error)
Note: This is a BLUE SCREEN "Fatal Error" Message. It is normal and expected. The tool ends an important Windows Process that was protecting the file and NT Security STOPS the system as soon as it detects this is happening.


VirusScan will now be able to remove the files normally when you run an on-demand scan.

Download Link -> http://secured2k.home.comcast.net/tools/VirtumundoBeGone.exe

Then run your antivirus or Ewido to remove any left over files and then post a fresh hjt log & the report from this tool
"Nothing could be finer than to be in South Carolina ............"

Member ASAP

#4 RyPkr_99

RyPkr_99
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:03:39 PM

Posted 15 December 2005 - 05:07 PM

I'm sorry I don't understand that at all.

Do I use the program that you gave me a link for at the bottom?

#5 MFDnSC

MFDnSC

    Ret. Director I/T


  • Members
  • 4,310 posts
  • OFFLINE
  •  
  • Local time:03:39 PM

Posted 15 December 2005 - 05:09 PM

Link at the bottom
"Nothing could be finer than to be in South Carolina ............"

Member ASAP

#6 RyPkr_99

RyPkr_99
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:03:39 PM

Posted 15 December 2005 - 05:14 PM

and do i run that in regular windows? because i cannot boot to safe mode...

#7 RyPkr_99

RyPkr_99
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:03:39 PM

Posted 15 December 2005 - 05:19 PM

Ok... I ran it and the log popped up... that would mean the computer is clean. But I dont think it is. I'm running my avg virus scan now... am i doing this right?

#8 MFDnSC

MFDnSC

    Ret. Director I/T


  • Members
  • 4,310 posts
  • OFFLINE
  •  
  • Local time:03:39 PM

Posted 15 December 2005 - 05:19 PM

Normal
"Nothing could be finer than to be in South Carolina ............"

Member ASAP

#9 RyPkr_99

RyPkr_99
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:03:39 PM

Posted 15 December 2005 - 06:05 PM

Normal



I'm sorry, I'm new to this... what is normal?

#10 MFDnSC

MFDnSC

    Ret. Director I/T


  • Members
  • 4,310 posts
  • OFFLINE
  •  
  • Local time:03:39 PM

Posted 15 December 2005 - 06:08 PM

Normal mode not safe mode
"Nothing could be finer than to be in South Carolina ............"

Member ASAP

#11 fogo

fogo

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:03:39 PM

Posted 27 December 2005 - 07:14 PM

I am also experiencing the same problem and would like to know if this worked for RyPkr_99

#12 MFDnSC

MFDnSC

    Ret. Director I/T


  • Members
  • 4,310 posts
  • OFFLINE
  •  
  • Local time:03:39 PM

Posted 28 December 2005 - 12:34 PM

Fogo start your own thread and post a HiJack log
"Nothing could be finer than to be in South Carolina ............"

Member ASAP




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users