Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Vundo/virtumonde Keeps Returning


  • Please log in to reply
3 replies to this topic

#1 froggyli

froggyli

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:01:30 PM

Posted 19 June 2007 - 08:52 PM

I have no clue as to how or where I picked this little gem up but I have done nearly everything to try and get rid of this bugger and it keeps returning, I've used a bunch of Vundo fix tools, Spybot S&D, Ad-Aware 2007, and AVG Free removed all the entries and I'm still getting virus pop-ups from AVG and those stupid funny .dll's keep coming back, I've been fighting this for 3 days no trying to get rid of it permanently but to no avail. Does anyone have any suggestions on where else it could be hiding and what else I can use to try and get rid of this bugger? Thanks!

BC AdBot (Login to Remove)

 


#2 buddy215

buddy215

  • BC Advisor
  • 13,005 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:West Tennessee
  • Local time:03:30 PM

Posted 19 June 2007 - 09:04 PM

Have you used this program?
Please download http://www.atribune.org/content/view/24/2/
to your desktop.
Double-click VundoFix.exe to run it.
Click the Scan for Vundo button.
Once it's done scanning, click the Remove Vundo button.
You will receive a prompt asking if you want to remove the files, click YES
Once you click yes, your desktop will go blank as it starts removing Vundo.
When completed, it will prompt that it will reboot your computer, click OK.

Note: It is possible that VundoFix encountered a file it could not remove.
In this case, VundoFix will run on reboot, simply follow the above
instructions starting from "Click the Scan for Vundo button." when
VundoFix appears at reboot.
__________________________________________________________________

If so, follow the instructions below
Post a Hijack This log in the Hijack This Forum by following the directions in the link below if the program above has not removed ALL malware. DO NOT post the log in this forum.
http://www.bleepingcomputer.com/forums/t/34773/preparation-guide-for-use-before-using-malware-removal-tools-and-requesting-help/

“Every atom in your body came from a star that exploded and the atoms in your left hand probably came from a different star than your right hand. It really is the most poetic thing I know about physics...you are all stardust.”Lawrence M. Krauss

A 1792 U.S. penny, designed in part by Thomas Jefferson and George Washington, reads “Liberty Parent of Science & Industry.”


#3 froggyli

froggyli
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:01:30 PM

Posted 19 June 2007 - 09:10 PM

Done it! On more than one occasion and it still keeps returning. Does it help to know that every once and a while a cmd.exe box briefly flashes on the screen?

#4 buddy215

buddy215

  • BC Advisor
  • 13,005 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:West Tennessee
  • Local time:03:30 PM

Posted 19 June 2007 - 09:26 PM

The Hijack This Team can answer that for you. Go ahead and post your log in the Hijack This Forum. NOT here.
You have done the preliminaries, just post the log.

“Every atom in your body came from a star that exploded and the atoms in your left hand probably came from a different star than your right hand. It really is the most poetic thing I know about physics...you are all stardust.”Lawrence M. Krauss

A 1792 U.S. penny, designed in part by Thomas Jefferson and George Washington, reads “Liberty Parent of Science & Industry.”





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users