TechSpot

Can't get rid of Vundo

By wormgod
May 6, 2009
  1. I believe that I have a Vundo infection that I have been trying to get rid of for several days, but like a bad rash it keeps coming back. Symptoms include XP freezing (some running programs freeze but others do not, system clock freezes -- requires a power off), IE having to close, tmproxy restarting, etc.
    I have tried multiple antivirus/spyware tools -- VirtumundoBeGone (nothing), FixVundo (nothing), VundoFix (nothing), SpyBot (found and removed something but probably not all), Trojan Remover (nothing), and several others whose names escape me at the moment. Please help. Logs are attached.
     

    Attached Files:

  2. B00kWyrm

    B00kWyrm TechSpot Paladin Posts: 1,436   +37

    WinFixer / Vundo / Dropper and others detected...

    Hello Wormgod...
    Your SAS log shows multiple issues, not just Vundo.
    Have you completed the 8 steps?
    See http://www.techspot.com/vb/topic58138.html

    I only glanced at your HJT log... What AV are you using? Is it fully updated?
    What did it say that it was able to do? (Do you have a log file from your last scan?)
    Were you able to update MBAM?

    Re: Vundo... Maybe you saw this... (on bleepingcomputer)
    From what I have seen, Vundo, though difficult, is defeatable.
    I have seen our generous volunteer experts at TechSpot help several with Vundo and with other difficult nasties.
    I would observe, some of the others can be even a little more difficult.
     
  3. wormgod

    wormgod TS Rookie Topic Starter

    Thanks for the quick response. I did go through all 8 of the steps before my initial post. I also noticed some problems that SAS found/removed, but I (perhaps naively) assumed they had been taken care of.


    My AV is Trend Micro PC-Cillin 2007 (fully updated as I have the subscription service). I had issues the last two times that I ran it. The first time, the computer (including the scan) hung in the middle requiring a power off. The second time, the computer hung, but the scan continued to run to completion, but it did not report any problems. I'll try running it again and see what log it generates.

    MBAM was able to update itself (db version 2079).
     
  4. wormgod

    wormgod TS Rookie Topic Starter

    Reran the full Trend Micro scan, and it found nothing but a couple of cookies, which I removed.

    Any ideas?
     
  5. wormgod

    wormgod TS Rookie Topic Starter

    Still having the same problems -- computer freezing (sometimes at Welcome screen), tmproxy restarting, IE restarting, other components/programs restarting, etc.

    Can anyone help? Thanks.
     
  6. touch

    touch TS Rookie Posts: 978

    Let´s see a combofix log ;)


    Please download Combofix:
    http://subs.geekstogo.com/ComboFix.exe

    And save to the desktop.

    Close all other browser windows.

    Please connect all your external hard drive/flash drive before running Combofix, if you have any

    Double-click on the combofix icon found on your desktop.

    Please note, that once you start combofix you should not click anywhere on the combofix window as it can cause the program to stall. In fact, when combofix is running, do not touch your computer at all and just take a break as it may take a while for it to complete.

    Combofix will create a logfile and display it after your computer has rebooted. Usually located in c:\combofix.txt, please attach it to your next post
     
  7. wormgod

    wormgod TS Rookie Topic Starter

    Here is the latest Combofix log. Thanks.
     

    Attached Files:

  8. touch

    touch TS Rookie Posts: 978

    It looks clean. How are things running ?
     
  9. wormgod

    wormgod TS Rookie Topic Starter

    No change. Still having the same problems. Something nasty is running that I cannot get rid of. It may not be Vundo, but it is nasty nonetheless.
     
  10. touch

    touch TS Rookie Posts: 978

    Ok. We´ll dig deeper -

    Click here: http://www.gmer.net/
    and download the installer for Gmer to your desktop, then click that file to run Gmer.
    (scroll down, and click on – Download Exe – Button)

    If on it's opening scan Gmer locates items shown in red or indicates "hidden" or "rootkit", stop there, and click on the Copy button and rightclick on your Desktop, choose "New" > Text document. Once the file is created, open it and rightclick again and choose Paste. Attach the information and post it here please. We don't want any crashes just from taking an initial look at things.

    If not, then click on Scan (before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while this scan completes. Also do not use your computer during the scan).

    When completed, click on the Copy button and rightclick on your Desktop, choose "New" > Text document. Once the file is created, open it and rightclick again and choose Paste. Attach the information and post it here please.
     
  11. wormgod

    wormgod TS Rookie Topic Starter

    Here is the gmer log.
     
  12. touch

    touch TS Rookie Posts: 978

    It looks clean.

    I don´t think your problems are virus related, I´ll therefore you check for corrupted systemfiles.

    To do so ->
    Click Start > Run and type sfc /scannow and the click OK.
    Note the space between the c and the /
    You may need your Windows XP CD so have it ready.
    If you have Service Pack 2 (SP2) or SP3 installed, you will need the SP2 or SP3 version of the version of the CD. This can be done with a borrowed CD, if you don't have one.

    Allow the scan to run and when completed, reboot the system, and tell how things are running now ?
     
  13. wormgod

    wormgod TS Rookie Topic Starter

    This really didn't sound like a corrupted system files issue, so I downloaded another scanner that checks the master boot record, and it found and removed the trojan. Everything seems to be running fine now. Thanks for all your suggestions -- they pointed me in the right direction.
     
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...