Hello Everyone,
I have a client's machine that is infected by the Trojan.Vundo virus. They are running Norton Antivirus and about every 10 minutes it gives the message, "Your computer must restart in order to continue the removal of security risks". After the computer reboots it finds the virus again about 10 minutes later. I've performed all of the steps in the preliminary removal instructions (by the way the link to that page doesn't appear to be working anymore), but the virus continues to show up. Vundofix doesn't detect the virus. I've also run fixvundo from Symantec and although it found the virus and said it removed it, it still shows the same behavior and asks the client to reboot every 10 minutes. Panda Rootkit didn't find anything. Attached are my Combofix, Vundofix, and Hijackthis logs. AVG Antispyware didn't find anything so it didn't generate a log. By the way, I had updated Java already and for some reason it went back to an old version. If you have a link for the latest version of Java handy I'd appreciate it.
I have a client's machine that is infected by the Trojan.Vundo virus. They are running Norton Antivirus and about every 10 minutes it gives the message, "Your computer must restart in order to continue the removal of security risks". After the computer reboots it finds the virus again about 10 minutes later. I've performed all of the steps in the preliminary removal instructions (by the way the link to that page doesn't appear to be working anymore), but the virus continues to show up. Vundofix doesn't detect the virus. I've also run fixvundo from Symantec and although it found the virus and said it removed it, it still shows the same behavior and asks the client to reboot every 10 minutes. Panda Rootkit didn't find anything. Attached are my Combofix, Vundofix, and Hijackthis logs. AVG Antispyware didn't find anything so it didn't generate a log. By the way, I had updated Java already and for some reason it went back to an old version. If you have a link for the latest version of Java handy I'd appreciate it.
. I'm running a full virus scan in safe mode to see if it finds the virus, but this computer has over 650,000 files and takes about 3 hours to run a scan. Momok, basically the error message is that Norton Antivirus 2006 pops up a message that states, "Your computer must restart in order to continue the removal of security risks". After restarting the message appears again within 10-15 minutes. When viewing the quarantine it shows hundreds of entries of Trojan.Vundo and says that it was partially removed each time and then says "resolved - no action" under recommended action, but the message pops up again asking the user to reboot the computer. By the way, the quarantine (in this case) does not have a way to remove any of these infections because it states they have already been removed. The folder path of these items is always one of two different paths that I mentioned in a previous post (C:\documents and settings\all users\application data\symantec\subeng\temp\"hex address" or C:\Windows\temp\"hex address". I have deleted the C:\Windows\Temp folder contents and run ccleaner and ATF Cleaner. The scan completed in safe mode without finding anything and now I'm running a scan in normal mode to see if it finds anything.
