By pcguy408
Feb 15, 2009
  1. Hi,

    I'm having trouble with trojan.vundo. I've ran the fixvundo fix in safe mode and it said it didnt find any infections. I also ran Malwarebytes it said it was clean also. Whenever i run AVG or Trend Housecall it find trojan.vundo.

    Hi-jack this logs i believe look clean, but i am a novice. Any ideas? I'm now unable to run Trend Housecall i receieve a "could not transfer data over the internet error message"..

    So looks the virus is still in my machine, not sure where or how to remove it. Any help would be appreciated.
  2. pcguy408

    pcguy408 TS Rookie Topic Starter

    Here's my logs.
  3. swwelsh

    swwelsh TS Rookie Posts: 34

    Where does it see the virus? It could be that the virus software has quarantined it, and it still shows up in a scan, or it could be in your system restore folder. You can delete quarantined files from AVG, and you can delete system restore folders by turning off system restore, rebooting and then turning it back on and making a new restore point
  4. pcguy408

    pcguy408 TS Rookie Topic Starter

    Earlier i ran Housecall and Spybot and it found a bunch of vundo instances, Last couple of MalwareBytes scans have been clean. I'm currently AVG again. System Restore is disabled at the moment.

    I've ran these scans now for hours both in safe mode and regular mode and it seems to always come back.

    Last AVG scan found Vundo in C:/Windows/System32/ngnrclqw.dll

    Does my hi-jack this logs look ok? Im unable to run Trend Housecall now because i receive a error message stating "unable to transfer data to the internet"
  5. swwelsh

    swwelsh TS Rookie Posts: 34

    I don't see any suspicious bho's in HJT, but I am no expert on how this one works. I found a couple of tools for it listed here:
    Also make sure you have updated malwarebytes to the newest version, same with vundofix. There are a lot of versions of this one, and they adjust it to bypass the removal tools. Some of the experts here may have better info
  6. pcguy408

    pcguy408 TS Rookie Topic Starter

    Thanks! Latest Spybot scan just came up with a few tracking cookies which i deleted. I'm currently running AVG again.
  7. mflynn

    mflynn TS Rookie Posts: 2,655

    Hi pcguy408

    Run HJT select and Fix the below.
    O23 - Service: McAfee Real-time Scanner (McShield) - Unknown owner - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe (file missing)
    O23 - Service: McAfee SystemGuards (McSysmon) - Unknown owner - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe (file missing)

    Then Do the TechSpot 8 steps:

    Skip no steps (do not install another virus scanner if you already have one, ask me before installing a Firewall).

    Most importantly update MalwareBytes and SuperAntiSpyware!

    Do the above attach the logs and we will fix this!

  8. pcguy408

    pcguy408 TS Rookie Topic Starter

    Thanks, will do!
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...