|
#1
11-22-2008
|
|||
|
|||
|
Vundo virus
Hi guys...new here. would appreciate some help if possible.
last wednesday i got the dreaded Vundo virus/trojan...cant understand how, unless i clicked a link incorrectly. I have avast installed on 2 desktops and 3 laptops.... only my desktop has been infected.. Syptoms include: losing desktop icins windows explorer shut down randomly unable to use system restore or HP recovery centre logonui.exe error, also get fatal exception at area oe30 etc (numbers change) windows no disk error random response in safe mode i have done the following after reading other posts: updated and ran avast ran vundo fix malware system gives midly faster response, conects to web but not abel to get all images on pages. could someone point me in right direction to get my pc back to normal... system is HP pavilion 309 windows xp home edition service pack 3 1gb ram 2.4ghz intel celeron geforce 5500 agp card Thank you.. Last edited by ascot54; 11-22-2008 at 12:40 PM.. |
|
#2
11-22-2008
|
|||
|
|||
|
Hello ascot54
Sorry to tell you my friend you don't have just vundo but are eat up!! But you did get quite a few with that scan. When running the below UPDATE every time you run them again as sometimes updates can come houlry! Do the TechSpot 8 steps: http://www.techspot.com/vb/topic58138.html Note: Ascot in your case you have already ran a MBAM so all you need to do is modify the settings as below under MalwareBytes. Skip no steps (do not install another virus scanner as you already have one). Most importantly update MalwareBytes and SuperAntiSptware! Before you scan with SuperAntiSpyWare do the below: SuperAntispyware config After installed double-click the icon on your desktop to run it. Update the program definitions. Click the Preferences button. Then Scanning Control. In Scanner Options make sure all boxes are checked except #3 Ignore System Restore.. are checked: MalwareBytes After update but before running Click settings and confirm all are Checked. I repeat Update these 2 programs. Run them and attach their logs. Do this correctly and we will make a short job of this! Ascot again in your case as you have already ran MBAM then run SAS first then attache me the log then run MBAM again and get me a second log. Mike |
|
|
#3
11-22-2008
|
|||
|
|||
|
Mike,
there in lies another prob... i download via laptop and save to flash drive as desktop seems to "lock up" when trying to update.. will give it another go Paul |
|
#4
11-22-2008
|
|||
|
|||
|
Mike,
Avast found this.. virus in memory... allow reboot to delete at start up.. file name c:\Windows\system32\rkskt.sys type rootkit : hidden file i have read through to Section 3 and dont have any of those progs ! do i need to "disable" Avast ? desktop currently doing reboot scan with avast so i may be a while.. mananged to get ccleaner and SAS onto flashdrive and install to desktop ! thanks again for help so far.. Paul |
|
#5
11-22-2008
|
|||
|
|||
|
That can be a legit program. Let Avast do its thing clean what it finds. Then reboot.
Now since MBAM ran and cleaned much as you see in the log it may have exposed additional issues not even seen on the first run. Reboot UPDATE mbam if you can, and run it again until it comes up clean. Once Avast and 2 runs of MBAM complete SAS will likely run and sweep up the rest. Attache me all logs on all runs as you do them! Mike |
|
#6
11-22-2008
|
|||
|
|||
|
Mike,
ccleaner ran clean on 2nd run... 1st was 661mb crap... ran Malaware got 40 odd infections.. log attached Paul |
|
#7
11-22-2008
|
|||
|
|||
|
You ran it, it done its job, but you did not click next and tell MBAM to remove them!
No Action taken! Run it again it will find them again click to remove them then run it again to be sure they are gone. If it is not clean send log and run it again. Mike |
|
#8
11-22-2008
|
|||
|
|||
|
Mike,
ran it again... i did select remove at reboot, however i couldn't get the log file to copy to my flash drive.. now goint to try step 5 ..SAS mode... btw on reboot i didnt get the logonui.exe problem like i had earlier ! |
|
#9
11-22-2008
|
|||
|
|||
|
Mike,
latest from my problem still couldnt copy log file to flash drive to to slow response/lock out system seems to have picked up.. not had logonui.exe error again... now running SAS... i got 9 items detected in Adware.MyWebSearch/FunWebProducts and Rogue.Component/Trace IIRC correctly MyWeb has caused probs in past ! i never open links for MyWeb..think my other half has added stuff ! cant be sure, but the history in IE tells me different story to my usual web sites ! i'm gonna let SAS do its bit for tonight then carry on in morning.. 0030GMT here.. Really appreciate help on this... hopefully 1 day i can return favour by helping others too..! |
|
|
#10
11-22-2008
|
|||
|
|||
|
Mike ,
SAS done, see attached logs... my IE opens ok but i get text only no images..! any ideas.? ps.. MAM log was done prior to SAS |
|
#11
11-22-2008
|
|||
|
|||
|
Once we are clean we will handle all the Malware we will get to correcting other issues.
MBAM found and deleted much, we need it to come up clean UPDATE and run again. Then same for SAS UPDATE and run again. Mike |
|
#12
11-23-2008
|
|||
|
|||
|
Morning Mike,
I owe you a big Beer ! Just done MAM and SAS updates.. ran both guess what ? I'm Clean...big sigh of relief... i found out the cause of lack of images on IE ! i went to internet options.. scrolled down and found the insert images bullet was unchecked.! placed check mark in there and hey presto i have images.. only glitch so far to report here is that, when i did SAS update i got a small window pop up on right handside of my screen, no text or anything, just a little jave like icon on top left corner..! tried screen refresh, no response, wouldnt close itself. did a restart, and it cleared... have you encountered this. ? or similar ? Thanks again Mike you are a top chap in my book ! Best wishes from one happy cookie in UK..! Paul |
|
#13
11-23-2008
|
|||
|
|||
|
Great Paul
You did a fantastic job. The yellow shield was a notice that you needed to reboot to finish the update. Since you had already ran mbam and sas I disregarded it but now go back to here do the TechSpot 8 steps: http://www.techspot.com/vb/topic58138.html Since you have already done the mbam and sas do the CCleaner and HJT. I need a fresh HJT log. Mike |
|
#14
11-23-2008
|
|||
|
|||
|
hi!
I`ve tried all the steps and still get a Done blank page on some sites! i`ll post my log so hopefully someone can shed light on this. many thanx km |
|
#15
11-23-2008
|
|||
|
|||
|
Mike,
here is my latest HJT file.. ran CC before it too.. anything need fine tuning here buddy ? Rgds Paul |
|
#16
11-23-2008
|
|||
|
|||
|
Hold on lets finish cleanup and that will come.
HJT Scan only Select and remove the below O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) Next go to Control Panel Add/Remove programs and uninstall all Java except the last one. Then Clean and update Java Cleanup old Java and update to newest version this program will do it all for you. Download JavaRa http://prm753.bchea.org/JavaRa.html Unzip it, run it, to update chose Jucheck (Suns updater) first, and if you do not have Jucheck then chose Update using Sun. After update chose Cleanup old versions. Give it a minute and after it pops up the log file you will see what it removed. Then click "Additional tasks" and check "remove Useless JRE files and Remove JavaRa log files. After that run Search for Updates again to confirm you are up to date. After that run remove older versions again. This time the Log file should be empty. ---------------------------------------------------------------------------------------------------------------------------------------------------- Next Download Dial-A-Fix (DAF) http://wiki.djlizard.net/Dial-a-fix#...C_and_articles http://djlizard.net.nyud.net:8080/so...v0.60.0.24.zip Have XP CD available in case DAF needs a file. Check all boxes on the screen (clear any restrictions if it shows any) Then click GO! When the entire page is finished click the HammerHead at bottom to go to the second DAF page. Here 1 at a time do the below Flush DNS Reset networking Watch for any File not found or other errors and make note as this may lead to the fix! Reboot retest! EDIT: Put it thu its paces so you can give me a status report and remaining issues. Mike |
|
#17
11-23-2008
|
|||
|
|||
|
Mike,
i cant find that BO file ref you posted ...! |
|
#18
11-23-2008
|
|||
|
|||
|
Neither can I!
I must have had someone else's log open  I try to Multitask but only women can do that! Her are yours O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O20 - Winlogon Notify: hegultwk - hegultwk32.dll (file missing) I will take you up on the beer when next I am there, large pitcher right?  New HJT log after. Mike |
|
#19
11-23-2008
|
|||
|
|||
|
can t up load latest HJT for some reason
|
|
#20
11-23-2008
|
|||
|
|||
|
got it now me think
your'e on for that beer buddy... |
 |
| Thread Tools | |
|
|
| Similar Topics | ||||
| Topic | Category | Replies | Last Post | |
| Mal vundo-4 virus removal | Virus & Malware removal | 0 | 05-08-2008 07:17 AM | |
| Persistent vundo virus | Virus & Malware removal | 8 | 04-25-2008 01:36 AM | |
| Vundo Virus - please help | Virus & Malware removal | 18 | 04-19-2008 08:58 AM | |
| Removing Vundo Virus | Virus & Malware removal | 2 | 04-17-2008 11:02 AM | |
| Trojan.Vundo Virus lo1[1] | Virus & Malware removal | 1 | 06-07-2007 09:20 PM | |
All times are GMT -4. The time now is 09:45 PM.