Hello,
My laptop was recently attacked by the Vundo Trojan. I followed the 8 steps removal procedure. I am attaching the 3 logs with this thread. Please help me resolve the issue. Thanks.

Regards
Raj Nambiar

Attached Files

	mbam-log-2009-04-24 (02-14-30).txt (4.1 KB, 1 views)
	hijackthis.log (24.9 KB, 1 views)
	SUPERAntiSpyware Scan Log - 04-24-2009 - 03-44-22.log (2.7 KB, 1 views)

Did you follow the instructions in Mbam to reboot to delete the malware?

Do NOT use System Restore while the system is being cleaned> this entry> C:\SYSTEM VOLUME INFORMATION\_RESTORE indicates that the malware is in the restore points. We will drop the old restore point and create a new, clean on when the malware has been removed.

You have Symantec/Norton entries as well as McAfee. Decide which you want to keep and remove the other:
I suspect you are not starting up, shutting down or surfing very fast. That is because you have to many processes starting on boot. (running processes, 04 entries, 023 services set to Automatic) That means they have to load, will run in the background, then each needs to shutdown. This is a waste of your resources as most can be started manually as needed. You are also using IE8 which is fat with bloat, using a lot of the system memory:

Examples: Media players (QuickTime Task, iTunes helper, ipod, Real Player updater, , Camera utilities, printer, PDF reader, Sonic, and on and on. you might want to look into that and the many Vaio processes Sony pre-loads. The ZoneAlarm Spyblocker is pre-checked on some update sites. I discourage using it because it is a BIG resource user.

Remove Bad Entries in HijackThis:
• Run HijackThis
• Click on the System Scan Only button
• Put a check beside all of the items listed below (if present):
• Close all open windows and browsers/email, etc...
• Click on the "Fix Checked" button
• When completed, close the application.

Boot into Safe Mode:
Start> Run> msconfig> enter> Selective Startup> Startup menu> UNCHECK the following:
Internet options> Security tab> Trusted Sites> Sites> remove the following from the Trusted Zone:
Reset Cookies:
Control Panel> Add/Remove Programs> UNINSTALL the following:
Boot into Normal Mode> Ignore the nag message and close it after checking 'don't show message again.' Stay in Selective Startup.

Run Vundo Fix:
Please download VundoFix.exe HERE and save to your desktop.
Rescan with HijackThis after vundoFix. Attach new log and Vundfo report.

This thread is for the use of razerforlove only. Please don't post your own virus/spyware problems in this thread. Instead, open a new thread in our Virus and Malware Removal Forum.

I now understand what I missed. Thanks a lot for your reply. I will immediately follow the instructions and will post the new logs. Thanks once again.

Hello,
I have followed all the instructions given in your post. I did not uninstall IE8 or other BOG resource user, but I will slowly look into what to keep and what to remove. I also uninstalled the weather channel programs and zone alarm spyblocker. I could not find viewpoint manager to uninstall. I could only find Viewpoint player which I have not yet uninstalled. I am attaching all the 4 logs along with this comment. Please verify and let me know if my PC is safe. Thanks a lot for your precious time.

Regards
Raj Nambiar

Attached Files

	SUPERAntiSpyware Scan Log - 04-25-2009 - 02-55-02.log (465 Bytes, 2 views)
	mbam-log-2009-04-25 (01-41-37).txt (864 Bytes, 2 views)
	hijackthis.log (23.4 KB, 2 views)
	VundoFix.txt (136 Bytes, 2 views)

Okay, very good! Almost there!

Open HijackThis again> System Scan Only> Check the following:
[quote]
Close all Windows and email> click on Fix Checked
Close when through

Boot into Safe Mode:
Start> Run> msconfig> enter> Selective Startup> Startup menu> UNCHECK the following:
PIFSvc.exe

Control Panel> Add/Remove Programs> UNINSTALL the following:
Viewpoint player

Right click on Start> Explore> Windows> System 32> right click> delete on the following if found:
pudomehi.dll

Boot into Normal Mode> Ignore the nag message and close it after checking 'don't show message again.' Stay in Selective Startup.

Run Combofix:
Please download ComboFix. HERE:

With ComboFix, at the download window, please rename it to Combo-Fix(.exe) before downloading it.

Please disable all security programs, such as antiviruses, antispywares, and firewalls.
Also disable your internet connection.

• Run Combo-Fix.exe and follow the prompts.
Rescan with HijackThis when through. Attach Combofix report and new HJ log.
If they're clean, we will finish up.

Hello,
Sure. I am on it. Thanks once again for your quick reply. Will be back soon with the new set of logs.

Regards
Raj Nambiar

Hello
When I started my PC in safe mode, I could not find PIFSvc.exe under Start> Run> msconfig> enter> Selective Startup> Startup menu to UNCHECK it.

I did not find pudomehi.dll under Right click on Start> Explore> Windows> System 32

Can I enable my system restore?

Please find the latest HijackThis.log and ComboFix.txt with this file. Thanks once again for all your help.

Regards
Raj Nambiar

Attached Files

	hijackthis.txt (22.5 KB, 1 views)
	ComboFix.txt (30.8 KB, 3 views)

P2P software/programs are a major contributor to your infections.

We reserve the right to withdraw our support:
If such programs are found in your logs
Should you not agree to their removal.
As they are normally set to bypass your Firewall and Anti-Virus software
Filesharing/P2P Programs serves as a constant threat to your computer

Uninstall:
c:\program files\Azureus << you decide

If you remove it, reboot and post new combofix log

Hello,
I had uninstalled Azureus even before I posted my last set of logs, but some how the windows uninstaller did not remove the Azureus folder and some files within it in the "C:\Program FIles" directory. That is what was listed in the ComboFix log that I attachet last time. It is all gone now. I am attaching the new ComboFix log with this post. Thanks once again for your wonderful help.

Regards
Raj Nambiar

Attached Files

ComboFix.txt (28.8 KB, 2 views)

Open notepad and copy/paste the text in the quotebox below into it:

Save this as:
CFScript

http://www.fromsej.saknet.dk/billeder/cfscript.gif

Refering to the picture above, drag CFScript into ComboFix.exe

Then attach fresh combofix log.