How to remove trojan.vundo malware with Hijackthis file log

By kerog
Apr 4, 2009
  1. Hello gents,

    I have trouble with my PC running Windows XP/Media Center Edition/ Version 2002 / Service Pack 3.

    When I start my computer, I get a pop up microsoft windows titled RUNDLL explaining there is an loading error of c:\WINDOWS\System32\fagometo.dll : the specified module can not be found.

    After light researches on the net, I understood fagometo.dll is linked to trojan.vundo malware.

    So I ran hijackthis and i got the attached log file.

    Hope you'll be able to help me.

    Thank you for your support.

  2. Spyder_1386

    Spyder_1386 TS Booster Posts: 498

  3. Spyder_1386

    Spyder_1386 TS Booster Posts: 498

    Hey Kerog

    Run TaskManager > Processes tab .... end your Rundll32.exe if possible.

    HJT remove below (these are not all but main ones)
    All lines ending with (file missing) and (no file)
    O4 - HKLM\..\Run: [nupobiboga] Rundll32.exe "C:\WINDOWS\system32\fagometo.dll",s
    O4 - HKCU\..\Run: [wmkqsgc] "c:\documents and settings\ronan\local settings\application data\wmkqsgc.exe" wmkqsgc
    O4 - HKUS\S-1-5-19\..\Run: [nupobiboga] Rundll32.exe "C:\WINDOWS\system32\fagometo.dll",s (User 'SERVICE LOCAL')
    O4 - HKUS\S-1-5-20\..\Run: [nupobiboga] Rundll32.exe "C:\WINDOWS\system32\fagometo.dll",s (User 'SERVICE RÉSEAU')
    O20 - AppInit_DLLs: c:\windows\system32\yezumoyu.dll c:\windows\system32\mupapupe.dll c:\windows\system32\ c:\windows\system32\jonotama.dll c:\windows\system32\juvabuye.dll C:\WINDOWS\system32\lijuhidi.dll c:\windows\system32\gezokije.dll

    Please note that these are not all your errors and you still need to run the 8-step tool that I posted previously.

    Spyder_1386 :)

    P.S. Thanks mflynn for assistance.
Topic Status:
Not open for further replies.

Similar Topics

Add your comment to this article

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...