Trojan.vundo

[pcguy408]

Hi,

I'm having trouble with trojan.vundo. I've ran the fixvundo fix in safe mode and it said it didnt find any infections. I also ran Malwarebytes it said it was clean also. Whenever i run AVG or Trend Housecall it find trojan.vundo.

Hi-jack this logs i believe look clean, but i am a novice. Any ideas? I'm now unable to run Trend Housecall i receieve a "could not transfer data over the internet error message"..

So looks the virus is still in my machine, not sure where or how to remove it. Any help would be appreciated.

 

[pcguy408]

Here's my logs.

 

[swwelsh]

Where does it see the virus? It could be that the virus software has quarantined it, and it still shows up in a scan, or it could be in your system restore folder. You can delete quarantined files from AVG, and you can delete system restore folders by turning off system restore, rebooting and then turning it back on and making a new restore point

 

[pcguy408]

Earlier i ran Housecall and Spybot and it found a bunch of vundo instances, Last couple of MalwareBytes scans have been clean. I'm currently AVG again. System Restore is disabled at the moment.

I've ran these scans now for hours both in safe mode and regular mode and it seems to always come back.

Last AVG scan found Vundo in C:/Windows/System32/ngnrclqw.dll
/System32/nkvuec.dll

Does my hi-jack this logs look ok? Im unable to run Trend Housecall now because i receive a error message stating "unable to transfer data to the internet"

 

[swwelsh]

I don't see any suspicious bho's in HJT, but I am no expert on how this one works. I found a couple of tools for it listed here:
http://www.bleepingcomputer.com/malware-removal/remove-vundo-virtumonde
Also make sure you have updated malwarebytes to the newest version, same with vundofix. There are a lot of versions of this one, and they adjust it to bypass the removal tools. Some of the experts here may have better info

 

[pcguy408]

Thanks! Latest Spybot scan just came up with a few tracking cookies which i deleted. I'm currently running AVG again.

 

[mflynn]

Hi pcguy408

Run HJT select and Fix the below.
O23 - Service: McAfee Real-time Scanner (McShield) - Unknown owner - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe (file missing)
O23 - Service: McAfee SystemGuards (McSysmon) - Unknown owner - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe (file missing)

Then Do the TechSpot 8 steps: https://www.techspot.com/community/...lware-removal-preliminary-instructions.58138/

Skip no steps (do not install another virus scanner if you already have one, ask me before installing a Firewall).

Most importantly update MalwareBytes and SuperAntiSpyware!

Do the above attach the logs and we will fix this!

Mike

 

[pcguy408]

Thanks, will do!