Trojan Vundo and Trojan Vundo H issues

Hi!

I recently had a problem with removing Trojan Vundo and Trojan Vundo H from my computer. I did the read first cleaning procedure and my computer seems to be okay now, but I was hoping someone could look at these logs and make sure. I can't seem to access my Spybot or Combofix logs either. Thank you so much!

Best regards,
J

 

Welcome! to MajorGeeks.com!

Were you able to run ComboFix as requested in the READ ME? If so, please attach the log. If not, please go back and run CF and attach the log once complete.

 

thanks! i was able to run it, but couldn't locate the log. I re-ran it and have attached the log.

best regards,
j

 

We need to update your versions of MBAM & SAS as there are newer versions available. Please uninstall your current versions, reboot once uninstalled. Once rebooted, download the newest versions below.

Once downloaded, install, update and run scans with both attaching the new logs once complete. Also, please attach a new set of logs from MGTools.

Malwarebytes Anti-Malware 1.33

SUPERAntiSpyware 4.25.0.1010

 

thank you for your help so far, i really appreciate it.
well, i downloaded and re-ran and both programs told me that they found 0 threats. for some reason superspy did not give me a log (is this possible?) and i have attached the malawares log.

let me know what's next!

 

Pre-Instructions:

1. First, please disable any antivirus and/or antispy programs you have installed so they will not block this fix.
   
2. Print out these instructions or save them to a text file so that you can operate with All Browser Windows CLOSED.

Step 1:

Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

Again, make sure ALL browser windows are closed when you click FIX.​

Step 2:

Now we need to use ComboFix to remove a bunch of malware files.

• Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
  • If it is not on your Desktop, the below will not work.
• Open Notepad and copy/paste the text in the below quote box into it:

• Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
• At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
• You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
• Now use your mouse to drag CFscript.txt on top of ComboFix.exe
• Follow the prompts.
• When it finishes, a log will be produced named c:\combofix.txt
• I will ask for this log below

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.​

Step 3:

Default Security Settings

To Default Security Settings:
For Internet Explorer 6 users:
Click Start > Run > type inetcpl.cpl and press ENTER, when Internet Properties comes up navigate to the Security Tab and click Default Level for the following:

• Internet
• Local Intranet
• Trusted Sites
• Restricted Sites.

Click OK to exit.

For Internet Explorer 7 users:
Click Start > Run > type inetcpl.cpl and press ENTER, when Internet Properties comes up, navigate to the Security Tab and simply click the "Reset all zones to default level" button. Click OK to exit.

NOTE: If it's "grey" then it's already at the default level.​

Step 4:

Please download ATF-Cleaner by Atribune. This program does not require an installation. The executable actually runs the program.

NOTE: This program is for Windows XP and Windows 2000 only. ATF Cleaner will remove all files from the items that are checked so if you have some cookies you'd like to save. Please move them to a different directory first.

• Double-click ATF-Cleaner.exe to run the program.
• Under Main choose: Select All
• Click the Empty Selected button.

If you use Firefox browser

• Click Firefox at the top and choose: Select All
• Click the Empty Selected button.
  • NOTE: If you would like to keep your saved passwords, please click No at the prompt.

If you use Opera browser

• Click Opera at the top and choose: Select All
• Click the Empty Selected button.
  • NOTE: If you would like to keep your saved passwords, please click No at the prompt.

Click Exit on the Main ATF-Cleaner menu to close the program.​

Step 5:

Finally, run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

Then attach the below logs:

• C:\ComboFix.txt
• C:\MGlogs.zip

​

Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now.

 

hi - sorry i'm so long in responding but i was out of town for awhile. i tried to do the clean but encountered an immediate problem - i don't seem to have MGtools.analyse, i have MG tools, but it auto scans when i load it and doesn't give me any options. please advise! and thank you so much for your help so far.

 

please disregard the last post, i found the program and am working on it...

 

okay, i think we got it now! my computer is running fine. let me know if i have a clean bill of health and should i hold on to all the programs i downloaded?

 

First, I recommend that you clean up your Desktop immediately leaving only links. Do not store downloads, exe files, iso files, etc; on your Desktop. First it is not a safe place to keep them (i.e., you may lose them due to malware, and a cluttered Desktop is an easy hiding place for malware, and last but not least it can have an effect on your PC’s performance.

Now download The Avenger by Swandog46, and save it to your Desktop.

• Extract avenger.exe from the Zip file and save it to your desktop
• Run avenger.exe by double-clicking on it.
• Do not change any check box options!!
• Copy everything in the Quote box below, and paste it into the Input script here: part of the window:

• Now click the Execute button.
• Click Yes to the prompt to confirm you want to execute.
• Click Yes to the Reboot now question that will appear when Avenger finishes running.
• Your PC should reboot, if not, reboot it yourself.
• A log file from Avenger will be produced at C:\avenger.txt and it will pop up for you to view when you login after reboot. Please attach this log to your next post.