Stubborn Vundo

Discussion in 'Malware Help (A Specialist Will Reply)' started by orkneyroad, Jan 3, 2009.

  1. orkneyroad

    orkneyroad Private E-2

    I've followed the READ & RUN ME FIRST. Malware Removal Guide and still seem to have residual infections. After succesfully completing the READ & RUN procedure for Windows XP, I ran SAS again to see if any infections were still present. I ended up running through the READ & RUN again, but still have a residual "Vundo." Please help...

    Attached are the logs from latest scans.
     

    Attached Files:

    orkneyroad, Jan 3, 2009
    #1
  2. orkneyroad

    orkneyroad Private E-2

    Here is the last log...
     

    Attached Files:

    orkneyroad, Jan 3, 2009
    #2
  3. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Looks not too bad, let's do this:

    Please disable all anti-virus and anti-spyware programs while we do the following ( be sure to re-enable when we are finished):


    Run C:\MGtools\analyse.exe by double clicking on it. (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
    NOTE: HJT may popup an error about the AppInit_DLLs line. Ignore it and click OK to continue.

    After clicking Fix, exit HJT.

    Now Copy the bold text below to notepad. Save it as fixME.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.
    Now use windows explorer to find and delete:
    c:\windows\system32\cbXQjKCu.dll
    C:\Documents and Settings\Owner\0DAD507193AAC7F0 --> Unless you know what this is!

    Reboot and run the C:\MGtools\GetLogs.bat file by double clicking on it. Then attach the new C:\MGlogs.zip.
     
    TimW, Jan 5, 2009
    #3
  4. orkneyroad

    orkneyroad Private E-2

    TimW

    Thanks! Your assistance is much appreciated...

    Attached is the MGlogs after the recommended fix. Thanks Again!
     

    Attached Files:

    orkneyroad, Jan 7, 2009
    #4
  5. orkneyroad

    orkneyroad Private E-2

    Well, after I ran the fix, I re-ran Malwarebytes. The registry entry showing Vundo still appears. Here is the latest log.
     

    Attached Files:

    orkneyroad, Jan 7, 2009
    #5
  6. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Well, how rude!!

    Please disable all anti-virus and anti-spyware programs while we do the following ( be sure to re-enable when we are finished):

    Copy the bold text below to notepad. Save it as fixME.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.
    Be sure to tell me if you get a success message.

    Now re-run SAS and see if it still exists.
     
    TimW, Jan 9, 2009
    #6
  7. orkneyroad

    orkneyroad Private E-2

    Well I think that took care of it. Thanks TimW. Much obliged. The regedit worked, and I reran SAS which came up clean. Thanks again.
     
    orkneyroad, Jan 11, 2009
    #7
  8. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Good to know...If you are not having any other malware issues, then:

     
    TimW, Jan 13, 2009
    #8

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds