Trojan.Vundo.B

Re: Trojan.Vundo.B - HELP!?

I am also having the same problem!! Tried deleting the file myself and it doesnt work...says it's being used by another process.

Any ideas?

 

Re: Trojan.Vundo.B - HELP!?

I ran the HiJackthis application and saved the log file...

I do know that the virus scan sees the "unjava.dll" as the infected file and I see it on the hijackthis log. However, I can't delete the file because something else is accessing it.

Anyways, any help would be greatly appreciated and the log file is attached.


Thanks!

 

Re: Trojan.Vundo.B - HELP!?

desistyle3,

Please follow forum guidelines!

Do not post in someone elses thread, create your own thread if your having a problem.

Also, do not post any logs until requested.

First, please follow ALL the steps in this Sticky thread READ ME FIRST BEFORE ASKING FOR SUPPORT: Basic Spyware, Trojan And Virus Removal

After doing ALL of the steps in the READ ME:
Download and run the following removal tool:

• Trojan.Vundo Removal Tool

After doing ALL of the above if you still have a problem:


http://www.majorgeeks.com/images/grenade.gif Download HijackThis 1.99.1

http://www.majorgeeks.com/images/grenade.gif Unzip the hijackthis.exe file to a folder you create named C:\Program Files\HJT

http://www.majorgeeks.com/images/grenade.gif Do NOT run Hijack This from the Desktop, a temp folder, or a sub-folder of C:\Documents and Settings, or choose to run it directly from the ZIP file as your backups will not be safely stored.

http://www.majorgeeks.com/images/grenade.gifBefore running HijackThis: You must close each of the following:your web browser, e-mail client, instant messenger, and programs like notepad, wordpad, MS Word etc. And any other unnecessary running programs.

http://www.majorgeeks.com/images/grenade.gifRun HijackThis and save your log file.

http://www.majorgeeks.com/images/grenade.gif Post your log as an ATTACHMENT to your next post. (Do NOT copy/paste the log into your post as it will be removed).

http://www.majorgeeks.com/images/grenade.gifNeed help with HJT? See this thread: NO HIJACK THIS LOG FILES BEFORE READING THIS: HJT Tutorial & LOG File Posting

 

oh god..i just created a new thread and i didn't see this..i'm very sorry...do you want me to reattach my log file?


sorry about that

 

LOL! Its okay, I will have your other one closed. Post in this one from now on.

Follow all of the steps in the README and then run the removal tool.

Afterwards post a fresh HJT log.

 

went over the readme earlier...nothing has seemed to help...

i'm currently running the removal tool...

 

There are no signs of you running the online scans required in the READ ME. If you want this stuff removed you have to follow exactly what I request.

Now, please run the following online scans AFTER YOU HAVE RAN THE REMOVAL TOOL:

TrendMicro Online Scan
Bitdefender online scan
RavAntivirus online scan <-- select Auto Clean then click Scan My PC
TrojanScan online scan

After you run these online scans procede with the next step:

Please download HOSTER and then follow the below steps.

• Unzip Hoster to a convenient folder such as C:\Hoster

• Run Hoster.exe, click Restore Original Hosts and then click OK.
• Click the X to exit the program.

Now post a fresh HJT log from normal mode!

 

Okay..so i ran each scan...it found some other viruses and some were removed and some werent becaused it couldnt clean or delete.

I also ran the hoster, and I even used the new trojan.vundo.b removal tool. The tool did not work..it found the viruses, but said it could not delete them, so it made me restart and prompted a message that it would delete on system startup. However, it did not delete it and my virus software still detected it.

I have ran everything I can and the Hijackthis log file looks the same to me. I'm attaching my new HJT logfile.

Thanks!

 

Post me the log from the removal tool so I can see what files its finding. If you can provide me with the exact filename and location we can manually remove them.

Please look in Add or Remove Programs for the following and Uninstall them if found:

MyWay

Please print out these instructions so that you can operate with All Browser Windows CLOSED.

Please make sure System Restore is OFF and the Viewing of Hidden Files & Folders is Enabled as per the tutorial.


Now, look in Task Manager (Ctrl-Alt-Del) for the following running process and, if you see it, try to END it:

iexplore.exe <-- End every instance of this process as requested!

Now scan with HijackThis and Check the Boxes for the following:

Make sure All Browser Windows are Closed when you Click FIX.

R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)

O2 - BHO: myBar BHO - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC} - C:\Program Files\MyWay\myBar\1.bin\MYBAR.DLL
O2 - BHO: MSEvents Object - {44240BB5-BD7D-4D49-A1AA-8AB0F3D3CB44} - C:\WINDOWS\Help\unjava.dll

O3 - Toolbar: &My Way Speedbar - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - C:\Program Files\MyWay\myBar\1.bin\MYBAR.DLL

O9 - Extra button: Run DAP - {669695BC-A811-4A9D-8CDF-BA8C795F261C} -C:\PROGRA~1\DAP\DAP.EXE (file missing)
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} -%windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Software - {AF0828BC-CB46-4C8D-95B6-8A7C4988F9FF} - c:\pillasoft-com\index.html

O16 - DPF: {1C955F3B-5B32-4393-A05D-24B4970CD2A1} - http://streamp.babenet.com/cabs/videox.cab

O20 - Winlogon Notify: unjava - C:\WINDOWS\Help\unjava.dll

O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)

Again, make sure All Browser Windows are Closed when you Click FIX.

NOW:
Please boot into Safe Mode with the Viewing of Hidden Files & Folders Enabled and navigate to and DELETE the following if they should remain:

C:\Program Files\MyWay ←–– Delete this whole folder if it exist!

C:\WINDOWS\Help\unjava.dll

NEXT:
Run CCleaner and Spybot S&D and have Spybot fix what it finds.
Note: Dont forget to update Spybot S&D by selecting "Search For Updates"

Then, as an added precaution, Go to Start > Run and type: cleanmgr and then click OK. Make sure the boxes for these are checked:
Temporary Files
Temporary Internet Files
Recycle Bin

And Click OK.


Reboot to Normal Windows

FINAL STEP

Reset Web Settings & Default Security Settings:


To Reset Web Settings:
Right click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.

If you do not have an Internet Explorer icon on your Desktop, click Start, Control Panel (for some systems it may be Start, Settings, Control Panel), Internet Options, Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK


To Default Security Settings:
Right click on your desktop Internet Explorer icon and select Properties. Then click the Security Tab and click Default Level for Internet, Local Intranet, Trusted Sites, and Restricted Sites.

After doing ALL of the above,
Scan with HijackThis and attach the new log.
Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now.

Good Luck!

 

Apparently he ran into some problems, I requested the log from the tool.

 

didn't see a log that it created last time..

however, i do know the name of the file and where it is because my real-time protection finds it..I can not delete it manually using the cmd prompt and i've also tried in safe mode. The file and directory is:

c:\windows\help\unjava.dll

 

Hey...finally it's gone!!!

Turns out everything was removed using HJT except for the unjava.dll one. It wouldnt remove it at all. So i ran the symantec vundo.b removal tool again, but this time when it had me reboot to delete the file..i rebooted in safe mode after the scan and when i got to windows the file was already gone!

So everything looks good now, thanks so much for the help everyone!

 

One of the things I had to do was use the Symantec removal tool in the safe mode. Before running the tool in the safe mode, I also went into the registry and deleted the 3 files that are referenced. When I then ran the tool it did remove the virus.

I think the key is running the removal tool while your computer is in the safe mode.

Good luck.