VBouncer

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by SunFx, Sep 7, 2004.

  1. SunFx

    SunFx Private E-2

    I have a problem with this line in my Hijack This logfile;

    O4 - HKLM\..\Run: [VBundleOuterDL] C:\Program Files\VBouncer\BundleOuter.EXE

    Something is causing it to come back everytime I select it and fix it via Hijack This. I have had this problem a couple of times before and simply booted into safe mode and deleted the offending files myself, manually. However in this case, "C:\Program Files\VBouncer\BundleOuter.EXE" does not actually exist.

    When I visited the page that started this problem, the following application asked for permission to connect to the internet, "Installation" located in C:\Documents and Settings\Knytelite\Local Settings\Temp\GLB217.tmp in Zone Alarm. GLB217.tmp doesn't exist either, but I assume that is because it was a temporary file.

    Now when windows loads two applications ask for internet access that did not previously;

    Run a DLL as an App C:\WINDOWS\system32\rundll32.exe
    Windows NT Logon Application C:\WINDOWS\system32\winlogon.exe

    I googled BundleOuter.EXE because I assumed someone must have had this spyware before and been as confused as I am, and the solution presented was to boot into safe mode, go to Add/Remove programs and remove VirtualBouncer. As luck would have it, VirtualBouncer isn't on the list.

    I am thinking that because I have denied all the applications requesting internet access that shouldn't internet access, the program was not installed properly and that is why I cannot remove it, but I'm not sure what I should do now. If anyone can help me resolve the problem, it will be greatly appreciated.

    Thank you.
     
  2. Major Attitude

    Major Attitude Co-Owner MajorGeeks.Com Staff Member

    HKLM\..\Run means its running in startup. Grab a startup app like StartupCPL in our admin tool section and look for it in startup under registry and frankly, anywhere.. I assume you have run the spyware tools and checked add\remove programs for it as well. Often if you have, its no longer in add\remove programs because Ad-Aware or whatever removed it. I prefer to uninstall items from add\remove before letting a spyware removal tool take anything out.
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds