Vundo gone, but problems remain

Aderak · Aug 19, 2008

I recently had a bout with The Dreaded Vundo, and after finally removing it I'm still having some problems with web browsing and system restore. Both Internet Explorer (v7) and Firefox (v3) totally freeze my PC when I attempt to load a page, and I can't use system restore to get back the The Time Before The Dreaded Vundo - I have a restore point but it can't restore it.
Firefox works for a while in safe mode, but it inevitably freezes after a short while.
I was wondering if anyone else had had similar problems, or any ideas on how to fix it?

TimW · Aug 19, 2008

Welcome to Major Geeks!

Please follow the instructions in the below link and attach the requested logs when you finish these instructions.

If something does not run, write down the info to explain to us later but keep on going.

Do not assume that because one step does not work that they all will not.

READ & RUN ME FIRST. Malware Removal Guide

Note:

1. If you run into problems trying to run the READ & RUN ME or any of the scans in normal boot mode. You can running steps in safe boot mode but make sure you tell us what you did later when you post logs. See the below if you do not know how to boot in safe mode:

Starting your computer in Safe mode

2. If you have problems downloading on the problem PC, download the tools on another PC and burn to a CD. Then copy them to the problem PC. You will have to skip getting updates if (and only if) your internet connection does not work. Yes you could use a flash drive too but flash drives are writeable and infections can spread to them.

Aderak · Aug 20, 2008

OK, I've run through the read me first and one of the applications (Anti malware) has removed yet more Vundo files (grr). One of the logs states that the repair console is not installed, however I am positively, absolutely sure that it is as I have used it in the past on that computer.

Aderak · Aug 20, 2008

Slightly belated SAS log

TimW · Aug 20, 2008

Not much to clean up ( though you really need to clean your desktop - great place for malware to hide).

Please disable all anti-virus and anti-spyware programs while we do the following (re-enable when you are finished):

Run C:\MGtools\analyse.exe by double clicking on it. This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
Click to expand...

After clicking Fix, exit HJT.

Now use windows explorer to find and delete:
C:\WINDOWS\system32\oxdphqlo.hvy
C:\WINDOWS\system32\mwivfsyj.gcg
C:\WINDOWS\F579118563414E21A47F41B57AC749B5.TMP
C:\WINDOWS\NV56605964.TMP
C:\WINDOWS\NV28684036.TMP
C:\WINDOWS\NV25281816.TMP

Tell me what malware issues you may still be having.

Aderak · Aug 20, 2008

I'm still having problems with Firefox locking up, and the PC is also very sluggish, with logging in taking a long time (although this could just be the sheer volume of anti-spyware now starting up).

TimW · Aug 20, 2008

I would be inclined to download FireFox again and then uninstall your current version, reboot and install the newly downloaded version.

You may also wish to use a Startup Manager

If you are not having any other malware problems, it is time to do our final steps:

You can uninstall SUPERAntiSpyware now.

We recommed you keep Malwarebytes Anti-Malware as a scanner. It uses no resources except a little disk space until you run a scan.

If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)

Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required

"%userprofile%\Desktop\combofix" /u

Notes: The space between the combofix" and the /u, it must be there.

This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

Delete the C:\combo-fix folder from combofix.

If we had you run Avenger, you can delete all files related to Avenger now.

If we had you run RenV.exe, you can delete it and the Log.txt file on your Desktop.

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.

If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Go to add/remove programs and uninstall HijackThis.

You can delete the C:\MGtools folder and the C:\MGtools.exe file. You can also delete the C:\MGlogs.zip

If you are running Vista, Windows XP or Windows ME, do the below:

Refer to the cleaning steps in the READ ME for your Window version and see the steps to Disable System Restore which will flush your Restore Points.

Then reboot and Enable System Restore to create a new clean Restore Point.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

Click to expand...

Aderak · Aug 21, 2008

I've tried reinstalling Firefox in that way (including having it remove personal information/custom settings on uninstall), but it's still causing the PC to hang after a short period of browsing. I haven't tried with Internet Explorer but as it was also hanging before presumably it still is.
I'm currently running a full scan with MBAM to see if it can pick anything up, I'll post a log if it finds anything.

Aderak · Aug 21, 2008

OK, I did a full scan of the C drive and MBAM only found stuff in System Restore folders. I've installed SP3 in the hope that whatever file is affected will be replaced by a fresh version.
I'm not sure if it's still hanging after the SP3 install, obviously until it happens I can't be sure. What is the best app for detecting problems, so that I know whether or not the PC is clear?
Thanks for you help so far, hopefully the end is in sight.

TimW · Aug 21, 2008

Please refer to items #2 , #11 and #12 in my last post.

Log in or Sign up

Vundo gone, but problems remain

Aderak Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Aderak Private E-2

Attached Files:

combofix.txt

mbam-log-08-20-2008 (12-02-20).txt

MGlogs.zip

Aderak Private E-2

Attached Files:

SUPERAntiSpyware Scan Log - 08-20-2008 - 16-01-37.log

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Aderak Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Aderak Private E-2

Aderak Private E-2

Attached Files:

mbam-log-08-21-2008 (15-38-50).txt

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member