Vundo Virus

General_Hogwart · 29 May 2007 at 9:38PM

I picked up a Virus called Vundo recently which was causing my system to run slow and, lots of other problems and lots of pop-ups too.

Does anyone know where the virus may have come from and recommend a good anti-virus/anti malware to keep it and others away.

I hope it did not have a keylogger or anything else like that as I used a debit card whilst infected and really hope they didn't get the details! :-s

Browntoa · 29 May 2007 at 9:40PM

have you removed it properly ??

http://www.majorgeeks.com/download4954.html

VundoFix is a [URL="javascript:void(0)"]removal tool[/URL] for Virtumonde - aka Winfixer.

To use Vundofix:
- Download the file and then double-click *VundoFix.exe* to run it.
- Put a check next to *Run VundoFix as a task.
- You will receive a message saying vundofix will close and re-open in a minute or less. Click *OK*
- When VundoFix re-opens, click the *[URL="javascript:void(0)"]Scan[/URL] for Vundo* button.
- Once it's done [URL="javascript:void(0)"]scanning[/URL], click the *Remove Vundo* button.
- You will receive a prompt asking if you want to remove the files, click *YES*
- Once you click yes, your desktop will go blank as it starts removing Vundo.
- When completed, it will prompt that it will shutdown your computer, click *OK*.
- Turn your computer back on.

Browntoa · 29 May 2007 at 9:41PM

and there is a very good chance that it included a keylogger

follow posts 1 to 4 of

http://forums.moneysavingexpert.com/showthread.html?t=133269

General_Hogwart · 29 May 2007 at 10:05PM

Thanks Browntoa,

I think it is all gone, a friend used a Vundofix tool but it wouldn't delete the files in windows, even in safe mode, he had to connect to a different o/s to remove it.

Just had a pop-up now but think that was from something else (real player maybe) it had the same colourings - something about movies.

Gutted if it does have a keylogger, hopefully thats all gone too.

I will have a good read through those threads. Thanks again!

dbs · 19 July 2007 at 7:39PM

I too have Virtumonde on my computer which Adaware picked up tried to get rid of it as suggested using Vundofix which appeared ok.

Next time I used Adaware again it picked up the Virtumonde infection but when I scan with Vundofix it comes up all clear?

It has infected Reg Value ...\microsoft\windows\currentversion\explorer\shellexe

Also Reg Key ....software\microsoft\installer

Also if I use Adaware in safe mode it states the definitions are 106 days old and needs updating and does not pick up the Virtumonde but when run in normal mode it is up to date and does pick up the Virtumonde infection.

How can I get rid of this annoying infection.

I am using Windows Vista

Browntoa · 19 July 2007 at 7:57PM

read post 2 again in this thread, follow that

then follow post 3 of this thread

you may need to run what is Vista compatable but run it in safe mode

Spybot is Vista compatable

To get into the Windows Vista Safe mode, as the computer is booting press and hold your "F8 Key" which should bring up the "Windows Advanced Options Menu" . Use your arrow keys to move to "Safe Mode" and press your Enter key.

dbs · 19 July 2007 at 9:43PM

Tried vendofix a few times but finds nothing Adaware keeps finding it though also has found Adware.NaviPromo which Adaware cant fix.

Also having a few problems with my internet connection which keeps dis-connecting and going off line need to sort this out to download Spybot post etc

Browntoa · 19 July 2007 at 9:51PM

it's important to run in safe mode

hit F8 on boot up

skiddy2k · 19 July 2007 at 11:43PM

Try also running SmitFraudFix: http://siri.geekstogo.com/SmitfraudFix.php

Alfonso_Skinarelli · 20 July 2007 at 8:56AM

SmitfraudFix doesn't target Vundo infections.

If VundoFix hasn't been updated to cover your variant yet, use ComboFix on the machine. That way, you'll see what extra Vundo files need deleting from the report log.

Download ComboFix from either of these links:

http://www.techsupportforum.com/sectools/sUBs/ComboFix.exe

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Double click Combofix.exe & follow the prompts.

When finished, it shall produce a log for you. Post that log in your next reply

Note:
Do not mouseclick Combofix's window whilst it's running. That may cause it to stall.

A_Clock · 20 July 2007 at 10:12AM

Make sure you turn off system restore, it always backups the virus for you

Vundo Virus

Comments

Confirm your email address to Create Threads and Reply

🚀 Getting Started

Categories

Is this how you want to be seen?

Get our FREE Weekly email full of deals & guides - and it’s spam-free