Follow Atribune's procedure at:
 
http://www.atribune.org/forums/index.php?showtopic=447&hl=killvundo
 
The paths the program asks you for would be:
 
C:\WINDOWS\System32\pmnom.dll

and
 
C:\WINDOWS\System32\monmp.*

Do not use the ones given in the article.  They won't work for your infection.

You will know that it worked if the lines

O2 - BHO: MSEvents Object - {52B1DFC7-AAFC-4362-B103-868B0683C697} - C:\WINDOWS\System32\pmnom.dll

and

O20 - Winlogon Notify: pmnom - C:\WINDOWS\System32\pmnom.dll

either drop out of the scan or say File Missing. 

If you see either entry with File Missing then check and Fix Checked to get rid of them.

Post a new HijackThis scan when you are done. 
 
Ron
 

OMG!  I am now totally confused!!!!!!!!!!!!!!!!!  

I want to protect my new Dell PC... what do I do first????     (Should I have bought a Mac/Apple instead)?  lOLOLOL  I have heard that they are "immune" to most of this stuff only because they are on a different operating system... am I right?  Someone help, please!

Julieinblack

Message Edited by RKinner on 09-14-2005 07:40 PM