
UNSOLVED
Trojan.Vundo help please
for the past couple weeks i have been battling the Trojan.Vundo to no avail. Norton was telling me it could not be repaired and the symantec removal tool detected it a couple times, but also would tell me it was not found other times. I continued to get the Norton popup telling me that my computer had the virus Trojan.Vundo. i read a forum that suggested the VundoBeGone download. I downloaded and ran the VundoBeGone and got the "Blue Screen of Death" saying fatal errors and begining physical memory dump. I rebooted my system and ran the FixVundo tool from Symantec. it did not find the virus on my computer. I then ran a full scan and again, the virus was not found. the popups have finally stopped and i think the virus may be gone, but i want to make sure im not missing any steps. the log from VBG is as follows....PLEASE HELP!!
[12/01/2005, 11:51:33] - Starting Process...
[12/01/2005, 11:51:33] - Looking for Browser Helper Object [MSEvents Object]
[12/01/2005, 11:51:33] - 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - AcroIEHlprObj Class
[12/01/2005, 11:51:33] - 2: {4D25F921-B9FE-4682-BF72-8AB8210D6D75} -
[12/01/2005, 11:51:33] - WARNING: 2: {4D25F921-B9FE-4682-BF72-8AB8210D6D75} - BHO Name is blank.
[12/01/2005, 11:51:33] - Checking for WinLogon Notify reference. (File: C:\Program Files\MyWaySA\SrchAsDe\1.bin\deSrcAs.dll)
[12/01/2005, 11:51:33] - Couldn't find deSrcAs in Winlogon Notify. Ignoring {4D25F921-B9FE-4682-BF72-8AB8210D6D75}.
[12/01/2005, 11:51:33] - 3: {5CA3D70E-1895-11CF-8E15-001234567890} - DriveLetterAccess
[12/01/2005, 11:51:33] - 4: {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - AOL Toolbar Launcher
[12/01/2005, 11:51:33] - 5: {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - CNisExtBho Class
[12/01/2005, 11:51:33] - 6: {BDF3E430-B101-42AD-A544-FADC6B084872} - CNavExtBho Class
[12/01/2005, 11:51:33] - 7: {FC148228-87E1-4D00-AC06-58DCAA52A4D1} - MSEvents Object
[12/01/2005, 11:51:33] - Found MSEvents Object!
[12/01/2005, 11:51:33] - File location: C:\WINDOWS\system32\sstqn.dll
[12/01/2005, 11:51:33] - Attempting to kill C:\WINDOWS\system32\sstqn.dll
[12/01/2005, 11:51:33] - Terminating Process: RUNDLL32.EXE
[12/01/2005, 11:51:34] - Terminating Process: IEXPLORE.EXE
[12/01/2005, 11:51:34] - Disabling Automatic Shell Restart
[12/01/2005, 11:51:34] - Terminating Process: EXPLORER.EXE
[12/01/2005, 11:51:34] - Suspending the NT Session Manager System Service
[12/01/2005, 11:51:35] - Terminating Windows NT Logon/Logoff Manager
[12/01/2005, 11:51:36] - Re-enabling Automatic Shell Restart
[12/01/2005, 11:51:36] - Renaming C:\WINDOWS\system32\sstqn.dll -> C:\WINDOWS\system32\sstqn.dll.vir
[12/01/2005, 11:51:36] - File rename was unsucessful. Rename operation sent to SMSS for next reboot.
[12/01/2005, 11:51:36] - Removing Registry references to {FC148228-87E1-4D00-AC06-58DCAA52A4D1}
[12/01/2005, 11:51:36] - Adding Internet Explorer Protection (Kill ActiveX) for {FC148228-87E1-4D00-AC06-58DCAA52A4D1}
[12/01/2005, 11:51:36] - Removing Winlogon Notify Entry: sstqn
[12/01/2005, 11:51:36] - BHO list has been changed! Starting over...
[12/01/2005, 11:51:36] - 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - AcroIEHlprObj Class
[12/01/2005, 11:51:36] - 2: {4D25F921-B9FE-4682-BF72-8AB8210D6D75} -
[12/01/2005, 11:51:36] - WARNING: 2: {4D25F921-B9FE-4682-BF72-8AB8210D6D75} - BHO Name is blank.
[12/01/2005, 11:51:36] - Checking for WinLogon Notify reference. (File: C:\Program Files\MyWaySA\SrchAsDe\1.bin\deSrcAs.dll)
[12/01/2005, 11:51:36] - Couldn't find deSrcAs in Winlogon Notify. Ignoring {4D25F921-B9FE-4682-BF72-8AB8210D6D75}.
[12/01/2005, 11:51:36] - 3: {5CA3D70E-1895-11CF-8E15-001234567890} - DriveLetterAccess
[12/01/2005, 11:51:36] - 4: {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - AOL Toolbar Launcher
[12/01/2005, 11:51:36] - 5: {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - CNisExtBho Class
[12/01/2005, 11:51:36] - 6: {BDF3E430-B101-42AD-A544-FADC6B084872} - CNavExtBho Class
[12/01/2005, 11:51:36] - Finished searching for [MSEvents Object]
[12/01/2005, 11:51:36] - Finishing up...
[12/01/2005, 11:51:36] - Enabling Automatic Reboot on STOP Error.
[12/01/2005, 11:51:36] - Attempting to Restart via STOP error (Blue Screen!)
[12/01/2005, 11:51:33] - Looking for Browser Helper Object [MSEvents Object]
[12/01/2005, 11:51:33] - 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - AcroIEHlprObj Class
[12/01/2005, 11:51:33] - 2: {4D25F921-B9FE-4682-BF72-8AB8210D6D75} -
[12/01/2005, 11:51:33] - WARNING: 2: {4D25F921-B9FE-4682-BF72-8AB8210D6D75} - BHO Name is blank.
[12/01/2005, 11:51:33] - Checking for WinLogon Notify reference. (File: C:\Program Files\MyWaySA\SrchAsDe\1.bin\deSrcAs.dll)
[12/01/2005, 11:51:33] - Couldn't find deSrcAs in Winlogon Notify. Ignoring {4D25F921-B9FE-4682-BF72-8AB8210D6D75}.
[12/01/2005, 11:51:33] - 3: {5CA3D70E-1895-11CF-8E15-001234567890} - DriveLetterAccess
[12/01/2005, 11:51:33] - 4: {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - AOL Toolbar Launcher
[12/01/2005, 11:51:33] - 5: {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - CNisExtBho Class
[12/01/2005, 11:51:33] - 6: {BDF3E430-B101-42AD-A544-FADC6B084872} - CNavExtBho Class
[12/01/2005, 11:51:33] - 7: {FC148228-87E1-4D00-AC06-58DCAA52A4D1} - MSEvents Object
[12/01/2005, 11:51:33] - Found MSEvents Object!
[12/01/2005, 11:51:33] - File location: C:\WINDOWS\system32\sstqn.dll
[12/01/2005, 11:51:33] - Attempting to kill C:\WINDOWS\system32\sstqn.dll
[12/01/2005, 11:51:33] - Terminating Process: RUNDLL32.EXE
[12/01/2005, 11:51:34] - Terminating Process: IEXPLORE.EXE
[12/01/2005, 11:51:34] - Disabling Automatic Shell Restart
[12/01/2005, 11:51:34] - Terminating Process: EXPLORER.EXE
[12/01/2005, 11:51:34] - Suspending the NT Session Manager System Service
[12/01/2005, 11:51:35] - Terminating Windows NT Logon/Logoff Manager
[12/01/2005, 11:51:36] - Re-enabling Automatic Shell Restart
[12/01/2005, 11:51:36] - Renaming C:\WINDOWS\system32\sstqn.dll -> C:\WINDOWS\system32\sstqn.dll.vir
[12/01/2005, 11:51:36] - File rename was unsucessful. Rename operation sent to SMSS for next reboot.
[12/01/2005, 11:51:36] - Removing Registry references to {FC148228-87E1-4D00-AC06-58DCAA52A4D1}
[12/01/2005, 11:51:36] - Adding Internet Explorer Protection (Kill ActiveX) for {FC148228-87E1-4D00-AC06-58DCAA52A4D1}
[12/01/2005, 11:51:36] - Removing Winlogon Notify Entry: sstqn
[12/01/2005, 11:51:36] - BHO list has been changed! Starting over...
[12/01/2005, 11:51:36] - 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - AcroIEHlprObj Class
[12/01/2005, 11:51:36] - 2: {4D25F921-B9FE-4682-BF72-8AB8210D6D75} -
[12/01/2005, 11:51:36] - WARNING: 2: {4D25F921-B9FE-4682-BF72-8AB8210D6D75} - BHO Name is blank.
[12/01/2005, 11:51:36] - Checking for WinLogon Notify reference. (File: C:\Program Files\MyWaySA\SrchAsDe\1.bin\deSrcAs.dll)
[12/01/2005, 11:51:36] - Couldn't find deSrcAs in Winlogon Notify. Ignoring {4D25F921-B9FE-4682-BF72-8AB8210D6D75}.
[12/01/2005, 11:51:36] - 3: {5CA3D70E-1895-11CF-8E15-001234567890} - DriveLetterAccess
[12/01/2005, 11:51:36] - 4: {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - AOL Toolbar Launcher
[12/01/2005, 11:51:36] - 5: {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - CNisExtBho Class
[12/01/2005, 11:51:36] - 6: {BDF3E430-B101-42AD-A544-FADC6B084872} - CNavExtBho Class
[12/01/2005, 11:51:36] - Finished searching for [MSEvents Object]
[12/01/2005, 11:51:36] - Finishing up...
[12/01/2005, 11:51:36] - Enabling Automatic Reboot on STOP Error.
[12/01/2005, 11:51:36] - Attempting to Restart via STOP error (Blue Screen!)
Responses (0)
Solutions (0)
