Attachment uploads are currently disabled. This is a temporary situation and will resume as normal in the coming days.
UNSOLVED
- You too huh??? I am having the same problem. I have ran both the fix tools out there from Norton and I also followed the directions for safe mode and regedit. I did not find any of the files they said to look for. Norton 2005 does not allow you to delete this virus even during safe mode. I am at a loss and if I can find out a way to restore the entire pc I am going to!!!
- you also need virtumundobegone: here are the complete instructions, including the symantec tool:
Download [but do *NOT* yet run] FixVundo from
http://securityresponse.symantec.com/avcenter/FixVundo.exe
[we'll have you run it later]
Note: If you have previously download this file on another occasion, please download it again, to be absolutely sure you have the most current version.
********************
Next, download VirtumundoBeGone from:
http://secured2k.home.comcast.net/tools/VirtumundoBeGone.exe
* Save it to your Desktop
* Close all running programs (including your Internet Browser)
* Double-click VirtumundoBeGone.exe on the desktop
* Follow the directions as indicatedplease be advised that this program will generate a "BLUE SCREEN OF DEATH"... this is an expected/necessary part of the process, so don't be surprised when it happens.
just reboot if your system "jams"*********************
After rebooting, it's now time to run FixVundo (which you had downloaded earlier).
Make sure all other programs, including your Internet Browser, are closed.
Double-click the FixVundo.exe file to start the removal tool.
Click Start to begin the process, and then allow this tool to run.
Important: Do not launch any new applications while the tool is running!
Reboot your computer.Run the FixVundo removal tool again to ensure that the system is clean.
*********************
It's now time to report back to us:
VirtumundoBeGone generated a "log" file of its own, which it should have placed on your Desktop... please REPLY to this thread, and copy/paste the VirtumundoBeGone log back here.
[ It would also be prudent to follow-up on this, by generating and posting a HiJackThis log, in the HJT forum.]
- [12/01/2005, 21:28:34] - Starting Process...
[12/01/2005, 21:28:34] - Looking for Browser Helper Object [MSEvents Object]
[12/01/2005, 21:28:34] - 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - AcroIEHlprObj Class
[12/01/2005, 21:28:34] - 2: {2DEA8791-C2B7-48E1-8992-8E8E6A6FE789} - Drop Spam Toolbar
[12/01/2005, 21:28:34] - 3: {4D25F921-B9FE-4682-BF72-8AB8210D6D75} -
[12/01/2005, 21:28:34] - WARNING: 3: {4D25F921-B9FE-4682-BF72-8AB8210D6D75} - BHO Name is blank.
[12/01/2005, 21:28:34] - Checking for WinLogon Notify reference. (File: C:\Program Files\MyWaySA\SrchAsDe\deSrcAs.dll)
[12/01/2005, 21:28:34] - Couldn't find deSrcAs in Winlogon Notify. Ignoring {4D25F921-B9FE-4682-BF72-8AB8210D6D75}.
[12/01/2005, 21:28:34] - 4: {5CA3D70E-1895-11CF-8E15-001234567890} - DriveLetterAccess
[12/01/2005, 21:28:34] - 5: {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - CNisExtBho Class
[12/01/2005, 21:28:34] - 6: {B313D637-F405-4052-AC37-E2119AB3C8F8} - MSEvents Object
[12/01/2005, 21:28:34] - Found MSEvents Object!
[12/01/2005, 21:28:34] - File location: C:\WINDOWS\system32\jkhfc.dll
[12/01/2005, 21:28:34] - Attempting to kill C:\WINDOWS\system32\jkhfc.dll
[12/01/2005, 21:28:34] - Terminating Process: RUNDLL32.EXE
[12/01/2005, 21:28:35] - Terminating Process: IEXPLORE.EXE
[12/01/2005, 21:28:38] - Disabling Automatic Shell Restart
[12/01/2005, 21:28:39] - Terminating Process: EXPLORER.EXE
[12/01/2005, 21:28:41] - Suspending the NT Session Manager System Service
[12/01/2005, 21:28:41] - Terminating Windows NT Logon/Logoff Manager
[12/01/2005, 21:28:41] - Re-enabling Automatic Shell Restart
[12/01/2005, 21:28:42] - Renaming C:\WINDOWS\system32\jkhfc.dll -> C:\WINDOWS\system32\jkhfc.dll.vir
[12/01/2005, 21:28:42] - File rename was unsucessful. Rename operation sent to SMSS for next reboot.
[12/01/2005, 21:28:42] - Removing Registry references to {B313D637-F405-4052-AC37-E2119AB3C8F8}
[12/01/2005, 21:28:42] - Adding Internet Explorer Protection (Kill ActiveX) for {B313D637-F405-4052-AC37-E2119AB3C8F8}
[12/01/2005, 21:28:42] - Removing Winlogon Notify Entry: jkhfc
[12/01/2005, 21:28:42] - BHO list has been changed! Starting over...
[12/01/2005, 21:28:42] - 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - AcroIEHlprObj Class
[12/01/2005, 21:28:42] - 2: {2DEA8791-C2B7-48E1-8992-8E8E6A6FE789} - Drop Spam Toolbar
[12/01/2005, 21:28:42] - 3: {4D25F921-B9FE-4682-BF72-8AB8210D6D75} -
[12/01/2005, 21:28:42] - WARNING: 3: {4D25F921-B9FE-4682-BF72-8AB8210D6D75} - BHO Name is blank.
[12/01/2005, 21:28:42] - Checking for WinLogon Notify reference. (File: C:\Program Files\MyWaySA\SrchAsDe\deSrcAs.dll)
[12/01/2005, 21:28:42] - Couldn't find deSrcAs in Winlogon Notify. Ignoring {4D25F921-B9FE-4682-BF72-8AB8210D6D75}.
[12/01/2005, 21:28:42] - 4: {5CA3D70E-1895-11CF-8E15-001234567890} - DriveLetterAccess
[12/01/2005, 21:28:42] - 5: {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - CNisExtBho Class
[12/01/2005, 21:28:42] - 6: {BDF3E430-B101-42AD-A544-FADC6B084872} - CNavExtBho Class
[12/01/2005, 21:28:42] - Finished searching for [MSEvents Object]
[12/01/2005, 21:28:42] - Finishing up...
[12/01/2005, 21:28:42] - Enabling Automatic Reboot on STOP Error.
[12/01/2005, 21:28:42] - Attempting to Restart via STOP error (Blue Screen!)[12/01/2005, 21:31:46] - Starting Process...
[12/01/2005, 21:31:46] - Looking for Browser Helper Object [MSEvents Object]
[12/01/2005, 21:31:46] - 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - AcroIEHlprObj Class
[12/01/2005, 21:31:46] - 2: {2DEA8791-C2B7-48E1-8992-8E8E6A6FE789} - Drop Spam Toolbar
[12/01/2005, 21:31:46] - 3: {4D25F921-B9FE-4682-BF72-8AB8210D6D75} -
[12/01/2005, 21:31:46] - WARNING: 3: {4D25F921-B9FE-4682-BF72-8AB8210D6D75} - BHO Name is blank.
[12/01/2005, 21:31:46] - Checking for WinLogon Notify reference. (File: C:\Program Files\MyWaySA\SrchAsDe\deSrcAs.dll)
[12/01/2005, 21:31:46] - Couldn't find deSrcAs in Winlogon Notify. Ignoring {4D25F921-B9FE-4682-BF72-8AB8210D6D75}.
[12/01/2005, 21:31:46] - 4: {5CA3D70E-1895-11CF-8E15-001234567890} - DriveLetterAccess
[12/01/2005, 21:31:46] - 5: {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - CNisExtBho Class
[12/01/2005, 21:31:46] - 6: {BDF3E430-B101-42AD-A544-FADC6B084872} - CNavExtBho Class
[12/01/2005, 21:31:46] - Finished searching for [MSEvents Object]
[12/01/2005, 21:31:46] - Nothing found! Exiting.
am i ok now? - the VBG log did not give us enough information in your case. is norton still detecting trojan vundo?--- or has that stopped??if the warning has stopped, that's certainly a strong sign that the fix worked... but if you're still getting the warning, the fix has failed...either way, in order to say more with any certainty (one way or the other) , we need to see your HiJackThis log;Download the latest version of HJT(hijackthis) (version 1.99.1) from
http://majorgeeks.com/download3155.html
you must create a separate folder and place it there.... people commonly use C:\HJT. Note: Please do *NOT* use a TEMP (temporary) folder, *NOR* your DESKTOP, as HJT will be generating log files and backup files in the folder from which it is run... you risk accidentally losing these if you use a TEMP folder, and you will generate extreme clutter if you use your DESKTOP.
The file above comes as a compressed .ZIP file... you have to UNzip it (hopefully, you have an UNzip utility built into your Windows Explorer. If for any reason, you're unable to UNzip it, you can download the already-unzipped .EXE file from http://downloads.malwareremoval.com/HijackThis.exe )
After Unzipping, double click on HiJackThis.EXE
Click on Do a System Scan and Save a LogFile
This will automatically open NotePad
Copy the entire file from NotePad: EDIT/SelectAll, EDIT/Copy
Then go to the new forum dedicated for HiJack This logs (**NOT** back here), and PASTE the results there:
http://forums.us.dell.com/supportforums/board?board.id=si_hijack
Be sure to include a detailed description of any problems/errors/warnings you are encountering.
Hopefully, one of the HJT experts will get to it as quickly as possible.
====================================================
WARNING: HiJack This is a VERY POWERFUL tool. Do *NOT* do anything else (in particular, do NOT use it to delete any entries) until you are advised to do so!! Improper use of this tool can severely damage your system.Supplemental note: The procedure as worded above has been carefully edited over time, so as to expedite the process of helping people. Nevertheless, it seems that many individuals try to be "creative", and make some variations. It really would be to your benefit if you follow these directions EXACTLY as stated... because certain changes on your part can result in slowing-down the help process.Specifically, the following are 3 very common BAD deviations which will cause delays:a) BAD: using an older/outdated version of HiJackThis...The experts only work with the current version. So if you make a post with an older version, you'll simply be advised to get the latest version, re-run it, and re-post your log.b) BAD: using a TEMP directory or your DESKTOP for HJT....Some experts may insist you move HJT before they'll begin working with you. Others will start the repair process, advising you to move HJT as one of the very first steps. Failure to do so can result in losing potentially critical information. So please, just use the suggested C:\HJT directory, rather than try to be creative.c) BAD: posting your log in the wrong forum...if you post your log back here, in the Virus/SpyWare forum, it will "sit idly", either until the forum moderator gets around to move it for you... or until you decide to repost your log... in the HiJackThis forum.POST SCRIPT: It has come to my attention that many people are unfamiliar with how to create the recommended sub-directory/folder C:\HJT ;
while others are able to create this directory, but are unsure how to move HJT into it (from wherever it happened to get downloaded into, "by default")...If you have either of these "problems", then you should d ownload a self-extracting copy of HijackThis fromSave it to your Desktop.Double-click on the file hijackthis_sfx.exe file, and it will self-extract into its own folder,C:\Program Files\HijackThis - vundo can infect your computer, regardless of which antivirus (Norton, McAfee, or otherwise) that you're using.WinFixer is a more general problem than just vundo (although they are often closely related). if you've "cured" your vundo, but still have a winfixer problem, you'll need to follow the directions above to post your hiJackthis log in the HJT forum
- Hello all. First time posting. We have been having trouble with this vundo thing too. We got the fix from nortons to work last week, but still had the winfixer add pop up, and now our computer is infected again. We are going to try the fix noted here, but we had a questions. Does anyone with McAffees have this problem?Thanks
dnee
3 Posts
402
0
Posted December 2nd, 2005 00:00