[Resolved] Suspect Vundo.JD Virus Attack

Given that your issues seem to be internet access based, and a firewall restricts this access, i'm wondering if ZA is in some way the root cause of this. It may not be but, as I can't find any traces of anything that looks malicious and none of the scanners can either, i'm running out of suggestions. Just because nothing is showing doesn't mean it isn't there, or that it is - sadly it's impossible to know if it just can't be found or it isn't there in the first place.
If it isn't your firewall that is at fault, then either you have malware that cannot be identified, or something has been corrupted, possibly as a result of the infection you had. In both cases this will probably be best solved by a reformat and reinstall as things stand as I don't see an easy way to identify the problem files and either delete them or replace them depending on the exact issue.

So we'll start with a new firewall and see where that gets us. There are a number free firewalls available, of which the following are a few:

Comodo Firewall Pro, available here. This download has both a firewall and anti-virus in the same package, so be sure that you uncheck the AV option if you choose to install this one. There may be a toolbar on offer as well, so you can chose whether you want this or not.
PC Tools Firewall Plus, available here.
Online Armor Free, available here.

I've used all three and prefer Comodo, but that isn't based on any great study, it's just the one that I got on with. Take your pick or try all three, but don't forget that it's only one to be installed at a time to avoid conflictions.

Let me know which one you have chosen and whether it solves your problems or not.

I believe I have solved the problem with IE and Outlook connecting to the Internet. What I believe occured is that one of us (myself, my wife or my daughter) inadvertantly selected to block a program/process with Zone Alarm when it prompted. I think I have the problem fixed with Zone Alarm but went ahead and disabled Zone Alarm and installed Comodo on your recommendation. It seems to be working fine but I have only been running with it so far for a few hours tonight. One thing that I notice is that it shows the direction of activity (in/out) whereas Zone Alarm only indicated activity. It also seems to have more viewing capabilities for what application/process are active and gives a summary of the traffic by application. There are a couple things about Comodo that I didn't see how to accomplish: 1. Where can you view a list of the applications that have been logged as trusted or blocked? (I see a trusted software vendors but not a trusted applications. I don't see blocked software vendors nor blocked applications either.) 2. I had a couple of items pop up requesting to be allowed/blocked. As I was checking some of the program options and help they disappeared. It appears that they timed out. When that occurs are they allowed or blocked and how would I change what it defaulted to? 3. How can Comodo be disabled and configured not to start on boot that would allow me to go back to Zone Alarm in case I block something that I can't unblock? I'd feel more comfortable continuing with Comodo if I understood how to do those things. I was able to solve the problem with my stock software. When I contacted the data feed vendor they had me perform a repair. It didn't completely fix the problem so they directed my to another repair that was "more thorough" and it fixed the problem…thankfully as I'm not crazy about reformatting and starting over. Although I have all software and have backups of data, etc. it is a time-consuming process.

If you open Comodo and click on Miscellaneous at the top and then Help, you can access the built-in manual which should tell you most of what you want to know. 1 is under Network Security Policy, 2 is Firewall Behaviour Settings.

I wouldn't install a second firewall even if the first was disabled, and some will check for an existing installation when you run the installer, so I suggest if you ever don't want it, that you remove it.

Is this the last of the problems with the machine sorted then?

I will remove one of the firewalls. That was the plan when I disabled Zone to install Comodo. Yes, I believe we have the virus cleaned up. Over the weekend there weren't any cases where IE or Outlook didn't connect to the Internet with Zone Alarm or Comodo Are there any startup processes that aren't needed and is there any software we installed that should be removed?

Your version of Sun Java needs updating:

1) Go here and click on the Windows XP/Vista/2000/2003 Offline link in the Windows section near the top and save it to your Desktop.

2) Download JavaRa from here and save it to your Desktop.
You will need to extract the file(s):
Right click on the zipped folder and from the menu that appears, click on Extract All…
In the 'Extraction Wizard' window that opens, click on Next> and in the next window that appears, click on Next> again.
In the final window, click on Finish

***Please close any instances of Internet Explorer before continuing!***

• Double-click JavaRa.exe to begin.
• Pick your preferred language from the drop-down menu and click Select.
• Click on Remove Older Versions to remove older version of Java - obvious really, isn't it!
• Click Yes when prompted. When JavaRa is done, a notice will appear that a logfile has been produced. Click OK.
• A logfile will pop up. Please save it to a convenient location, just in case you have any problems with Java afterwards.

3) Run the installer that you downloaded earlier.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Your version of Adobe Reader needs updating which you can do through the program itself (Help > Check for Updates…), or you can switch to a different pdf viewer. I use Foxit which I feel is probably more secure, but you are free to take your pick. You can get Foxit here.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Run HijackThis as you did to generate a log, but this time click on 'Do a system scan only'.
Place a checkmark in the boxes to the left of the following entries, by clicking on them:

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

CLOSE ALL OPEN WINDOWS AND BROWSERS - EXCEPT HJT and click on Fix checked

These two entries preload the two apps speeding up access time, so unless you use them every time you boot up, they can be fixed. You will find that the programs then take slightly longer to start when you use them, but it shouldn't be significantly longer, and you can restore the entries using HJT's backup option if you aren't happy.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

I want you to run your PC as normal for a few days and when you are happy that everything is fine, do the following:

Go to Start > Run, enter the following into the textbox and click OK: ComboFix /Uninstall
This will uninstall Combofix and do a little housework besides.

Create a new Restore Point - this will give a clean one should you need it in the future. A tutorial for System Restore is available here.

The reason for waiting is that if removing the malware has caused a problem, which it occasionally does, you can put your PC back to how it was before the fix. This will re-install the malware, but an infected PC is better than an expensive paperweight!

Some bedtime reading: This is a very good tutorial about keeping your computer safe and secure on the internet.

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.