jgb
Topic Starter
I've had this pernicious Trojan for a few days now, and PC-Cillin stood idly by. Then I tried a self help. I traced it to a file(s) in C:\windows\system32 and discovered a pile of files with very strange names. Mostly .DLL, INI and a few EXE. I found them by sorting Windows Explorer dir list by CREATION DATE, and found they were all created at the times I booted my PC over the last week or so. Not sure yet if they were needed I tried renaming them with an "xx" prefix. Only those that were started just now I could not rename, move or delete as they were in use, by something.
However, when I rebooted my PC VUNDO got mad and started to fight with PCC, restarting itself and being killed every 2 seconds. I tried TM Chat, but really got nowhere. I was told to run HIJACKTHIS and send them the log, which I did, and was told they would get back to me, "real soon now". 2 hours later, nada. So HIJACK led me to this site, and from the HIJACKTHIS log I noted that the name VUNDO appeared many times as a "possible" TJ, and found VUNDOFIX.
I ran it and after the scan and 2 reboots I think I am clean.
Now the tip…. Instead of perusing the Log, go and check Windows/system32 and sort by CREATION DATE. If a list of strange files appear, with recent dates, such as (I found) EFCCCYA.DLL PPQSS.INI SSTTU.DLL SSQPP.DLL QQTWA.INI ZUYIX etc then you have VUNDO Notice the names mostly follow a trait of double letters.
This will take you 2 minutes at most to find. Then run VUNDOFIX as instructed, and VUNDO should be gone. It will probably boot twice. After the first boot, VUNDOFIX will come up and say it can't remove a file. OK the reboot. It will do a Windows bootup file deletion before the nasty can come alive.
HIJACKTHIS is supposed to do this too, in tools, but it crashes each time I try.
JGB
We appreciate that you wish to help others, but only Qualified and Authorised personnel are allowed to post advice in this forum. They have to go through a demanding training course first.
This post will be locked and removed.
Gary R
However, when I rebooted my PC VUNDO got mad and started to fight with PCC, restarting itself and being killed every 2 seconds. I tried TM Chat, but really got nowhere. I was told to run HIJACKTHIS and send them the log, which I did, and was told they would get back to me, "real soon now". 2 hours later, nada. So HIJACK led me to this site, and from the HIJACKTHIS log I noted that the name VUNDO appeared many times as a "possible" TJ, and found VUNDOFIX.
I ran it and after the scan and 2 reboots I think I am clean.
Now the tip…. Instead of perusing the Log, go and check Windows/system32 and sort by CREATION DATE. If a list of strange files appear, with recent dates, such as (I found) EFCCCYA.DLL PPQSS.INI SSTTU.DLL SSQPP.DLL QQTWA.INI ZUYIX etc then you have VUNDO Notice the names mostly follow a trait of double letters.
This will take you 2 minutes at most to find. Then run VUNDOFIX as instructed, and VUNDO should be gone. It will probably boot twice. After the first boot, VUNDOFIX will come up and say it can't remove a file. OK the reboot. It will do a Windows bootup file deletion before the nasty can come alive.
HIJACKTHIS is supposed to do this too, in tools, but it crashes each time I try.
JGB
We appreciate that you wish to help others, but only Qualified and Authorised personnel are allowed to post advice in this forum. They have to go through a demanding training course first.
This post will be locked and removed.
Gary R