[Resolved] Vundo Won't remove

Hi! Welcome to the WTT forums.
My name is Scotty. I would be glad to take a look at your log and help you with solving any malware problems. HijackThis logs can take a while to research.
Please be patient.

Please make a uninstall list using HijackThis
To access the Uninstall Manager you would do the following:

1. Start HijackThis
2. Click on the Config button
3. Click on the Misc Tools button
4. Click on the Open Uninstall Manager button.
5. Click on the Save list… button and specify where you would like to save this file. When you press Save button a notepad will open with the contents of that file. Simply copy and paste the contents of that notepad here in a reply.

Thanks for your help Scotty. I followed your instructions. When I click on "save list" hijackthis closes. So I couldn't finish with being able to copy and paste to notepad. I'll wait for you to review the HJT log before I do anything else. A Davis

Hi

Download and Save ComboFix

• Download this file from below:
  
  Here
  
• Save it to your Desktop.
• Disconnect from the Internet, than disable your anti-virus and any real-time anti-spyware monitors that are running.
• Click Start>Run copy/paste or type "%userprofile%\desktop\combofix.exe" /killall into the Run box and click OK.
• When finished, it shall produce a log for you. Post that log in your next reply with a new HijackThis log.

Note 1: Do not mouseclick combofix's window whilst it's running. That may cause it to stall
Note 2:Remember to re-enable your anti-virus and anti-spyware before reconnecting to the Internet.

Combofix should never take more that 20 minutes including the reboot if malware is detected.
If it does, open Task-Manager use the Processes tab (press ctrl alt and del at the same time) and end any processes of findstr, find, sed or swreg, then combofix should continue.
If that happened we want to know, and also what process you had to end.

In your next reply post:
ComboFix.txt
New HijackThis log taken after the above scan has run

Hi


Remember to disconnect from the Internet and disable your anti-virus before carrying out the next instruction, and to reenable the anti-virus before reconnecting to the Internet


Open Notepad - it must be Notepad, not Wordpad.
Copy the text below in the code box by highlighting all the text with your mouse and pressing Ctrl+C

File::
C:\WINDOWS\SYSTEM32\uonnsrbm.dll
C:\WINDOWS\SYSTEM32\cvcjnxat.dll
C:\WINDOWS\SYSTEM32\vsljwbee.ini
C:\WINDOWS\SYSTEM32\rgfotmkr.dll
C:\WINDOWS\SYSTEM32\hwwfihhl.ini
C:\WINDOWS\SYSTEM32\nabyhhge.ini 
C:\WINDOWS\SYSTEM32\ocyshetp.dll
C:\WINDOWS\SYSTEM32\gcfqopvy.dll
C:\WINDOWS\SYSTEM32\wnnsfjeh.dll
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\MyWebSearch Email Plugin.lnk

Folder::
C:\VundoFix Backups

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{95f23bd4-3774-4dd9-b818-7469a10e5016}]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\f86f5048]

Go to the Notepad window and click Edit > Paste
Then click File > Save
Name the file "CFScript.txt" (including the quotes)
Save the file to your Desktop

[external image: Posted Image]


Refering to the picture above, drag CFScript into ComboFix.exe

Combofix should never take more that 20 minutes including the reboot if malware is detected.
If it does, open Task-Manager use the Processes tab (press ctrl alt and del at the same time) and end any processes of findstr, find, sed or swreg, then combofix should continue.
If that happened we want to know, and also what process you had to end.

In your next reply post:
ComboFix.txt
New HJT log taken after the above scan has run

Hi You posted the wrong Combofix.txt. That was the first one you posted. Look for C:\Combofix(2).txt

Hi

Almost there.

• Please go HERE to run PandaActiveScan…
  
  
• Once you are on the Panda site click the Scan your PC button
  
• A new window will open…click the Check Now button
  
• Enter your Country
  
• Enter your State/Province
  
• Enter your e-mail address and click send
  
• Select either Home User or Company
  
• Click the big Scan Now button
  
• If it wants to install an ActiveX component allow it
  
• It will start downloading the files it requires for the scan (Note: It may take a couple of minutes)
  
  
• When download is complete, click on My Computer to start the scan
  
• When the scan completes, if anything malicious is detected, click the See Report button, then Save Report and save it to your desktop.Then post it in your next reply.

Took a little while to get it to complete. I had to run it a second time due to user(me) errors. The report is posted below. Incident Status Location Potentially unwanted tool:application/funweb Not disinfected c:\windows\downloaded program files\f3initialsetup1.0.0.15-3.inf Spyware:spyware/betterinet Not disinfected c:\windows\inf\banner.inf Potentially unwanted tool:application/mywebsearch Not disinfected hkey_local_machine\software\microsoft\windows\currentversion\uninstall\MyWebSearch bar Uninstall Spyware:Cookie/Adrevolver Not disinfected C:\Documents and Settings\slangfitt\Cookies\slangfitt@adrevolver[1].txt Spyware:Cookie/PointRoll Not disinfected C:\Documents and Settings\slangfitt\Cookies\[removed][1].txt Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\slangfitt\Cookies\slangfitt@advertising[2].txt Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\slangfitt\Cookies\slangfitt@atdmt[2].txt Spyware:Cookie/Atwola Not disinfected C:\Documents and Settings\slangfitt\Cookies\slangfitt@atwola[1].txt Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\slangfitt\Cookies\slangfitt@doubleclick[1].txt Spyware:Cookie/Enhance Not disinfected C:\Documents and Settings\slangfitt\Cookies\slangfitt@enhance[1].txt Spyware:Cookie/FastClick Not disinfected C:\Documents and Settings\slangfitt\Cookies\slangfitt@fastclick[2].txt Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\slangfitt\Cookies\slangfitt@realmedia[1].txt Spyware:Cookie/Tradedoubler Not disinfected C:\Documents and Settings\slangfitt\Cookies\slangfitt@tradedoubler[1].txt Spyware:Cookie/Tradedoubler Not disinfected C:\Documents and Settings\slangfitt\Cookies\slangfitt@tradedoubler[2].txt Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\slangfitt\Cookies\slangfitt@tribalfusion[2].txt Potentially unwanted tool:Application/NirCmd.A Not disinfected C:\Documents and Settings\slangfitt\Desktop\ComboFix.exe[nircmd.exe] Potentially unwanted tool:Application/NirCmd.A Not disinfected C:\Documents and Settings\slangfitt\Desktop\ComboFix.exe[nircmd.cfexe] Potentially unwanted tool:Application/FunWeb Not disinfected C:\qoobox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\F3HTMLMU.DLL.vir Potentially unwanted tool:Application/MyWebSearch Not disinfected C:\qoobox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\M3HTML.DLL.vir Potentially unwanted tool:Application/MyWebSearch Not disinfected C:\qoobox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL.vir Potentially unwanted tool:Application/MyWebSearch Not disinfected C:\qoobox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE.vir Potentially unwanted tool:Application/MyWebSearch Not disinfected C:\qoobox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\MWSOESTB.DLL.vir Potentially unwanted tool:Application/MyWebSearch Not disinfected C:\qoobox\Quarantine\C\Program Files\MyWebSearch\bar\2.bin\M3MSG.DLL.vir Potentially unwanted tool:Application/MyWebSearch Not disinfected C:\qoobox\Quarantine\C\Program Files\MyWebSearch\bar\2.bin\M3PLUGIN.DLL.vir Potentially unwanted tool:Application/MyWebSearch Not disinfected C:\qoobox\Quarantine\C\Program Files\MyWebSearch\bar\2.bin\M3SLSRCH.EXE.vir Potentially unwanted tool:Application/MyWebSearch Not disinfected C:\qoobox\Quarantine\C\Program Files\MyWebSearch\bar\2.bin\M3SRCHMN.EXE.vir Potentially unwanted tool:Application/MyWebSearch Not disinfected C:\qoobox\Quarantine\C\Program Files\MyWebSearch\bar\2.bin\MWSBAR.DLL.vir Potentially unwanted tool:Application/MyWebSearch Not disinfected C:\qoobox\Quarantine\C\Program Files\MyWebSearch\bar\2.bin\NPMYWEBS.DLL.vir Potentially unwanted tool:Application/MyWebSearch Not disinfected C:\qoobox\Quarantine\C\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL.vir Spyware:Spyware/Vundo Not disinfected C:\qoobox\Quarantine\C\WINDOWS\SYSTEM32\agvtmlfm.dll.vir Spyware:Spyware/Vundo Not disinfected C:\qoobox\Quarantine\C\WINDOWS\SYSTEM32\efydpxvy.dll.vir Spyware:Spyware/Vundo Not disinfected C:\qoobox\Quarantine\C\WINDOWS\SYSTEM32\exaceoiu.dll.vir Spyware:Spyware/Vundo Not disinfected C:\qoobox\Quarantine\C\WINDOWS\SYSTEM32\fjbtuvjm.dll.vir Spyware:Spyware/Vundo Not disinfected C:\qoobox\Quarantine\C\WINDOWS\SYSTEM32\gcfqopvy.dll.vir Spyware:Spyware/Vundo Not disinfected C:\qoobox\Quarantine\C\WINDOWS\SYSTEM32\hbbotywe.dll.vir Spyware:Spyware/Vundo Not disinfected C:\qoobox\Quarantine\C\WINDOWS\SYSTEM32\ocyshetp.dll.vir Spyware:Spyware/Vundo Not disinfected C:\qoobox\Quarantine\C\WINDOWS\SYSTEM32\pwawmgyv.dll.vir Spyware:Spyware/Vundo Not disinfected C:\qoobox\Quarantine\C\WINDOWS\SYSTEM32\ruptmjlv.dll.vir Spyware:Spyware/Vundo Not disinfected C:\qoobox\Quarantine\C\WINDOWS\SYSTEM32\tddaqunl.dll.vir Spyware:Spyware/Vundo Not disinfected C:\qoobox\Quarantine\C\WINDOWS\SYSTEM32\tsmjmwdo.dll.vir Spyware:Spyware/Vundo Not disinfected C:\qoobox\Quarantine\C\WINDOWS\SYSTEM32\ubexavff.dll.vir Spyware:Spyware/Vundo Not disinfected C:\qoobox\Quarantine\C\WINDOWS\SYSTEM32\upvsiglk.dll.vir Spyware:Spyware/Vundo Not disinfected C:\qoobox\Quarantine\C\WINDOWS\SYSTEM32\wnnsfjeh.dll.vir Spyware:Spyware/Vundo Not disinfected C:\qoobox\Quarantine\C\WINDOWS\SYSTEM32\xuolxatx.dll.vir Spyware:Spyware/BetterInet Not disinfected C:\WINDOWS\banner.dll Virus:Generic Malware Disinfected C:\WINDOWS\Downloaded Program Files\CONFLICT.1\HbInstIE.dll Potentially unwanted tool:Application/NirCmd.A Not disinfected C:\WINDOWS\NirCmd.exe Spyware:Spyware/Vundo Not disinfected C:\WINDOWS\SYSTEM32\bmiewdpo.dll Spyware:Spyware/Vundo Not disinfected C:\WINDOWS\SYSTEM32\fxcittgx.dll Spyware:Spyware/Vundo Not disinfected C:\WINDOWS\SYSTEM32\icrbqcfb.dll Spyware:Spyware/Vundo Not disinfected C:\WINDOWS\SYSTEM32\uxxbacrc.dll

Hi


Remember to disconnect from the Internet and disable your anti-virus before carrying out the next instruction, and to reenable the anti-virus before reconnecting to the Internet


Open Notepad - it must be Notepad, not Wordpad.
Copy the text below in the code box by highlighting all the text with your mouse and pressing Ctrl+C

File::
C:\WINDOWS\SYSTEM32\bmiewdpo.dll  
C:\WINDOWS\SYSTEM32\fxcittgx.dll
C:\WINDOWS\SYSTEM32\icrbqcfb.dll 
C:\WINDOWS\SYSTEM32\uxxbacrc.dll
C:\WINDOWS\Downloaded Program Files\CONFLICT.1\HbInstIE.dll 
c:\windows\downloaded program files\f3initialsetup1.0.0.15-3.inf
C:\WINDOWS\banner.dll 
c:\windows\inf\banner.inf

Go to the Notepad window and click Edit > Paste
Then click File > Save
Name the file "CFScript.txt" (including the quotes)
Save the file to your Desktop

[external image: Posted Image]


Refering to the picture above, drag CFScript into ComboFix.exe

Combofix should never take more that 20 minutes including the reboot if malware is detected.
If it does, open Task-Manager use the Processes tab (press ctrl alt and del at the same time) and end any processes of findstr, find, sed or swreg, then combofix should continue.
If that happened we want to know, and also what process you had to end.

In your next reply post:
ComboFix.txt
New HJT log taken after the above scan has run

You may wish to keep hold of the Panda Online Scan as an extra on-demand virus-scanner.
If not you can uninstall it through Start>Control Panel>Add/Remove Programs