This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Malware.Trace Trojan.Vundo Tried several solutions non

29 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

TMPLGE,

Almost done. We have a couple steps to clean up.

Please open Notepad (this will replace the fix.reg you already have)

  • Click Start , then Run
  • Type notepad.exe in the Run Box.
    Copy and Paste everything from the Quote box into Notepad:

    REGEDIT4

    [HKEY_LOCAL_MACHINE\SOFTWARE\SUPERAntiSpyware.com\SUPERAntiSpyware\InUseRegistry\RegItem0]
    "SubKey"=-

    [HKEY_LOCAL_MACHINE\SOFTWARE\SUPERAntiSpyware.com\SUPERAntiSpyware\InUseRegistry\RegItem1]
    "SubKey"=-

    [HKEY_LOCAL_MACHINE\SOFTWARE\SUPERAntiSpyware.com\SUPERAntiSpyware\InUseRegistry\RegItem2]
    "SubKey"=-

    [HKEY_LOCAL_MACHINE\SOFTWARE\SUPERAntiSpyware.com\SUPERAntiSpyware\InUseRegistry\RegItem3]
    "SubKey"=-

    [HKEY_LOCAL_MACHINE\SOFTWARE\SUPERAntiSpyware.com\SUPERAntiSpyware\InUseRegistry\RegItem4]
    "SubKey"=-

    [HKEY_LOCAL_MACHINE\SOFTWARE\SUPERAntiSpyware.com\SUPERAntiSpyware\InUseRegistry\RegItem5]
    "SubKey"=-

    [HKEY_LOCAL_MACHINE\SOFTWARE\SUPERAntiSpyware.com\SUPERAntiSpyware\InUseRegistry\RegItem6]
    "SubKey"=-

    [HKEY_LOCAL_MACHINE\SOFTWARE\SUPERAntiSpyware.com\SUPERAntiSpyware\InUseRegistry\RegItem7]
    "SubKey"=-


    Make sure there are NO blank lines before REGEDIT4
    Make sure there IS one blank line at the end of the file.

    Go to File > Save As
    Save File name as Fix.reg
    Change Save as Type to All Files and save the file to your desktop.

    Close Notepad, and double-click Fix.reg on your Desktop. When it asks if you want to merge the info to the registry, hit YES/OK. Reboot the computer.

With that done, Log looks good :D


Time for some housekeeping
  • Click START then RUN
  • Now type Combofix /u in the runbox and click OK
  • Note the space between the X and the U, it needs to be there.
  • [external image: Posted Image]
The above procedure will:
  • Implement some cleanup procedures.
  • Reset System Restore.


  • Double click on OTMoveIt3.exe to run it.
  • Click on CleanUp!
  • When done, you will be prompted to restart your computer. Please restart your computer.

Please re-enable any security that was disabled.
Please delete any of these tools we used if they still exist:
Rooter
Gmer
Registry Search
Erunt
Fix.reg
MyFile.txt

Keep ATF and Malwarebytes'. Run them every month or so.

You expressed an interest in replacing your Anti-Virus. This link: Preventing Malware - Tools and Practices for Safe Computing will provide you with links to free AV's and firewalls along with some other information and reccomendations.

Please respond back that you understand the above and let me know if you have any questions. Otherwise, this thread will be closed Resolved. :thumbup:
I ran notepad.exe, then Combo but this did nothing becuase Combo no longer exists on my desktop. I ran OTMove Cleanup and was prompted to restart my system. On the restart Windows asked for a User and pass word? Which ive never had. When I alicked Shut down I get a blue screen that says STOP: c000021a {Fatal System Error} The Session Manager Initialization system process terminated unexpectedly with a status of 0xc0000022 (0x00000000 0x00000000). The system has been shut down. Any chance this is reparable?
TMPLGE,

Sorry. I forgot that we already removed ComboFix.

Restart your computer.
When the machine first starts again it will generally list some equipment that is installed in your machine,
amount of memory, hard drives installed etc (BOOT SCREEEN).
At this point you should gently tap the F8 key repeatedly until you are presented with a Options menu.
Select the option for Last Known Good Configuration using the arrow keys.
Then press enter on your keyboard to boot.

Let me know if it starts OK
TMPLGE, My thought is a repair install. The Tech Team may have more helpful ideas. See if you can borrow the correct CD (XP Home SP3 if possible). I don't think you'll find SP3 but hopefully you can find SP2.
TMPLGE, Sorry about the overlapping post. I hope you don't have to reformat. That will erase everything. A repair install will just overwrite your OS. Give me a little time to get advice from the Tech Team to see if they have a better way.
Update: I have DL SuperAntispyware, CCleaner, ATF, ZoneAlarm firewall, MBA, Avast Anitvirus onto a flash drive incase i need to reformat. Is there anything else I shold have? Most of my files are kept on a backup CD so i still have the most importrant things. I shold be able to DL drivers from the websites correct? If there is anywhere I can get directions for this it would be good. My only worry would be getting online.
TMPLGE,

When you start your computer, does it bring up a screen that asks you to select the operating system to start:
Recovery Console or Windows XP?

If it does, select recovery console.

If it does not, restart and tap F8 like you are going to enter safe mode but instead choose Return to OS Choices Menu
Then select recovery console.

You will have to type 1 to select windows

When you get to the command prompt:

  • Enter cd \Windows\ERDNT\Autobackup
  • enter dir to see what registry backups are available. They will be in mm-dd-yyyyy format.
  • Pick one before the c0000021a occured and enter cd xx-xx-xxxx(cd 1-7-2009 for instance) to change to that directory.
  • Type erdnt to restore the registry to that date and time.

Try to restart.
Let me know how you did.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI