Random popup virus
Hi, I have been getting popups (in both firefox and ie7, it sort of alternates between them) randomly, even when the browser is not open. It has been going on for the past few days. I ran norton 2007 w/ latest virus updates, and ad-aware and it said it removed everything, but it is still happening. Norton said it removed a Trojan.Vundo and Infostealer. But it is still happening. Please help! Thanks
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
More vundo info
http://www.bleepingcomputer.com/forums/topic18610.html
Make sure you have fully removed infostealer as well
http://www.symantec.com/security_response/writeup.jsp?docid=2000-122016-0558-99&tabid=3
I think Vundo is more likely your problem though
http://www.bleepingcomputer.com/forums/topic18610.html
Make sure you have fully removed infostealer as well
http://www.symantec.com/security_response/writeup.jsp?docid=2000-122016-0558-99&tabid=3
I think Vundo is more likely your problem though
Have you run Vundofix yet?
If Vundofix or Virtumondobegone doesn't fix it, then we need to see a hijackthis log, most likely that there are other nasties there.
1. Please download VundoFix.exe to your desktop.
http://www.atribune.org/ccount/click.php?id=4
* Double-click VundoFix.exe to run it.
* Click the "Scan for Vundo" button.
* Once it's done scanning, click the "Remove Vundo" button.
* You will receive a prompt asking if you want to remove the files, click YES
* Once you click yes, your desktop will go blank as it starts removing Vundo.
* When completed, it will prompt that it will reboot your computer, click OK.
* Please post the contents of C:\vundofix.txt.
Note: It is possible that VundoFix encounters a file it could not remove.
In this case, VundoFix will run on reboot, simply follow the above
instructions starting from "Click the Scan for Vundo button." when
VundoFix appears at reboot.
2. If vundofix doesn't find any files, run this alternative.
Download VirtumundoBegone from here:
http://secured2k.home.comcast.net/tools/VirtumundoBeGone.exe
and save it to your desktop. When you have done this doubleclick on VirtumundoBeGone.exe and follow the instructions. When it has finished, reboot. If you like, post the log that is created on your desktop called VBG.TXT in your next reply. Do not worry if you see a BLUE SCREEN "Fatal Error" Message, it is normal and expected.
If Vundofix or Virtumondobegone doesn't fix it, then we need to see a hijackthis log, most likely that there are other nasties there.
1. Please download VundoFix.exe to your desktop.
http://www.atribune.org/ccount/click.php?id=4
* Double-click VundoFix.exe to run it.
* Click the "Scan for Vundo" button.
* Once it's done scanning, click the "Remove Vundo" button.
* You will receive a prompt asking if you want to remove the files, click YES
* Once you click yes, your desktop will go blank as it starts removing Vundo.
* When completed, it will prompt that it will reboot your computer, click OK.
* Please post the contents of C:\vundofix.txt.
Note: It is possible that VundoFix encounters a file it could not remove.
In this case, VundoFix will run on reboot, simply follow the above
instructions starting from "Click the Scan for Vundo button." when
VundoFix appears at reboot.
2. If vundofix doesn't find any files, run this alternative.
Download VirtumundoBegone from here:
http://secured2k.home.comcast.net/tools/VirtumundoBeGone.exe
and save it to your desktop. When you have done this doubleclick on VirtumundoBeGone.exe and follow the instructions. When it has finished, reboot. If you like, post the log that is created on your desktop called VBG.TXT in your next reply. Do not worry if you see a BLUE SCREEN "Fatal Error" Message, it is normal and expected.
Well since it's a spyware problem you might want to try
http://www.hitmanpro.nl/hitmanpro/index.php?option=com_content&task=view&id=3&Itemid=9&lang=en
this program. It's an all-in-one program that automatically downloads, installs and updates several different spyware and adware scanners. Just run it and watch it control you're PC and remove (almost) all spy- and adware. Unlike virus scanners you can have several ad- and spyware scanners installed.
Best of luck
http://www.hitmanpro.nl/hitmanpro/index.php?option=com_content&task=view&id=3&Itemid=9&lang=en
this program. It's an all-in-one program that automatically downloads, installs and updates several different spyware and adware scanners. Just run it and watch it control you're PC and remove (almost) all spy- and adware. Unlike virus scanners you can have several ad- and spyware scanners installed.
Best of luck
ASKER
Hey - Thanks for all the responses! and sorry it took so long for me to get back to you!
RedKelvin - I tried your first link and used the norton tool to scan for the virus, but it didnt find anything. Then i tried SudburyComputer's first link and downloaded FixVondo and it found around 7 files and removed them. i think it worked - but i'm going to wait a day and see if i get any more popups (like i said they occur at random times, and ive only been using the comptuer for around 5 min since i restarted after FixVondo)
Thanks again for all the comments! I'll let you guys know the results.
-Kyle
RedKelvin - I tried your first link and used the norton tool to scan for the virus, but it didnt find anything. Then i tried SudburyComputer's first link and downloaded FixVondo and it found around 7 files and removed them. i think it worked - but i'm going to wait a day and see if i get any more popups (like i said they occur at random times, and ive only been using the comptuer for around 5 min since i restarted after FixVondo)
Thanks again for all the comments! I'll let you guys know the results.
-Kyle
ASKER
Hey! I havent had a pop up for the past few days!!! THANKS SO MUCH!!! I was literally starting to write down programs that i would have to reinstall after i did a format because this was so annoying. thanks to everyone that helped out!
-Kyle
-Kyle
http://www.symantec.com/security_response/writeup.jsp?docid=2004-112111-3912-99&tabid=3