Solved

Virus removal tools for Vundo.gen.d

Posted on 2008-06-17
10
2,954 Views
Last Modified: 2013-12-09
My laptop infected by Vundo.gen.d Trojan virus. I need removal tool for this virus.

I am using windows xp Professional.

0
Comment
Question by:rajasekarramasamy
  • 5
  • 4
10 Comments
 
LVL 47

Accepted Solution

by:
rpggamergirl earned 125 total points
ID: 21800725
What scanners have you tried to remove it?
Combofix is very effective in removing vundo infection.

Please download ComboFix by sUBs:
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

You must download it to and run it from your Desktop
Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.
Double click combofix.exe & follow the prompts.
When finished, it will produce a log. Please save that log and attach it in your next reply along with a fresh HJT log
Re-enable all the programs that were disabled during the running of ComboFix..


Note:
Do not mouse-click combofix's window while it is running. That may cause it to stall.

CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.


This link tells you How to use Combofix as well as installing RC if you haven't yet.
http://www.bleepingcomputer.com/combofix/how-to-use-combofix
0
 

Author Comment

by:rajasekarramasamy
ID: 21801442
Kindly see the attachment for  log file.
hijackthis.log
Combofix-log.txt
0
 
LVL 47

Expert Comment

by:rpggamergirl
ID: 21801824
Thansk for the logs.
Still some bad files leftover.

1. Open Notepad.
2. Now copy/paste the text between the lines below into the Notepad window:
------------------------------------------------------------------------
File::
C:\WINDOWS\system32\bucchcqq.ini
C:\WINDOWS\system32\hhwadqdu.ini
C:\WINDOWS\atfxqogp.dll_old
C:\WINDOWS\ekel.exe
------------------------------------------------------------------------

3. Save the above as CFScript.txt on your desktop.
4. Then drag the CFScript.txt into ComboFix.exe. This will start ComboFix again.


You can fix this redundant entry below in Hijackthis:
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)

You have so many programs starting at bootup which slows down the booting time, you can if you like fix any 04 entries that you don't want to start when pc startup. I basically only have my security programs running at bootup.
0
 

Author Comment

by:rajasekarramasamy
ID: 21810064
Kindly see the attachment for  log file these log files is generated after running CFScript using Combofix.exe.


Combofix-log-after-running-CFScr.txt
hijackthis-log-after-CFScript-ru.txt
0
 
LVL 47

Expert Comment

by:rpggamergirl
ID: 21810472
It doesn't look like those files were deleted, the log should've showed files listed "other Deletions"
Maybe because your antivirus was still enabled during the run, not sure why.

Can you run an online scan with Kaspersky?
Using Internet Explorer, run Kaspersky Online Scanner
http://www.kaspersky.com/virusscanner
   
* Click 'Accept' in the window that pops up.
* You will be prompted to install an ActiveX component from Kaspersky, Click on the information bar and select Install ActiveX Control if so. This may happen more than once. That is OK. You also may get a warning from your Windows Firewall. You can tell it to unblock.
* The program will launch and then start to download the latest definition files.
* Once the scanner is installed and the definitions downloaded, click 'Next'.
* Now click on 'Scan Settings'
* In the scan settings make sure that the following are selected:
          o Scan using the following Anti-Virus database: 'Extended' (If available, otherwise 'Standard')
          o Scan Options: 'Scan Archives' and 'Scan Mail Bases'
* Click 'OK'
* Now under 'Select a target to scan' select 'My Computer'
* The scan will take a while, so be patient and let it run. Once the scan is complete, it will display whether your system has been infected.
* Now click on the 'Save Report As...' button:
* Make sure it says Save as a text file - change it if not
* Save the file to your desktop.
0
Is Your Active Directory as Secure as You Think?

More than 75% of all records are compromised because of the loss or theft of a privileged credential. Experts have been exploring Active Directory infrastructure to identify key threats and establish best practices for keeping data safe. Attend this month’s webinar to learn more.

 

Author Comment

by:rajasekarramasamy
ID: 21810559
I am using Macfee 8.5 Now it showing that my laptop inf infected by this virus "EICAR test file" there is any tool to remove this virus completely.
0
 
LVL 23

Expert Comment

by:Mohammed Hamada
ID: 21813274
I believe this virus/malware or so called (Test File) was downloaded from this website

http://www.eicar.org/anti_virus_test_file.htm

Additional notes:
(1) This file used to be named ducklin.htm or ducklin-html.htm or similar based on its original author Paul Ducklin and was made in cooperation with CARO.
(2) The definition of the file has been refined 1 May 2003 by Eddy Willems in cooperation with all vendors.
(3) The content of this documentation (title-only) was adapted 1 September 2006 to add verification of the activity of anti-malware or anti-spyware products. It was decided not to change the file itself for backward-compatibility reasons.

The file has a highly encrypted data and can't be removed on normal mode.. Only Dos mode can do it,,, You can either boot to recovery console and then goto Dos prompt or try to do when you restart your windows and then by holding the key F8 many times u will have access to dos mode.

You can manually delete the files, You have some other choices which is delete the files by using a bootable CD like Hiren or Ultimate boot CD ...
Knoppix too does work...

0
 
LVL 47

Expert Comment

by:rpggamergirl
ID: 21835960
A lot of antivirus detect "EICAR_test_file" as a virus but it's not viral, it's a harmless file.
http://www.viruslist.com/en/viruses/encyclopedia?virusid=55843

"EICAR test file" also explained here.
http://en.wikipedia.org/wiki/EICAR_test_file


I assume evrything's okay now as the question has been closed?
If so, please uninstall combofix.
Go to Start > Run and copy and paste next command in the field:

ComboFix /u


Thanks!

0
 

Author Comment

by:rajasekarramasamy
ID: 21844385
Hi rpggamergirl,

I uninstalled the Combofix from my system.

Thanks.
0
 
LVL 47

Expert Comment

by:rpggamergirl
ID: 21844471
rajasekarramasamy,

You're welcome.

Thank you.
0

Featured Post

Is Your Active Directory as Secure as You Think?

More than 75% of all records are compromised because of the loss or theft of a privileged credential. Experts have been exploring Active Directory infrastructure to identify key threats and establish best practices for keeping data safe. Attend this month’s webinar to learn more.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

UPDATE - 6/15/2011 Added support for Release Update 6 Maintenance Patch 2 Point Patch 1 (RU6 MP2 PP1). Fixed a defect in the username field that was hard-coded to look for a specific domain (left over code from testing). This release will be the …
The purpose of this Article is to provide information for a newly released variant of malware – with the assumption that many EE Members will have need of the information. According to “Computerworld”, well over one million web sites have been co…
Internet Business Fax to Email Made Easy - With eFax Corporate (http://www.enterprise.efax.com), you'll receive a dedicated online fax number, which is used the same way as a typical analog fax number. You'll receive secure faxes in your email, fr…
As a trusted technology advisor to your customers you are likely getting the daily question of, ‘should I put this in the cloud?’ As customer demands for cloud services increases, companies will see a shift from traditional buying patterns to new…

920 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

16 Experts available now in Live!

Get 1:1 Help Now