Trojan.Vundo and Malware.Trace ... anyone have specific instructions to remove? - GoFuckYourself.com

J$tyle$ · 12-28-2008, 04:21 AM

Driving me fucking nuts.

Popping ads in both IE and FF at different intervals. Going to Google or yahoo generally triggers them.

Just can't find anything to get rid of 'em for good

HELP

LOL

Malwarebytes' Anti-Malware 1.31
Database version: 1559
Windows 5.1.2600 Service Pack 2

12/28/2008 3:18:08 AM
mbam-log-2008-12-28 (03-11-08).txt

Scan type: Quick Scan
Objects scanned: 60603
Time elapsed: 6 minute(s), 39 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 2
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

sicone · 12-28-2008, 04:47 AM

Hey man.. I had that shit a whilE back and it took me about 2 days too get rid of it.

start here...

http://www.symantec.com/business/sec...112210-3747-99

run both tools (unless you know which vundo you have)
reboot in safe mode, run the tool again
reboot in safe mode run Windows Defender... http://www.microsoft.com/windows/pro...r/default.mspx
reboot in safe mode run spybot search and destroy.
reboot in safe mode and go through each item that runs on start up, run each item 1 at a time, if you dont know the process, do not allow it to run
Run the symantec program again

reboot normal and run all 3 programs again

Cross your fingers and good luck. I had to repeat this process several times until I found all files that were auto running and reinstalling the malware

Fletch XXX · 12-28-2008, 06:23 AM

MBAM wont and cannot remove all spyware that is currently out.

http://www.gofuckyourself.com/showth...ght=virtumonde

Theres my thread about recent infection, it will take you a full day to remove it.

the programs out for free do not remove this stuff, the processes in memory cannot be killed by MBAM or spybot or any free stuff, you need to start dissecting and killing registry keys and go until you nip it all...

most processes or files will remanifest itself as a copy if you delete the original .dll files etc... so you have yto fight it and try to remove as much as you can to stop it from running so you can kill it all.

ps i just removed the MS Juan from my bros computer,...

Mutt · 12-28-2008, 06:33 AM

i've had this shit three times now - finally learned my lesson, don't visit sites that end in .RU !

go to Fletch's thread - the MajorGeeks guide has bailed me out each time - it's going to take at least half a day to clean it up so consider re-formatting and re-installing Windows.

and Fletch - those .dll files that u had left in your registry are harmless, they're just remnants

i just don't know how we let these fuckers get away with the mass destruction they are responsible for - it's not like this shit is hidden - the servers that these trojans connect to are known - so tracking down the people behind it should not be hard.

stoner529 · 12-28-2008, 06:51 AM

i use spyware doctor and registry mechanic, both by PC Tools. they work very well for me. there was only one infection that i had trouble with but i got it solved. sometimes its just easier to make sure your files are back up periodically and just use a seperate account from the adminstrator. then you can delete the infected account and put your old files back on it free and clear, and it wont take all day.

polish_aristocrat · 12-28-2008, 06:55 AM

how do you get infected with this trojan?

RegUser · 12-28-2008, 07:57 AM

Quote:

Originally Posted by polish_aristocrat

how do you get infected with this trojan?

easy mah friend
just visit a webpage and thats it! the bloody thing attaches itself to your machine

u-Bob · 12-28-2008, 07:58 AM

format + reinstall.

HorseShit · 12-28-2008, 08:06 AM

google malwarebytes

Brujah · 12-28-2008, 08:08 AM

Buy a new computer. That usually worked for me.

dready · 12-28-2008, 08:35 AM

You might want to try the free online virus scan at http://www.pandasoftware.com/

It sometimes cleans things that Norton and McAfee can't touch.

GregE · 12-28-2008, 09:29 AM

Quote:

Originally Posted by Brujah

Buy a new computer. That usually worked for me.

Barefootsies · 12-28-2008, 09:36 AM

Quote:

Originally Posted by stoner529

i use spyware doctor and registry mechanic, both by PC Tools. they work very well for me. there was only one infection that i had trouble with but i got it solved. sometimes its just easier to make sure your files are back up periodically and just use a seperate account from the adminstrator. then you can delete the infected account and put your old files back on it free and clear, and it wont take all day.

IllTestYourGirls · 12-28-2008, 09:51 AM

Update your java or you will just keep getting it

Outlaw #1 · 12-28-2008, 10:23 AM

this and just this...
http://www.greatis.com/unhackme/

sicone · 12-28-2008, 11:41 AM

Quote:

Originally Posted by Fletch XXX

MBAM wont and cannot remove all spyware that is currently out.

http://www.gofuckyourself.com/showth...ght=virtumonde

Theres my thread about recent infection, it will take you a full day to remove it.

the programs out for free do not remove this stuff, the processes in memory cannot be killed by MBAM or spybot or any free stuff, you need to start dissecting and killing registry keys and go until you nip it all...

most processes or files will remanifest itself as a copy if you delete the original .dll files etc... so you have yto fight it and try to remove as much as you can to stop it from running so you can kill it all.

ps i just removed the MS Juan from my bros computer,...

I probably should have mentioned that it was well over a yr ago when I got hit by this, and at that time that's what I did to get rid of it. I'm sure its been changed and re-written several times by now

HandballJim · 12-28-2008, 02:10 PM

Try "Malwarebytes" - Anti-Malware, you can download it for free. This cleared up my problems...and I had some nasty stuff.

If a program was downloaded on your computer, you might have to manually remove it from "add/remove programs" in your control panel.

I usually get my problems checking sigs on GYF, it seem their website is safe, but once you start clicking on their Photo Galleries..."it's like a box of chocolates...you don't know what your going to get." The pain in the ass spyware/virus lately is a PDF pop up...you just visit the infected website and it just pops up. I avoided it a couple more times by quickly hitting CTL ATL DELETE...and ending the process.

Hope this helps...

HandballJim · 12-28-2008, 02:27 PM

Looking through this thread again ic you already tried Malwarebytes, you can go to download.com and try several other programs...many are free or offer a free trial...and try to find their updated versions.

In the past I was able to search and manually delete the files, but now these viruses are smarter and seem to be hidden and you might delete something that you need to make the computer function correctly. If you do try deleting manually...don't empty your recycling bin right away. Just incase you need to restore the files.

Just Mike · 12-29-2008, 12:30 AM

fixvundo.exe will permanently remove it

If you cant find a copy hit me up and I'll upload it for you

perfectodollars-gabrio · 12-29-2008, 01:10 AM

hey there Johnatan, i got that fucker myself too and took a lil while to clean it, if i recall correctly ive used the specific cleaner.... as well as Malwarebytes' Anti-Malware several times... and be careful since some of the cleaners that pretend do clean the infection, they will only charge you $$$ and do nothing.

i had a link with the instructions but cant find it :/

perfectodollars-gabrio · 12-29-2008, 01:11 AM

have you tried running HijackThis ?

Barefootsies · 12-29-2008, 01:16 AM

Quote:

Originally Posted by IllTestYourGirls

Update your java or you will just keep getting it

tranza · 12-29-2008, 07:49 AM

That's fucked up!

12-28-2008, 04:47 AM	#2
sicone Retired Industry Role: Join Date: Jan 2004 Location: Sac Posts: 18,453	Hey man.. I had that shit a whilE back and it took me about 2 days too get rid of it. start here... http://www.symantec.com/business/sec...112210-3747-99 run both tools (unless you know which vundo you have) reboot in safe mode, run the tool again reboot in safe mode run Windows Defender... http://www.microsoft.com/windows/pro...r/default.mspx reboot in safe mode run spybot search and destroy. reboot in safe mode and go through each item that runs on start up, run each item 1 at a time, if you dont know the process, do not allow it to run Run the symantec program again reboot normal and run all 3 programs again Cross your fingers and good luck. I had to repeat this process several times until I found all files that were auto running and reinstalling the malware __________________

12-28-2008, 06:23 AM	#3
Fletch XXX GFY HALL OF FAME DAMMIT!!! Join Date: Jan 2002 Location: that 504 Posts: 60,840	MBAM wont and cannot remove all spyware that is currently out. http://www.gofuckyourself.com/showth...ght=virtumonde Theres my thread about recent infection, it will take you a full day to remove it. the programs out for free do not remove this stuff, the processes in memory cannot be killed by MBAM or spybot or any free stuff, you need to start dissecting and killing registry keys and go until you nip it all... most processes or files will remanifest itself as a copy if you delete the original .dll files etc... so you have yto fight it and try to remove as much as you can to stop it from running so you can kill it all. ps i just removed the MS Juan from my bros computer,... __________________ Want an Android App for your tube, membership, or free site? Need banners or promo material? Hit us up (ICQ Fletch: 148841377) or email me fletchxxx at gmail.com - recent work - About me Last edited by Fletch XXX; 12-28-2008 at 06:25 AM..

12-28-2008, 06:33 AM	#4
Mutt Too lazy to set a custom title Industry Role: Join Date: Sep 2002 Posts: 34,431	i've had this shit three times now - finally learned my lesson, don't visit sites that end in .RU ! go to Fletch's thread - the MajorGeeks guide has bailed me out each time - it's going to take at least half a day to clean it up so consider re-formatting and re-installing Windows. and Fletch - those .dll files that u had left in your registry are harmless, they're just remnants i just don't know how we let these fuckers get away with the mass destruction they are responsible for - it's not like this shit is hidden - the servers that these trojans connect to are known - so tracking down the people behind it should not be hard. __________________ I moved my sites to Vacares Hosting. I've saved money, my hair is thicker, lost some weight too! Thanks Sly!

12-28-2008, 06:55 AM	#6
polish_aristocrat Too lazy to set a custom title Join Date: Jul 2002 Posts: 40,377	how do you get infected with this trojan? __________________ I don't use ICQ anymore.

12-28-2008, 08:08 AM	#10
Brujah Beer Money Baron Industry Role: Join Date: Jan 2001 Location: brujah / gmail Posts: 22,157	Buy a new computer. That usually worked for me. __________________ Free Premium Domain Lists and Tools at Clickmojo.com For Sale: Obscenity.com

12-28-2008, 04:21 AM	#1
J$tyle$ Too lazy to set a custom title Industry Role: Join Date: Apr 2003 Location: Sunny San Diego Posts: 11,500	Trojan.Vundo and Malware.Trace ... anyone have specific instructions to remove? Driving me fucking nuts. Popping ads in both IE and FF at different intervals. Going to Google or yahoo generally triggers them. Just can't find anything to get rid of 'em for good HELP LOL Malwarebytes' Anti-Malware 1.31 Database version: 1559 Windows 5.1.2600 Service Pack 2 12/28/2008 3:18:08 AM mbam-log-2008-12-28 (03-11-08).txt Scan type: Quick Scan Objects scanned: 60603 Time elapsed: 6 minute(s), 39 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 2 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Quarantined and deleted successfully. Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected)

12-28-2008, 06:51 AM	#5
stoner529 Confirmed User Join Date: Aug 2008 Location: longwood, fl Posts: 421	i use spyware doctor and registry mechanic, both by PC Tools. they work very well for me. there was only one infection that i had trouble with but i got it solved. sometimes its just easier to make sure your files are back up periodically and just use a seperate account from the adminstrator. then you can delete the infected account and put your old files back on it free and clear, and it wont take all day.

12-28-2008, 07:58 AM	#8
u-Bob there's no $$$ in porn Industry Role: Join Date: Jul 2005 Location: icq: 195./568.-230 (btw: not getting offline msgs) Posts: 33,063	format + reinstall.

12-28-2008, 08:06 AM	#9
HorseShit Too lazy to set a custom title Join Date: Dec 2004 Posts: 17,513	google malwarebytes

12-28-2008, 08:35 AM	#11
dready Confirmed User Industry Role: Join Date: Oct 2002 Location: Toronto, ON Posts: 5,247	You might want to try the free online virus scan at http://www.pandasoftware.com/ It sometimes cleans things that Norton and McAfee can't touch. __________________ ICQ: 91139591

12-28-2008, 09:51 AM	#14
IllTestYourGirls Ah My Balls Industry Role: Join Date: Feb 2007 Location: Under the gold leaf ICQ 388-454-421 Posts: 14,311	Update your java or you will just keep getting it __________________

12-28-2008, 10:23 AM	#15
Outlaw #1 Confirmed User Industry Role: Join Date: May 2003 Location: Internet. Posts: 745	this and just this... http://www.greatis.com/unhackme/ __________________ BlowNetwork.com - Advertise on 20 y old porn network >> blownetwork AT gmail.com

12-28-2008, 02:10 PM	#17
HandballJim Confirmed User Industry Role: Join Date: Sep 2008 Location: NYC Posts: 4,024	Try "Malwarebytes" - Anti-Malware, you can download it for free. This cleared up my problems...and I had some nasty stuff. If a program was downloaded on your computer, you might have to manually remove it from "add/remove programs" in your control panel. I usually get my problems checking sigs on GYF, it seem their website is safe, but once you start clicking on their Photo Galleries..."it's like a box of chocolates...you don't know what your going to get." The pain in the ass spyware/virus lately is a PDF pop up...you just visit the infected website and it just pops up. I avoided it a couple more times by quickly hitting CTL ATL DELETE...and ending the process. Hope this helps... __________________ HOW I MAKE LOTS OF $$$

12-28-2008, 02:27 PM	#18
HandballJim Confirmed User Industry Role: Join Date: Sep 2008 Location: NYC Posts: 4,024	Looking through this thread again ic you already tried Malwarebytes, you can go to download.com and try several other programs...many are free or offer a free trial...and try to find their updated versions. In the past I was able to search and manually delete the files, but now these viruses are smarter and seem to be hidden and you might delete something that you need to make the computer function correctly. If you do try deleting manually...don't empty your recycling bin right away. Just incase you need to restore the files. __________________ HOW I MAKE LOTS OF $$$

12-29-2008, 12:30 AM	#19
Just Mike Confirmed User Industry Role: Join Date: Sep 2002 Location: In a land FAR FAR away Posts: 3,726	fixvundo.exe will permanently remove it If you cant find a copy hit me up and I'll upload it for you __________________ EMAIL: [email protected] / ICQ: 56205262 AWEMPIRE

12-29-2008, 01:10 AM	#20
perfectodollars-gabrio Confirmed User Join Date: Jun 2003 Location: www.perfectodollars.com Posts: 3,811	hey there Johnatan, i got that fucker myself too and took a lil while to clean it, if i recall correctly ive used the specific cleaner.... as well as Malwarebytes' Anti-Malware several times... and be careful since some of the cleaners that pretend do clean the infection, they will only charge you $$$ and do nothing. i had a link with the instructions but cant find it :/

12-29-2008, 01:11 AM	#21
perfectodollars-gabrio Confirmed User Join Date: Jun 2003 Location: www.perfectodollars.com Posts: 3,811	have you tried running HijackThis ?

12-29-2008, 07:49 AM	#23
tranza ICQ: 197-556-237 Join Date: Jun 2003 Location: BRASIL !!! Posts: 57,559	That's fucked up! __________________ I'm just a newbie.