vundo will not be removed, even after several methods tried

[Gideon]

hey all

i logged in here, cause i have no idea how to treat this bastard of a trojan...

some time ago( a few weeks), i had encountered the trojan, but was able to remove
it while suspending winlogon and explorer processes and doin ODS with mcafee,
then shutting down "hard"(with the on/off button).


last night, while i was asleep, some how the trojan returned, as i saw
when i woke up.

tried everythings including the method from last time, fix from atribune and vundo be gone, they cannot find the infected file, although mcafee can still detect it, but, how convinient, cannot quarantine it.

i cannot go on working on my pc(graphic designer), while knowing this trojan is still present.

if anyone has any ideas, i'd be more then glad to try'em out...

many thanks ahead,
Gideon

[Jubo]

Can you also tell us what you have installed on the computer? If you have an icon near the PC clock like:

• 
  
• , then launch the Security Center:
  
  
  
  Click on the "View Details" link and in the next window you see all the McAfee programs installed. Clicking on each of them will give you the exact version numbers. Include the version # of the VirusScan Scan Engine and DAT file.

Also, what version of Windows is installed?

• 
  
• Windows XP: Go to Start > right click My Computer > click on Properties and on the General tab you'll find all the information, incl. any installed Service Packs.
  
• Windows Vista: Open Welcome Center by clicking the Start button , clicking Control Panel, clicking System and Maintenance, and then clicking Welcome Center.
  
• Check if your version of Windows is up-to-date at: Windows Update. Use the "Custom" button. This way you also get the "Optional" updates as well as the "Critical" updates/patches.

Try to do an online scan as in here to see if the computer is infected or not...

[Gideon]

virus scan:

version: 12.1
build: 12.1.110
affid: 0
last update 23/7/2008
DAT version: 5344.0000 (creation date:22/07/2008)
engine version : 5200.2160

windows XP pro
version 2002
SP3


anything else needed?

[Gideon]

ok, i'm doin the scan you suggested, although i'm pretty sure
the vundo is still here...

i can still see the random dll file it produced in the system 32 dir:ssqoMeBR.dll

plus, my pc is up2date wink

[Gideon]

scan found this trojan name:

Trojan:Win32/Vundo.gen!R

[exbrit]

Your best bet is to run Hijackthis and post its log on one of the following forums. I've named several as people have their favourites.
They have experts who will tell you exactly how to get rid of it. Vundo is one the worst because new versions are released almost daily.

Do not post the log here, we can't help!

DOWNLOAD HIJACKTHIS

Post the logs at a specialist Forum:

AUMHA FORUM

BLEEPING COMPUTER FORUM

CASTLECOPS FORUM

GEEKS TO GO FORUM

MAJOR GEEKS FORUM

MALWARE REMOVAL FORUM

SPYWARE INFO FORUM

TECH SUPPORT GUY FORUM

WHAT THE TECH FORUM (Formerly Tom Coyote)

Be sure to read all the sticky announcements/instructions at the top of each malware forum!

[Gideon]

thanks all!

i just used super anti spyware and it cleaned everything right away!

:cool:

[exbrit]

That's good news.