#1
Inactive
Profile: Join Date: Aug 2008
Posts: 2
Computer Experience:
Problem with vundo trojan
I have a situation where pop-ups with instructions to download antivirus softwares come up and my computer is also running very slow.SP2 (WinNT 5.01.2600)http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157 http://messenger.zone.msn.com/binary...t.cab31267.cab http://go.microsoft.com/fwlink/?linkid=39204 http://messenger.zone.msn.com/binary...r.cab31267.cab http://messenger.zone.msn.com/binary...t.cab31267.cab http://messenger.zone.msn.com/binary...o.cab32846.cab http://upload.facebook.com/controls/...ploader4_5.cab http://messenger.zone.msn.com/binary...n.cab31267.cab
Didn't find the information you thought to find?Similar Threads
#2
Staff
Profile: Join Date: Apr 2003
Location: New Bremen, Ohio U.S.A.
Posts: 12,524
Computer Experience:
Welcome to WindowsBBS kaspertopdog here , saving the file to your desktop.this link for your applicable programs.Close all open programs and windows Double click combofix.exe and follow the prompts.
It may reboot your computer and resume running when you logon. Wait for it to complete. When finished, it will open a log for you. Post that log and a new HijackThis log in your next reply.
Note: Do not mouseclick combofix's window while its running. That may cause it to stall
#3
Inactive
Profile: Join Date: Aug 2008
Posts: 2
Computer Experience:
ComboFix 08-08-11.01 - Steve 2008-08-12 15:50:00.1 - FAT32 WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! LAN Card Driver;C:\WINDOWS\system32\DRIVERS\i2220ntx.sys [2004-11-04 18:29]js - SEARCH.DEFAULTURL - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=http://www.gmer.net Ad -Aware\aawservice.exe HiJack This Log SP2 (WinNT 5.01.2600)Ad -Aware\aawservice.exehttp://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157 http://messenger.zone.msn.com/binary...t.cab31267.cab http://go.microsoft.com/fwlink/?linkid=39204 http://messenger.zone.msn.com/binary...r.cab31267.cab http://messenger.zone.msn.com/binary...t.cab31267.cab http://messenger.zone.msn.com/binary...o.cab32846.cab http://upload.facebook.com/controls/...ploader4_5.cab http://messenger.zone.msn.com/binary...n.cab31267.cab Ad -Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad -Aware\aawservice.exe
#4
Staff
Profile: Join Date: Apr 2003
Location: New Bremen, Ohio U.S.A.
Posts: 12,524
Computer Experience:
Once again, please disable any realtime protection applications. Highlight and copy the contents of the code box below and paste it into a blank notepad, then save it to your desktop as;CFScript.txt All Files (*.*)
Code:
http ://www.windowsbbs.com/malware-virus-removal/75886-problem-vundo-trojan.html#post410873
Suspect::[22]
C:\WINDOWS\system32\drivers\pshook11.sys
C:\WINDOWS\system32\drivers\psntkd20.sys
Folder::
C:\WINDOWS\system32\kBin15
C:\Temp\epr1
Registry::
O3 - Toolbar: (no name) - {37B85A29-692B-4205-9CAD-2626E4993404} - Close all other windows and programs . Now drag the CFScript.txt onto ComboFix.exe and drop it, using the left mouse button. Combofix should run and may reboot the computer when it's done. A log will open when it's complete. Post the contents of that log and a fresh HijackThis log.Please do not click on the ComboFix window while it is running a scan. This can cause it to stall.
All times are GMT +1. The time now is 07:20 .
