Trojan Vundo

I'm afraid to have trojan Vundo: how to be sure to have it?

I've just launched Spybot and NOD32 and they haven't detected anything.

Please, tell me!

Mhaxx


P.S. maybe you need the HiJackThis log?

On Tue, 23 Sep 2008 10:24:56 +0200, "Mhaxx" <supermhaxx@despammed.com>
wrote:

>I'm afraid to have trojan Vundo: how to be sure to have it?
>
>I've just launched Spybot and NOD32 and they haven't detected anything.
>
>Please, tell me!
>
>Mhaxx
>
>
>P.S. maybe you need the HiJackThis log?
>


Try Trojan Remover from www.simplysup.com. It will detect and remove
Vundo and its varients.

Bill wrote:
> On Tue, 23 Sep 2008 10:24:56 +0200, "Mhaxx" <supermhaxx@despammed.com>
> wrote:
>
>> I'm afraid to have trojan Vundo: how to be sure to have it?
>>
>> I've just launched Spybot and NOD32 and they haven't detected anything.
>>
>> Please, tell me!
>>
>> Mhaxx
>>
>>
>> P.S. maybe you need the HiJackThis log?
>>
>
>
> Try Trojan Remover from www.simplysup.com. It will detect and remove
> Vundo and its varients.


I find that Superantispyware does the job...and they have a free version...

http://superantispyware.com/

* Mhaxx, after much thought, came up with this jewel:
> I'm afraid to have trojan Vundo: how to be sure to have it?
> I've just launched Spybot and NOD32 and they haven't detected anything.
> Please, tell me! P.S. maybe you need the HiJackThis log?

Use this tool

http://vundofix.atribune.org/

Do not post log files here please. There are special forums for them.
--
Virus Removal http://max.shplink.com/removal.html
Keep Clean http://max.shplink.com/keepingclean.html
Change nomail.afraid.org to gmail.com to reply by email.
nomail.afraid.org is for use in USENET-feel free to use it yourself.

Mhaxx wrote:
> I'm afraid to have trojan Vundo: how to be sure to have it?
>
> I've just launched Spybot and NOD32 and they haven't detected
> anything.
>
> Please, tell me!
>
> Mhaxx
>
>
> P.S. maybe you need the HiJackThis log?

These three tools will help you. This trojan has numerous variants, and I
find it really needs a clean through from all three of these programmes to
be sure you have got rid of it:

i) Superantispyware
ii) Malwarebytes
iii) smitfraudfix.

All three programmes are free, you *must* update them before use, it would
be better once you have installed them all and updated them, to drop into
safe mode and run from there.

Gaz

> All three programmes are free, you *must* update them before use, it would

I'm scanning my PC with all the applications you suggested, without finding
anything.

Maybe I was confused because the fact that told me to have Vunde was this:
scanning my HD with SpyBot I see on the bottom of the window of the scan the
phase "Scanning.. (136593/286339: VirtuMonde.dll)". At the end of the scan
no VirtuMonde is found, anyway I can't understand why Spyot shows
"VirtuMonde.dll" there.. do you have Spybot and can you you try by your own
in order to understand its meaning, please?

Thanks again,

Mhaxx

Mhaxx wrote:

> Maybe I was confused because the fact that told me to have Vunde was
> this: scanning my HD with SpyBot I see on the bottom of the window of
> the scan the phase "Scanning.. (136593/286339: VirtuMonde.dll)". At
> the end of the scan no VirtuMonde is found, anyway I can't understand
> why Spyot shows "VirtuMonde.dll" there.. do you have Spybot and can
> you you try by your own in order to understand its meaning, please?

In the status bar, it shows *all* the items it is scanning for. It runs
rather quickly, but don't you notice that it starts at "1" and continues
scanning to the 286,339th item? Maybe it takes longer to look for this
one item, so it is displayed in the status bar long enough for you to
actually read it.

If nothing was found when the scan *completes*, I think you have naught
to worry about.

--
-bts
-Friends don't let friends drive Windows

> In the status bar, it shows *all* the items it is scanning for. It runs
> rather quickly, but don't you notice that it starts at "1" and continues
> scanning to the 286,339th item?

Sure

> Maybe it takes longer to look for this
> one item, so it is displayed in the status bar long enough for you to
> actually read it.

It could be

> If nothing was found when the scan *completes*, I think you have naught
> to worry about.

Okay, thanks a lot.

Massimo

"Gaz" <gazter@msn.com> wrote in news:6jt1lrF504chU1@mid.individual.net:

> Mhaxx wrote:
>> I'm afraid to have trojan Vundo: how to be sure to have it?
>>
>> I've just launched Spybot and NOD32 and they haven't detected
>> anything.
>>
>> Please, tell me!
>>
>> Mhaxx
>>
>>
>> P.S. maybe you need the HiJackThis log?
>
> These three tools will help you. This trojan has numerous variants,
> and I find it really needs a clean through from all three of these
> programmes to be sure you have got rid of it:
>
> i) Superantispyware
> ii) Malwarebytes
> iii) smitfraudfix.
>
> All three programmes are free, you *must* update them before use, it
> would be better once you have installed them all and updated them, to
> drop into safe mode and run from there.
>
> Gaz
>
>
>

With the exception of Malwarebytes, it doesn't perform as well in safe
mode as it would in normal mode.


--
Regards,
Dustin Cook, Author of BugHunter
BugHunter - http://bughunter.it-mate.co.uk
MalwareBytes - http://www.malwarebytes.org

Dustin Cook wrote:
> "Gaz" <gazter@msn.com> wrote in
> news:6jt1lrF504chU1@mid.individual.net:
>
>> Mhaxx wrote:
>>> I'm afraid to have trojan Vundo: how to be sure to have it?
>>>
>>> I've just launched Spybot and NOD32 and they haven't detected
>>> anything.
>>>
>>> Please, tell me!
>>>
>>> Mhaxx
>>>
>>>
>>> P.S. maybe you need the HiJackThis log?
>>
>> These three tools will help you. This trojan has numerous variants,
>> and I find it really needs a clean through from all three of these
>> programmes to be sure you have got rid of it:
>>
>> i) Superantispyware
>> ii) Malwarebytes
>> iii) smitfraudfix.
>>
>> All three programmes are free, you *must* update them before use, it
>> would be better once you have installed them all and updated them, to
>> drop into safe mode and run from there.
>>
>> Gaz
>>
>>
>>
>
> With the exception of Malwarebytes, it doesn't perform as well in safe
> mode as it would in normal mode.

Really? I wasnt aware of that. Any reason??

Gaz

"Gaz" <gazter@msn.com> wrote in news:6k5407F5spj7U1@mid.individual.net:

> Dustin Cook wrote:
>> "Gaz" <gazter@msn.com> wrote in
>> news:6jt1lrF504chU1@mid.individual.net:
>>
>>> Mhaxx wrote:
>>>> I'm afraid to have trojan Vundo: how to be sure to have it?
>>>>
>>>> I've just launched Spybot and NOD32 and they haven't detected
>>>> anything.
>>>>
>>>> Please, tell me!
>>>>
>>>> Mhaxx
>>>>
>>>>
>>>> P.S. maybe you need the HiJackThis log?
>>>
>>> These three tools will help you. This trojan has numerous variants,
>>> and I find it really needs a clean through from all three of these
>>> programmes to be sure you have got rid of it:
>>>
>>> i) Superantispyware
>>> ii) Malwarebytes
>>> iii) smitfraudfix.
>>>
>>> All three programmes are free, you *must* update them before use, it
>>> would be better once you have installed them all and updated them, to
>>> drop into safe mode and run from there.
>>>
>>> Gaz
>>>
>>>
>>>
>>
>> With the exception of Malwarebytes, it doesn't perform as well in safe
>> mode as it would in normal mode.
>
> Really? I wasnt aware of that. Any reason??

Windows doesn't load a complete copy of the registry in safe mode. We
would miss some registry items.


--
Regards,
Dustin Cook, Author of BugHunter
BugHunter - http://bughunter.it-mate.co.uk
MalwareBytes - http://www.malwarebytes.org

[punkdude600]

try using avg free 8.0 to delete the file. heres the download link:

http://www.download.com/AVG-Anti-Vir...dlPid=10880275


download, install, navigate to pmkji.dll in system 32 folder, right click and click scan with avg. it should automatically recognize the virus and delete the file. after that, navigate back to the file which should now say 'pmkji' instead of 'pmkji.dll'. u should also have a white box for an icon. now delete the file from there and the recycle bin. open up the registry( go to start>run and type in REGEDIT. once there hit ctrl+f and search for 'pmkji'. delete all keys for this file, it may require reboot. now walahh!! no more trojan=]