Vundo - Virus/Trojan/Hijack etc.

[Hans Manhave]

Besides reformat, how do I remove a Vundo infection?  This is on a home computer, it was a good lesson for a kid not to go wherever a thought leads, and a dad to install more Deepfrozen machines instead of letting some be open and trusting a virus scanning software.  But I like to get rid of it first.  I ran SuperAntiSpyware which may have gotten rid of a bunch, a virus scanner which may have gotten rid of a bunch, but instead of it becoming more subdued, it is out in greater force than yesterday.

Thanks.

[Marie (Zionkowski) Gozikowski]

Hans

I just cleaned up someone's laptop 2 weeks ago with this....

Download Malwarebytes' Anti-Malware, and install it on the computer - run once, and make note of the
names of the files it is deleting...   go into your registry and search/remove those, then reboot in safe mode
and run Malwarebyte again....  It was the only thing that I could get to work --- SuperAntispyware and others didn't seem to be able to remove it

Took a while, but it is possible to remove it - good luck!

[Mark]

+1 for Malwarebytes -- though I am not familiar with your infection.

[Marie (Zionkowski) Gozikowski]

New one going around... have actually cleaned up two computers in the last month with it...

Also a REALLY nasty one out there called PCAntispyware2010... one of those things where it pops up
and says 'your computer is infected, click here to download our free on-line virus scan..."   It was a
tenacious little bas***d, and took a long time to track down the dll's and registry items....

(Good thing I'm tenancious too....)   

[Mark]

I added HAVP to my proxy so now I am scanning http traffic for viruses using the ClamAV database.  I've already heard about some false positives some shops have experienced in the past, but I'd rather a false positive then an infection.

I am happy with this configuration so far.  Performance is decent as well.

[Sheila Foss]

SuperAntiSpyware which is free, was the only one that removed the prior versions easily.  Although you had to rename the file to install it, since those programs watch out for the name.

Haven't had the pleasure (!) of working on the 2010 version yet.

[Marie (Zionkowski) Gozikowski]

Haven't had the pleasure (!) of working on the 2010 version yet.

LOL --- your friends will hit you up soon enough~   

[Bob]

Han's what ever happened to your strong endorsement of Hit Man Pro?

[Jeff Zylstra]

VUndoFix.exe is a specialty program that I've used a couple of times with great success.  It is an executable that will run right off a usb memory stick without installing, and it was not blocked by VUndo.   That said, VUndo is somewhat "old" by now so I think that either Malware Bytes or Super Anti Spyware would both clean it up too.  Good luck.

[Hans Manhave]

SuperAntiSpyware made an attempt but by no means was succesful.  MalwareBytes did a much better job, plus, and I think this was also a big part, I deleted the other users.  Tough they lost their files, but a good lesson.

Still wondering if I should do DeepFreeze with Igloo or WinSelect.  The latter looks more interesting to me.  But I'll probably end up doing both.  The Enterprise version of each appears to be what I want.  Just wish they had it as one product.

[Marie (Zionkowski) Gozikowski]

I never used Deep Freeze before... I'd be interested in knowing what people think
about it...

[Dawn Shirley]

I think its a cold dark place, when the lid is closed.  Remember on Desperate Housewives the old lady had her husband in it!

[Marie (Zionkowski) Gozikowski]

Wow --- I'm gonna have to start watching that show   

[Nick Oliver]

I never used Deep Freeze before... I'd be interested in knowing what people think
about it...

Deepfreeze is awesome, I'll fill you in more at TENCon when I see you

[Hans Manhave]

It is.  You just have to handle the unfrozen parts, because you'll need those.  They made an Igloo for that.  Planning ahead and scheduling in the use of DeepFreeze would greatly help.