Vundo, Abetear won't go away

My main anti virus client is Zone Alarm. The signatures are always up to
date. For the last couple weeks, the program has found & treated
multiple instances of "vundo", abetear", & sometimes "darksma". The
program always says they have been treated and no further action is
neccessary, But it continues, and continues. As a result, I have
run the "Multi AV command line utility" repeatedly both in safe &
regular mode. The various signatures for "Sophos", "Trend", "Kaspersy"
etc all update each time, but the problem continues. I have also run the
"Vundo Fix" utility, that didn't find anything, but then the
Zone Alarm window pops up w/ addition instances, all being treated, but
it just won't go away.
I have had to boot to "last known good config..." twice, & use restore
points several times just to boot up. The only other symptom, is the web
browser will open extra windows when left alone....sometimes a 404, &
sometimes "sexbuddies" in the address bar & a script error on the page.

On Wed, 12 Dec 2007 18:21:31 GMT, Dave Goldman wrote:

> My main anti virus client is Zone Alarm. The signatures are always up to
> date. For the last couple weeks, the program has found & treated
> multiple instances of "vundo", abetear", & sometimes "darksma". The
> program always says they have been treated and no further action is
> neccessary, But it continues, and continues. As a result, I have
> run the "Multi AV command line utility" repeatedly both in safe &
> regular mode. The various signatures for "Sophos", "Trend", "Kaspersy"
> etc all update each time, but the problem continues. I have also run the
> "Vundo Fix" utility, that didn't find anything, but then the
> Zone Alarm window pops up w/ addition instances, all being treated, but
> it just won't go away.
> I have had to boot to "last known good config..." twice, & use restore
> points several times just to boot up. The only other symptom, is the web
> browser will open extra windows when left alone....sometimes a 404, &
> sometimes "sexbuddies" in the address bar & a script error on the page.

Download and run HijackThis;
(http://aumha.org/downloads/hijackthis.zip)

Read this Tutorial *before* first use;
(http://www.bleepingcomputer.com/for...showtutorial=42)

Once done > run HijackThis > save a scan log and post it to /any/ of the
following (expert) forums for analysis.

*Note, //registration// *is* required prior to posting a log.
- Not listed in any particular order -

(http://www.theeldergeek.com/forum/i...f6&showforum=29)
(http://www.trendsecure.com/portal/e...page=hijackthis)
(http://aumha.net/viewforum.php?f=30)
(http://forums.spywareinfo.com/index.php?&showforum=18)
(http://www.spywarewarrior.com/viewforum.php?f=5)
(http://www.bleepingcomputer.com/forums/forum22.html)
(http://www.dslreports.com/forum/cleanup)
(http://forum.malwareremoval.com/viewforum.php?f=11)
(http://www.cybertechhelp.com/forums...isplay.php?f=25)
(http://www.atribune.org/forums/index.php?showforum=9)
(http://www.geekstogo.com/forum/Malw...o_Here-f37.html)
(http://forums.spywareinfo.com/index.php?showforum=18)
(http://www.techmonkeys.co.uk/forums/viewforum.php?f=8)
(http://forum.networktechs.com/forumdisplay.php?f=130)
(http://forums.maddoktor2.com/index.php?showforum=17)
(http://forums.spywaretimes.com/index.php?showforum=2)
(http://www.bluetack.co.uk/forums/in...p?showforum=172)
(http://forums.techguy.org/f54-s.html)
(http://forums.tomcoyote.org/index.php?showforum=27)
(http://forums.subratam.org/index.php?showforum=7)
(http://www.5starsupport.com/ipboard...hp?showforum=18)
(http://www.malwarebytes.org/forums/...php?showforum=7)
(http://www.wilderssecurity.com/forumdisplay.php?f=26)
(http://makephpbb.com/phpbb/viewforum.php?f=2)
(http://forums.techguy.org/54-security/)
(http://forums.security-central.us/forumdisplay.php?f=13)
(http://castlecops.com/forum67.html)
(http://gladiator-antivirus.com/foru...p?showforum=170)

Use Remove-it version 16, it's fast and free. It now has over 6500
signatures to remove All variants of Rogue scanners, Desktop/Homepage
Hijackers, Trojans, Codec's, and related Malware/Spyware. New Feature,
Remove-it will now update your hosts file. This tool is designed to
Specifically remove all variants. Scan time is about 2-10 minutes. Designed
for Windows 2000/XP only.First read this page
http://www.pcbutts1.com/downloads then use the email link on the bottom of
the page to receive the software.


Check my feedback and see what others have said about it
http://pcbutts1-therealtruth.blogspot.com/

--

Newsgroup Trolls. Read about mine here http://www.pcbutts1.com/downloads
The list grows. Leythos the stalker http://www.leythosthestalker.com, David
H. Lipman, Max M Wachtell III aka What's in a Name?, Fitz, Beauregard T.
Shagnasty,Rhonda Lea Kirk, Meat Plow, F Kwatu F, George Orwell



"Dave Goldman" <Dave@riverheaven.com> wrote in message
news:LEV7j.295$Sa1.144@news02.roc.ny...
> My main anti virus client is Zone Alarm. The signatures are always up to
> date. For the last couple weeks, the program has found & treated multiple
> instances of "vundo", abetear", & sometimes "darksma". The program always
> says they have been treated and no further action is neccessary, But it
> continues, and continues. As a result, I have
> run the "Multi AV command line utility" repeatedly both in safe & regular
> mode. The various signatures for "Sophos", "Trend", "Kaspersy" etc all
> update each time, but the problem continues. I have also run the "Vundo
> Fix" utility, that didn't find anything, but then the
> Zone Alarm window pops up w/ addition instances, all being treated, but it
> just won't go away.
> I have had to boot to "last known good config..." twice, & use restore
> points several times just to boot up. The only other symptom, is the web
> browser will open extra windows when left alone....sometimes a 404, &
> sometimes "sexbuddies" in the address bar & a script error on the page.