Trojan vundi virus

[Guest]

For several days I have attempted to remove a Trojan Virus called vundi. I
downloaded a vundifix from norton but it says the virus is not on the computer
In the details it says
Objject Name C:\WINDOWS\system32\rqolk.dll
Virus Name Trojan.Vundo
Action Taken Access to the file denied

I have also downloaded a Virus Remover from microsoft but it did not detect
anything either.

I dont know what else to try to remove it.
Please help.

 

[David H. Lipman]

From: "crusader504" <[email protected]>

| For several days I have attempted to remove a Trojan Virus called vundi. I
| downloaded a vundifix from norton but it says the virus is not on the computer
| In the details it says
| Objject Name C:\WINDOWS\system32\rqolk.dll
| Virus Name Trojan.Vundo
| Action Taken Access to the file denied
|
| I have also downloaded a Virus Remover from microsoft but it did not detect
| anything either.
|
| I dont know what else to try to remove it.
| Please help.

There are anti virus News Groups specifically for this type of discussion.

microsoft.public.security.virus
alt.comp.virus
alt.comp.anti-virus

Download MULTI_AV.EXE from the URL --
http://www.ik-cs.com/programs/virtools/Multi_AV.exe

To use this utility, perform the following...
Execute; Multi_AV.exe { Note: You must use the default folder C:\AV-CLS }
Choose; Unzip
Choose; Close

Execute; C:\AV-CLS\StartMenu.BAT
{ or Double-click on 'Start Menu' in C:\AV-CLS }

NOTE: You may have to disable your software FireWall or allow WGET.EXE to go through your
FireWall to allow it to download the needed AV vendor related files.

C:\AV-CLS\StartMenu.BAT -- { or Double-click on 'Start Menu' in C:\AV-CLS}
This will bring up the initial menu of choices and should be executed in Normal Mode.
This way all the components can be downloaded from each AV vendor's web site.
The choices are; Sophos, Trend, McAfee, Kaspersky, Exit this menu and Reboot the PC.

You can choose to go to each menu item and just download the needed files or you can
download the files and perform a scan in Normal Mode. Once you have downloaded the files
needed for each scanner you want to use, you should reboot the PC into Safe Mode [F8 key
during boot] and re-run the menu again and choose which scanner you want to run in Safe
Mode. It is suggested to run the scanners in both Safe Mode and Normal Mode.

When the menu is displayed hitting 'H' or 'h' will bring up a more comprehensive PDF help
file.


* * * Please report back your results * * *

 

[siljaline]

For several days I have attempted to remove a Trojan Virus called vundi. I
downloaded a vundifix from norton but it says the virus is not on the computer
In the details it says
Objject Name C:\WINDOWS\system32\rqolk.dll
Virus Name Trojan.Vundo
Action Taken Access to the file denied

I have also downloaded a Virus Remover from microsoft but it did not detect
anything either.

I dont know what else to try to remove it.

The tools discussed and used here may help;
http://www.bleepingcomputer.com/forums/topic18610.html

If you should require further assistance, register here:
http://www.bleepingcomputer.com/forums/index.php?act=Reg&CODE=00
When you have received registration confirmation, post your query here;
http://www.bleepingcomputer.com/forums/forum56.html

Regards,
Silj

--
siljaline

MS - MVP Windows (IE/OE) & Security, AH-VSOP
_________________________________________
Security Tools Updates
http://aumha.net/viewforum.php?f=31

Reply to group, as return address
is invalid that we may all benefit.

 

[teddybigman]

Send me an email at (e-mail address removed) and I will send you a fix
tool that will remove that pest. Remove the XXX to make the email valid. Oh
BTW ignore the response you will get from Leythos he is a sick obsessed
stalker who cannot fix your problem. He would rather have you suffer with
this issue then to receive help from me.

 

[David H. Lipman]

From: "teddybigman" <[email protected]>

| Send me an email at (e-mail address removed) and I will send you a fix
| tool that will remove that pest. Remove the XXX to make the email valid. Oh
| BTW ignore the response you will get from Leythos he is a sick obsessed
| stalker who cannot fix your problem. He would rather have you suffer with
| this issue then to receive help from me.

Changed your name again PCBUTTS1 !

Why should anyone send you email when Silj and I have posted the information for all to see.

News Groups are here to share information and nobody should have to send you email to get a
utility that you most likley stole frome someone else !

 

[Nick Skrepetos \(SuperAdBlocker.com\)]

Hello,

You may wish to try Super Ad Blocker with SUPERAntiSpyware. Our database has
that file in it:
http://www.superadblocker.com

Super Ad Blocker | SUPERAntiSpyware offers several unique features such as
using a system level driver to delete detected items, so pests do not come
back once detected and cleaned.

Super Ad Blocker offers a fully functional 15-day trial. You can scan and
clean your computer and then remove Super Ad Blocker if you do not wish to
keep it. We do appreciate when users support our development efforts by
purchasing the product

If that does not find and/or remove the spyware/adware on your machine, you
can submit a diagnostic and I will diagnose your machine for free and post
the results back to the group and update our rules with anything found:
http://www.superadblocker.com/diagnostic.html?id=nicks

You may also wish to "see" what is running on your computer here:
http://www.fileresearchcenter.com

Nick Skrepetos
SuperAdBlocker.com - SUPERAntiSpyware
http://www.superadblocker.com
http://blogs.superadblocker.com
http://forums.superadblocker.com

** Please note that I am the author of the above programs and sites and I do
have a vested interest in Super Ad Blocker, SUPERAntiSpyware and
FileResearchCenter.com. You, the user, have no obligation to purchase the
software and are free to try the software, clean/fix your system, and then
uninstall.

 

[Leythos]

Send me an email at (e-mail address removed) and I will send you a fix
tool that will remove that pest. Remove the XXX to make the email valid. Oh
BTW ignore the response you will get from Leythos he is a sick obsessed
stalker who cannot fix your problem. He would rather have you suffer with
this issue then to receive help from me.

Be warned that anyone asking you to email them for a fix COULD BE a
serious security threat. There files that pcbutts1 will provide to you
are available in the public directly from the vendors own websites and
you will see that they are the real files not some possibly hacked
version.

While we don't know that pcbutts1 has compromised the files, do you
really want to take the chance with your computer / date? Would you
trust a poster that changes his nickname every day, that is shunned by
the community, that is banned by Microsoft from posting directly on
their servers?

Nothing pcbutts1 could provide you is unique to his site, some of it is
stolen works for other vendors, some of it is hosted against the vendors
permission (all of this has been posted here).

If you run the malware removal tools that others have pointed you too,
run them in SAFE MODE, your problem should be solved without having to
resort to getting files from some unknown, possibly hacked, site.

 

[Leythos]

** Please note that I am the author of the above programs and sites and I do
have a vested interest in Super Ad Blocker, SUPERAntiSpyware and
FileResearchCenter.com. You, the user, have no obligation to purchase the
software and are free to try the software, clean/fix your system, and then
uninstall.

Hey Nick, I can live with this method of posting, even if I still
consider it spam, but at least you've been nice enough to indicate that
you have a vested interest in the product. I won't complain about it
while you use this in the sig.

 

[Aquafina]

You ever notice how much smoother these newsgroups operate when the stalkers
and trolls like you don't know what name I post under. BTW your winfixer
tool is crap, it takes way too long, it's too intrusive, it crashes if you
try to cancel or close it, and it deletes files not associated with
Winfixer. It's CRAP!

 

[deebs]

Hey Nick, I can live with this method of posting, even if I still
consider it spam, but at least you've been nice enough to indicate that
you have a vested interest in the product. I won't complain about it
while you use this in the sig.

I'd like to echo the sentiment expressed here.

There's nothing worse IMHO than spam and apammers.

On the other hand someone involved in sales and promotion acting with
integrity and honesty = Hey! A brand new world?

I am all for integrity and honesty wherever it is found