Trojan Win32/Vundo.gen!R

[dinamo74]

Every time I use Defender to scan it shows Trojan Win32/Vundo.gen!R and yet
it will not quarantine or remove the trojan even though I have tried to do
this numerous times.



Category:

Trojan

Description:

This program displays advertisements and may be difficult to remove.

Advice:

Remove this software immediately.

Resources:

clsid:

HKLM\SOFTWARE\CLASSES\CLSID\{c94ed871-ab2b-46c1-a6dc-24329423e51b}

regkey:

HKLM\SOFTWARE\CLASSES\CLSID\{c94ed871-ab2b-46c1-a6dc-24329423e51b}

file:

C:\windows\system32\vwesnkrr.dll

file:

C:\windows\system32\sihicx.dll

file:

C:\windows\system32\rdprnilo.dll

file:

C:\windows\system32\pylydwda.dll

file:

C:\windows\system32\gvwsenmg.dll

file:

C:\windows\system32\fusjjwrw.dll

file:

C:\windows\system32\fgwwox.dll

file:

C:\windows\system32\ejdyykup.dll

file:

C:\windows\system32\eiiwvgoa.dll

file:

C:\windows\system32\dhxlgp.dll

file:

C:\windows\system32\bqlecnqe.dll

file:

C:\windows\system32\akrtiy.dll

file:

C:\windows\system32\adnyogew.dll

 

[Dave M]

If you've tried using Windows Defender in SAFE mode to run a Full scan, and
this Trojan still remains detected but not removed, you should contact
Microsoft's PC Safety for no charge removal assistance:

http://www.microsoft.com/protect/support/default.mspx

 

[Engel]

Hello dinamo74,

In addition to Dave's excellent advice, please submit such suspicious files
to the Microsoft Malware Protection Center:
<https://www.microsoft.com/security/portal/submit.aspx>


Good luck
-=-

 

[Rebel28]

If you've tried using Windows Defender in SAFE mode to run a Full scan, and
this Trojan still remains detected but not removed, you should contact
Microsoft's PC Safety for no charge removal assistance:

http://www.microsoft.com/protect/support/default.mspx

 

[Rebel28]

Whenever I try run defender it says this:

Windows Defender ecountered an error: 0x80501001. One or more
actions could not be completed sucessfully.
And when I search it on Help and Support, It gives me links to this site.
and Event Viewer.

 

[Dave M]

Rebel28
This 0x80501001 error is reported during a full scan correct? Is it
possibly inside an archived (zipped) file, or within the system volume
information area, or within a mail store? If it can be located, perhaps by
using Event Viewer, can you either manually clean or delete this file.
Another possibility is to uncheck the scan inside archived files/folders
option in Windows Defender Tools > Options.

See this document for further information on this error:
http://www.microsoft.com/communitie...a2c2&mid=38738a37-cb53-473c-8c89-e3e23d31a2c2