Trojan.Vundo.H virus, OMG what a pain

[Green Sub]

I make a living out of servicing computer networks and have probably cleaned about 300 systems of malware the last 4 years. Last night I thought I had met my match.

I typically remove the infected hard drive and mount it on my test system as a secondary and run all the good stuff on the now D: drive. Malwarebytes, AVG, Spysweeper, several others, and temp folder cleanup. This usually kills all infected files and then there is just registry scans after the drive is mounted back in the original system.

Last night was the first time this didn't work. Trojan.Vundo.H virus kept popping up. Well I finally found several references to Combofix and it did the job. bleepingcomputer.com doesn't give a lot of detail on how Combofix works, but it does install Microsoft Recovery Console if it's not already there.

Anyway, hope this helps someone.

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

EDIT: One sign of real trouble was that the infected Windows XP box would not start up in Safe Mode, but no problem starting normally.

[idk01]

Sounds like you've been having the same fun Barry :banghead: I found a mix of all the usual's with avp tool in there for god measure, I always have a thumbdrive with all the updated stuff including combofix, luckily this thumbdrive has a write protect switch which makes it super handy too.

I've been a member on Bleepingcomputer for quite a while now, I hardly need to post there as the answer is always available :-) has been a life saver many times :thumbsup:

[Bullyterrier]

I'm no comp whizz far from it, and a couple of months ago I received an email from my brother in law saying I must have a virus on my pc as I was sending out spam email. I went to run my kaspersky anti virus and founed that some functions had been disabled. I tried updating it and restarting pc but no good. I got hold of my mate that came around the following day, he is more comp savvy than me, and he couldn't remove it. I ended up waiting for my windows 7 to arrive and completely wiping my pc and doing a complete install of 7. I don't know what it was but it was a sod to sort out, and for it to disable my antivirus as well.

[idk01]

I'm no comp whizz far from it, and a couple of months ago I received an email from my brother in law saying I must have a virus on my pc as I was sending out spam email. I went to run my kaspersky anti virus and founed that some functions had been disabled. I tried updating it and restarting pc but no good. I got hold of my mate that came around the following day, he is more comp savvy than me, and he couldn't remove it. I ended up waiting for my windows 7 to arrive and completely wiping my pc and doing a complete install of 7. I don't know what it was but it was a sod to sort out, and for it to disable my antivirus as well.

I have seen some real nasty things that play havoc with quite a few of the more popular virus suites, its rare that one gets past me, but there has been one or two, there comes a time if its going to take too long to fix, back up the critical data, format and reinstall. I find myself spending way too much time on the removal process, but its usually less than reinstall everything :-)

[mikey]

I purchased a laptop running XP think it compaq from a flea market. It was heavily infected with spyware and malware. I took it back to the seller and all he did was delete files over and over again and charged me $40! I took to Geek Squad and I have 500,000 infection spyware/malware/trojans combined. They told me to toss it in the trash. I ordered Vista upgrade and ran it actually a clean install and the Compq was fine. Sold it after months of bad advice and no solutions. The seller probably put that stuff on the harddrive.

[Dr.B]

Thank you!!!!

[Saxon007]

I ran into Trojan.Vundo.H virus a few months back and had the same issues. The virus was re-installing via a rootkit (if you get a Windows warning that the file system has problems that is a clue). What a pain. :dummy::dummy:

Combofix rocks. :thumbsup:

[vh_bu98]

Did you try superantispyware?

I work for a MSP so I know your pain. Malware has been pretty bad this year and it's a pain to clean. The time it takes to clean a machine, it could be reformatted with a clean OS.

[idk01]

Did you try superantispyware?

I work for a MSP so I know your pain. Malware has been pretty bad this year and it's a pain to clean. The time it takes to clean a machine, it could be reformatted with a clean OS.

Agreed :thumbsup: and in a few cases its been the only way, steadystate has been a life saver for a few companies I do work for :-)