Please help remove vundo.h

knasky · November 3, 2008

I've tried numerous software, but it keeps coming back! Malwarebytes is the only scan that even picks it up. But like others have posted, after quarantine/deletion/reboot, it's back again (and again...) Any help would be greatly appreciated. Thanks so much. (Panda results soon to follow.)

Malwarebytes' Anti-Malware 1.29

Database version: 1286

Windows 5.1.2600 Service Pack 3

11/2/2008 8:56:01 PM

mbam-log-2008-11-02 (20-55-53).txt

Scan type: Quick Scan

Objects scanned: 56692

Time elapsed: 13 minute(s), 55 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 1

Registry Keys Infected: 7

Registry Values Infected: 0

Registry Data Items Infected: 2

Folders Infected: 0

Files Infected: 6

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

G:\WINDOWS\system32\urqOHAPj.dll (Trojan.Vundo.H) -> No action taken.

Registry Keys Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{fda4433b-1394-4708-a941-50e658121bc7} (Trojan.Vundo.H) -> No action taken.

HKEY_CLASSES_ROOT\CLSID\{fda4433b-1394-4708-a941-50e658121bc7} (Trojan.Vundo.H) -> No action taken.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> No action taken.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> No action taken.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> No action taken.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> No action taken.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> No action taken.

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo.H) -> Data: g:\windows\system32\urqohapj -> No action taken.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo.H) -> Data: g:\windows\system32\urqohapj -> No action taken.

Folders Infected:

(No malicious items detected)

Files Infected:

G:\WINDOWS\system32\urqOHAPj.dll (Trojan.Vundo.H) -> No action taken.

G:\WINDOWS\system32\jPAHOqru.ini (Trojan.Vundo.H) -> No action taken.

G:\WINDOWS\system32\jPAHOqru.ini2 (Trojan.Vundo.H) -> No action taken.

G:\WINDOWS\system32\tcpyjmwd.dll (Trojan.Vundo.H) -> No action taken.

G:\WINDOWS\system32\dwmjypct.ini (Trojan.Vundo.H) -> No action taken.

G:\WINDOWS\system32\hmvsquss.dll (Trojan.Vundo.H) -> No action taken.

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 8:26:53 PM, on 11/2/2008

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16735)

Boot mode: Normal

Running processes:

G:\WINDOWS\System32\smss.exe

G:\WINDOWS\system32\winlogon.exe

G:\WINDOWS\system32\services.exe

G:\WINDOWS\system32\lsass.exe

G:\WINDOWS\system32\svchost.exe

G:\Program Files\Windows Defender\MsMpEng.exe

G:\WINDOWS\System32\svchost.exe

G:\Program Files\Lavasoft\Ad-Aware\aawservice.exe

G:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

G:\Program Files\Alwil Software\Avast4\ashServ.exe

G:\WINDOWS\Explorer.EXE

G:\WINDOWS\system32\spoolsv.exe

G:\Program Files\Bonjour\mDNSResponder.exe

G:\WINDOWS\eHome\ehRecvr.exe

G:\WINDOWS\eHome\ehSched.exe

G:\Program Files\MozyHome\mozybackup.exe

G:\WINDOWS\system32\svchost.exe

G:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe

G:\WINDOWS\ehome\ehtray.exe

G:\Program Files\Windows Defender\MSASCui.exe

G:\WINDOWS\stsystra.exe

G:\WINDOWS\system32\hphmon04.exe

G:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

G:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

G:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe

G:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe

G:\Documents and Settings\Kevin\Local Settings\Application

Data\Google\Update\GoogleUpdate.exe

G:\WINDOWS\system32\ctfmon.exe

G:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

G:\Program Files\MozyHome\mozystat.exe

G:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

G:\Program Files\Alwil Software\Avast4\ashWebSv.exe

G:\WINDOWS\system32\dllhost.exe

G:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe

G:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe

G:\Documents and Settings\Kevin\Local Settings\Application

Data\Google\Chrome\Application\chrome.exe

G:\Documents and Settings\Kevin\Local Settings\Application

Data\Google\Chrome\Application\chrome.exe

G:\Program Files\Webroot\Spy Sweeper\SSU.EXE

G:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =

http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =

http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =

http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =

http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet

Settings,ProxyOverride = *.local

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88}

- (no file)

O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} -

G:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll

O3 - Toolbar: Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} -

G:\Program Files\Adobe\/Adobe Contribute CS3/contributeieplugin.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - g:\program

files\google\googletoolbar1.dll

O4 - HKLM\..\Run: [ehTray] "G:\WINDOWS\ehome\ehtray.exe"

O4 - HKLM\..\Run: [Windows Defender] "G:\Program Files\Windows

Defender\MSASCui.exe" -hide

O4 - HKLM\..\Run: [sigmatelSysTrayApp] stsystra.exe

O4 - HKLM\..\Run: [HPHmon04] G:\WINDOWS\system32\hphmon04.exe

O4 - HKLM\..\Run: [Google Desktop Search] "G:\Program Files\Google\Google

Desktop Search\GoogleDesktop.exe" /startup

O4 - HKLM\..\Run: [iSUSPM Startup] "G:\Program Files\Common

Files\InstallShield\UpdateService\isuspm.exe" -startup

O4 - HKLM\..\Run: [avast!] G:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [spySweeper] "G:\Program Files\Webroot\Spy

Sweeper\SpySweeperUI.exe" /startintray

O4 - HKCU\..\Run: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]

"G:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"

O4 - HKCU\..\Run: [Google Update] "G:\Documents and Settings\Kevin\Local

Settings\Application Data\Google\Update\GoogleUpdate.exe" /c

O4 - HKCU\..\Run: [ctfmon.exe] "G:\WINDOWS\system32\ctfmon.exe"

O4 - HKCU\..\Run: [spybotSD TeaTimer] "G:\Program Files\Spybot - Search &

Destroy\TeaTimer.exe"

O4 - HKCU\..\Run: [uniblue SpeedUpMyPC] "G:\Program

Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe" -s

O4 - Global Startup: MozyHome Status.lnk = G:\Program

Files\MozyHome\mozystat.exe

O8 - Extra context menu item: Add to Google Photos Screensa&ver -

res://G:\WINDOWS\system32\GPhotos.scr/200

O8 - Extra context menu item: Append to existing PDF - res://G:\Program

Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convert link target to Adobe PDF -