Comments on: Trojan Vundo

By: audra

audra — Tue, 27 Oct 2009 05:00:27 +0000

I have SpyHunter3, which can locate the Trojan Vundo, but whenever you try to remove it, SH3 is unable to do so.
Qwik Fix’s rename-restart-delete method worked beautifully for me, but I do recommend running another virus scan afterwards. For some reason, there were still a few files (but not registries) linked to the Trojan that SH3 found (and could actually remove, since the original registry was gone). Just a helpful hint. :)

By: Remove Invitation Card.zip (Removal Instructions) | 411 on Spyware

Remove Invitation Card.zip (Removal Instructions) | 411 on Spyware — Fri, 26 Jun 2009 19:44:09 +0000

[...] If you open this Invitation Card.zip attachment, you’ll launch W32.Ackantta.B@mm, a worm that will copy itself to your removable drives and shared folders, then spam your other friends. W32.Ackantta.B@mm then may download a Trojan onto your machine, such as Trojan Vundo. [...]

By: Leo

Leo — Thu, 01 Jan 2009 06:29:08 +0000

Hey Qwik Fix and Tom – great advice. My only problem is when I try to modify one of the files I get an error messge that the file is being used by another program and I can’t change it. I even tried closing each application one by one and trying to change the file name after each close – eventually the computer got too unstable and shut down.

Any ideas????

By: » The Effect of Having Multiple Fake Antivirus on your Computer DAMN TROJAN

» The Effect of Having Multiple Fake Antivirus on your Computer DAMN TROJAN — Mon, 13 Oct 2008 02:41:24 +0000

[...] Heres the Trojan Vundu removal instructions. [...]

By: sara

sara — Mon, 08 Sep 2008 16:43:23 +0000

I got a vundo trojan infection about a month ago on the laptop I use for researches online. I tried all the tricks and blah blah blah but non worked. I surrendered and formatted the Hard Disk.
Now, I’m having the same issues again on the laptop AND one the brand new desktop I do not use at all for “web wandering”. Did it “hopped” on the desktop computer from the previously-infected-now-apparently-recovered laptop???
Odd thing, 2 days ago I installed Firefox again on both computers. And the problems showed up again, on every browser I have (IE, Opera, Firefox). I may start thinking the Firefox dudes got their super-safe/super-fast/free browser hacked or something…
I really don’t know what to do. I may start over with the tricks and manual removal procedures, but I’m really really REALLY sick of it all. I use the computers for work and now the laptop can be dumped. Apparently, not even formatting solved the problem.
Should I dump the brand new desktop computer too???
*sigh sigh*

By: Tom

Tom — Tue, 08 Jul 2008 04:45:09 +0000

The easiest way to remove the vundo trojan is to:

1. run windows defender which will pick up the trojan but will not allow you to delete it
2. windows defender will give you the registry value which starts vundo
3. modify, DO NOT DELETE IT, the entry by changing the name of the .dll file at the end. if you hit the delete button on this registry entry it will just regenerate and be there again when you refresh the registry
4. you will get an error that says this .dll cannot be started
5. restart your computer
6. run windows defender again and this time when it picks up the .dll files hit delete
7. you’re done or YOU WIN!!!!!! as Qwik Fix put it.

By: Qwik Fix

Qwik Fix — Thu, 12 Jun 2008 10:47:45 +0000

Update to my last post…. Since I am too nerdy and patient for my own good, I think I have solved the riddle of the Trojan Vundo for free with very little effort once you track the files and keys:

1st (skip if you know the files )DL the demo of SpyNoMore and make sure you update it and wait for the update to complete so that it can seek the Vundo.
** or if you keep constant track of your “msconfig” startups & “regedit” runs like I do, you can find them with ease..
Once you isolate the file that is located in your “system32″ folder, find it and rename it with a different extention such as .rar
The just restart your computer.. you will get an error that was looking for that renamed .dll “click ok”
NOW return to the “system32″ folder… You can now delete the file that you renamed…

YOU WIN!!!!!

By: Qwik Fix

Qwik Fix — Thu, 12 Jun 2008 10:31:46 +0000

If you can locate the specific .dll that is causing the problem in your system32 file.. “Rename it” with a different extention such as .rar or something.. then restart your system and you will see an error every startup until you can resolve the issue…

By: Kristen

Kristen — Mon, 09 Jun 2008 17:56:55 +0000

… because the vundo virus has wreaked havoc on my settings when i try to download a scan i cant get to it. After it asked me “run/save” it asks where to “run/save” it to… after that i cant get into anything! So how do I get into what i need.

By: tom

tom — Mon, 07 Apr 2008 16:54:55 +0000

My Symantec Antivirus finds the trojan vundo but can’t get rid of it. i also tried the steps you said above to manually remove it and it won’t work. it says that the Value isn’t set or something when i try. I’ve also tried getting rid of it using a spyware program called hijack this i think and none of its working is there anything else i can do?