Comments on: Trojan Vundo

By: » The Effect of Having Multiple Fake Antivirus on your Computer DAMN TROJAN

» The Effect of Having Multiple Fake Antivirus on your Computer DAMN TROJAN — Mon, 13 Oct 2008 02:41:24 +0000

[...] Heres the Trojan Vundu removal instructions. [...]

By: sara

sara — Mon, 08 Sep 2008 16:43:23 +0000

I got a vundo trojan infection about a month ago on the laptop I use for researches online. I tried all the tricks and blah blah blah but non worked. I surrendered and formatted the Hard Disk.
Now, I’m having the same issues again on the laptop AND one the brand new desktop I do not use at all for “web wandering”. Did it “hopped” on the desktop computer from the previously-infected-now-apparently-recovered laptop???
Odd thing, 2 days ago I installed Firefox again on both computers. And the problems showed up again, on every browser I have (IE, Opera, Firefox). I may start thinking the Firefox dudes got their super-safe/super-fast/free browser hacked or something…
I really don’t know what to do. I may start over with the tricks and manual removal procedures, but I’m really really REALLY sick of it all. I use the computers for work and now the laptop can be dumped. Apparently, not even formatting solved the problem.
Should I dump the brand new desktop computer too???
*sigh sigh*

By: Tom

Tom — Tue, 08 Jul 2008 04:45:09 +0000

The easiest way to remove the vundo trojan is to:

1. run windows defender which will pick up the trojan but will not allow you to delete it
2. windows defender will give you the registry value which starts vundo
3. modify, DO NOT DELETE IT, the entry by changing the name of the .dll file at the end. if you hit the delete button on this registry entry it will just regenerate and be there again when you refresh the registry
4. you will get an error that says this .dll cannot be started
5. restart your computer
6. run windows defender again and this time when it picks up the .dll files hit delete
7. you’re done or YOU WIN!!!!!! as Qwik Fix put it.

By: Qwik Fix

Qwik Fix — Thu, 12 Jun 2008 10:47:45 +0000

Update to my last post…. Since I am too nerdy and patient for my own good, I think I have solved the riddle of the Trojan Vundo for free with very little effort once you track the files and keys:

1st (skip if you know the files )DL the demo of SpyNoMore and make sure you update it and wait for the update to complete so that it can seek the Vundo.
** or if you keep constant track of your “msconfig” startups & “regedit” runs like I do, you can find them with ease..
Once you isolate the file that is located in your “system32″ folder, find it and rename it with a different extention such as .rar
The just restart your computer.. you will get an error that was looking for that renamed .dll “click ok”
NOW return to the “system32″ folder… You can now delete the file that you renamed…

YOU WIN!!!!!

By: Qwik Fix

Qwik Fix — Thu, 12 Jun 2008 10:31:46 +0000

If you can locate the specific .dll that is causing the problem in your system32 file.. “Rename it” with a different extention such as .rar or something.. then restart your system and you will see an error every startup until you can resolve the issue…

By: Kristen

Kristen — Mon, 09 Jun 2008 17:56:55 +0000

… because the vundo virus has wreaked havoc on my settings when i try to download a scan i cant get to it. After it asked me “run/save” it asks where to “run/save” it to… after that i cant get into anything! So how do I get into what i need.

By: tom

tom — Mon, 07 Apr 2008 16:54:55 +0000

My symantec Antivirus finds the trojan vundo but can’t get rid of it. i also tried the steps you said above to manually remove it and it won’t work. it says that the Value isn’t set or something when i try. I’ve also tried getting rid of it using a spyware program called hijack this i think and none of its working is there anything else i can do?

By: Joe

Joe — Sun, 08 Jul 2007 01:42:46 +0000

I’ve deleted the offensive registry found by spyhunter; however, there is a lingering Trojan.Vundo file (object item is a string of numbers and letters) that was found in my cscdll.dll. I understand that the cscdll.dll should not be deleted, but I’m not sure how it is related to the Trojan.Vundo file. Nothing else has been found (except for a few cookies which I have zapped). Could someone please explain and tell me how (if necessary) to get rid of the file? By the way, a search for the file through MS search feature did not work. Thanks.

By: clement

clement — Tue, 03 Jul 2007 11:25:50 +0000

please whats the trojan registry name…..

By: Caeruleaus

Caeruleaus — Thu, 28 Jun 2007 08:14:29 +0000

The reason it keeps coming back after you remove the file is because it creates a registry that norton antivirus doesnt check. The registry tells the computer to recreate a new file every time you restart your comp or restart your internet explorer. If you want to remove it you must find all registries associated with this virus and remove them. If you read the guide above, the software it tells you to download checks the registries for you. It should remove all necessary files.