Comments on Gibdon Moon: Getting Rid of Vundo and Pop-Ups

One of my co-workers had this on her computer and ...

2009-10-30T11:16:40.549-07:00

One of my co-workers had this on her computer and none of the programs listed on bleepingcomputer could fix it. The computer blue screened when try to get into SafeMode, I couldn't get into regedit and I couldn't delete any of the entries in HiJack This. I followed your suggestions and loaded Windows Recovery Console and deleted the bad dll files that way - all fixed now :) I think I owe you a beer!

Neil, your suggestion worked Great!!! Thank you so...

2008-12-13T14:24:00.000-08:00

Neil, your suggestion worked Great!!! Thank you so much!

Dang I just spent nearly an hour actually g...

2008-11-24T20:17:00.000-08:00

Dang I just spent nearly an hour actually getting rid of frickin' Vundo. It's insanely simple once you know what to do, but the problem is a lot of sources give you bad information. Here's the low-down:

1.) View C:\WINDOWS\System32 in Explorer sorted by "Created Date" to find the Vundo DLL's which should be very recent assuming you caught this early enough. Its DLL names are always an 8 character assortment of upper and lower-case letters.

2.) Write down the names of said files.

3.) Boot off your Windows XP CD. To do this put it in your drive, restart, and pay attention ... your computer should say something like "Press any key to boot from CD-ROM".

4.) After waiting 4-EVA for the CD to "start Windows", select the "Recovery Console" option. You'll need to type in your Administrator password so I hope you have it handy.

5.) Type "CD \WINDOWS\System32" (without the quotes) and then for each file you wrote down type "DEL blahblah.dll" (where blahblah is the file name).

6.) Type "EXIT" to restart your computer and this time don't boot from the CD.

7.) Once back in Windows, you should be able to clean out the registry entries left behind without them constantly re-appearing. Basically just run "REGEDIT" and do a search for those file names in the registry, deleting any place they show up. If you have some sort of utility to check for "Windows Errors" then it will do this for you.

--

The problem I was having is that since Vundo hooks into WinLogon, NONE of the solutions I found worked 100%. Sure they'd stop the BHO or pop-ups, but that main "kernel" of Vundo was still running. The delete-on-reboot utilities ran AFTER WinLogon and therefore would not delete it and I couldn't rename the files even in Safe Mode. Then I realized I was looking at it the wrong way, fighting the criminal from WITHIN their little cave rather than bombing it from outside. Good thing I kept those boot CD's around!

Wouldn't you know it, but nearly a year later and ...

2008-11-23T10:32:00.000-08:00

Wouldn't you know it, but nearly a year later and I got Vundo on my desktop. I launched Internet Explorer simply to test a website and I believe some malicious AD code installed it on my system. Using my own blog entry (this one) I removed it with HijackThis and in doing so I found that the URL to that in my post is no longer valid (fixing now).

The culprit this time?

O4 - HKLM\..\Run: [acfa1503] rundll32.exe "C:\WINDOWS\system32\wroovkbn.dll",b

In case it helps, it was launching THIS website:

http://www.premiercardoffers.com/?Mkt=674&SubMkt=1341&PID=1&BID=0&SourceID=YOUR_SOURCEID&jump=ap1

Yes I too have the same problem as your sister.It ...

2008-02-04T16:55:00.000-08:00

Yes I too have the same problem as your sister.It started happening after I had downloaded some MP3 files from Limewire.
The pop-up that appears at the bottom right hand corner is Malware. Just Google Advanced Cleaner and you'll see what I mean. Also known as Drive Cleaner as well.

Hi, this virus is running rampant this month and i...

2008-01-01T15:39:00.000-08:00

Hi, this virus is running rampant this month and it is a new strain of vundo that is very potent and corrupts many files. The only program that is currently able to completely remove it is called combofix You can download it through a site called bleepingcomputer.

After running combofix, if any important system files are quarantined you can reinstall them by taking the log file after combofix is done, renaming it log.txt, and dropping it into the rev icon on your desktop. This whole issue and these fixes are discussed on the avast antivirus forums.