couple of things to try

http://sarc.com/avcenter/venc/data/trojan.vundo.removal.tool.html

http://forums.mcafeehelp.com/viewtopic.php?t=57049

Ken

Ken, Thanks for the reply but I already used the tool that you suggested and still is in the system. If anybody else have a suggestion I greatly appreciated it!

Thanks!

Mat

Message Edited by ky331 on 12-07-2005 10:04 AM

How's it going? thanks for replying! I hope this thing is gone from my computer soon! here is my VBG log, hopefully I did everything right!

[12/07/2005, 23:09:30] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\MATISON COSTA\Local Settings\Temporary Internet Files\Content.IE5\IL47YX8T\VirtumundoBeGone[1].exe" )
[12/07/2005, 23:09:48] - Detected System Information:
[12/07/2005, 23:09:48] -  Windows Version: 5.1.2600, Service Pack 2
[12/07/2005, 23:09:48] -  Current Username: MATISON COSTA (Admin)
[12/07/2005, 23:09:48] -  Windows is in NORMAL mode.
[12/07/2005, 23:09:48] - Searching for Browser Helper Objects:
[12/07/2005, 23:09:48] -  BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (AcroIEHlprObj Class)
[12/07/2005, 23:09:48] -  BHO 2: {4D25F921-B9FE-4682-BF72-8AB8210D6D75} ()
[12/07/2005, 23:09:48] - WARNING: BHO has no default name. Checking for Winlogon reference.
[12/07/2005, 23:09:48] -  Checking for HKLM\...\Winlogon\Notify\deSrcAs
[12/07/2005, 23:09:48] -  Key not found: HKLM\...\Winlogon\Notify\deSrcAs, continuing.
[12/07/2005, 23:09:48] -  BHO 3: {53707962-6F74-2D53-2644-206D7942484F} ()
[12/07/2005, 23:09:48] - WARNING: BHO has no default name. Checking for Winlogon reference.
[12/07/2005, 23:09:48] -  Checking for HKLM\...\Winlogon\Notify\SDHelper
[12/07/2005, 23:09:48] -  Key not found: HKLM\...\Winlogon\Notify\SDHelper, continuing.
[12/07/2005, 23:09:48] -  BHO 4: {5CA3D70E-1895-11CF-8E15-001234567890} (DriveLetterAccess)
[12/07/2005, 23:09:48] -  BHO 5: {B313D637-F405-4052-AC37-E2119AB3C8F8} (MSEvents Object)
[12/07/2005, 23:09:48] - ALERT: Found MSEvents Object!
[12/07/2005, 23:09:48] -  BHO 6: {BDF3E430-B101-42AD-A544-FADC6B084872} (CNavExtBho Class)
[12/07/2005, 23:09:48] - Finished Searching Browser Helper Objects
[12/07/2005, 23:09:48] - *** Detected MSEvents Object
[12/07/2005, 23:09:48] - Trying to remove MSEvents Object...
[12/07/2005, 23:09:50] -    Terminating Process: IEXPLORE.EXE
[12/07/2005, 23:09:50] -    Terminating Process: RUNDLL32.EXE
[12/07/2005, 23:09:50] -    Disabling Automatic Shell Restart
[12/07/2005, 23:09:50] -    Terminating Process: EXPLORER.EXE
[12/07/2005, 23:09:50] -    Suspending the NT Session Manager System Service
[12/07/2005, 23:09:50] -    Terminating Windows NT Logon/Logoff Manager
[12/07/2005, 23:09:51] -    Re-enabling Automatic Shell Restart
[12/07/2005, 23:09:51] -   File to disable: C:\WINDOWS\system32\jkklk.dll
[12/07/2005, 23:09:51] -  Renaming C:\WINDOWS\system32\jkklk.dll -> C:\WINDOWS\system32\jkklk.dll.vir
[12/07/2005, 23:09:51] -  File successfully renamed!
[12/07/2005, 23:09:51] -   Removing HKLM\...\Browser Helper Objects\{B313D637-F405-4052-AC37-E2119AB3C8F8}
[12/07/2005, 23:09:51] -   Removing HKCR\CLSID\{B313D637-F405-4052-AC37-E2119AB3C8F8}
[12/07/2005, 23:09:51] -   Adding Kill Bit for ActiveX for GUID: {B313D637-F405-4052-AC37-E2119AB3C8F8}
[12/07/2005, 23:09:51] -   Deleting ATLEvents/MSEvents Registry entries
[12/07/2005, 23:09:51] -   Removing HKLM\...\Winlogon\Notify\jkklk
[12/07/2005, 23:09:51] - Searching for Browser Helper Objects:
[12/07/2005, 23:09:51] -  BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (AcroIEHlprObj Class)
[12/07/2005, 23:09:51] -  BHO 2: {4D25F921-B9FE-4682-BF72-8AB8210D6D75} ()
[12/07/2005, 23:09:51] - WARNING: BHO has no default name. Checking for Winlogon reference.
[12/07/2005, 23:09:51] -  Checking for HKLM\...\Winlogon\Notify\deSrcAs
[12/07/2005, 23:09:51] -  Key not found: HKLM\...\Winlogon\Notify\deSrcAs, continuing.
[12/07/2005, 23:09:51] -  BHO 3: {53707962-6F74-2D53-2644-206D7942484F} ()
[12/07/2005, 23:09:51] - WARNING: BHO has no default name. Checking for Winlogon reference.
[12/07/2005, 23:09:51] -  Checking for HKLM\...\Winlogon\Notify\SDHelper
[12/07/2005, 23:09:51] -  Key not found: HKLM\...\Winlogon\Notify\SDHelper, continuing.
[12/07/2005, 23:09:51] -  BHO 4: {5CA3D70E-1895-11CF-8E15-001234567890} (DriveLetterAccess)
[12/07/2005, 23:09:51] -  BHO 5: {BDF3E430-B101-42AD-A544-FADC6B084872} (CNavExtBho Class)
[12/07/2005, 23:09:51] - Finished Searching Browser Helper Objects
[12/07/2005, 23:09:51] - Finishing up...
[12/07/2005, 23:09:51] - A restart is needed.
[12/07/2005, 23:09:51] - Automatic Reboot on STOP Error is not set. User will have to manually restart.
[12/07/2005, 23:10:02] - Attempting to Restart via STOP error (Blue Screen!)

Here is the FixVundo log but again I do not trust it's results!

Symantec Trojan.Vundo Removal Tool 1.5.0
The process "IEXPLORE.EXE" might be affected by the threat. It cannot be terminated.
The process "IEXPLORE.EXE" might be affected by the threat. It has been terminated.

C:\System Volume Information: (not scanned)

Trojan.Vundo has been successfully removed from your computer!

Here is the report:

The total number of the scanned files: 63713
The number of deleted files: 0
The number of viral processes terminated: 1
The number of viral threads terminated: 0
The number of registry entries fixed: 0

Log looks good.  The slowness may be a result of the new BHO that java installs.  Don't know what it does but there have been some complaints that it makes things slower.  You can probably live without it.

Close Internet Explorer and run Hijackthis (scan only) Check this line then Fix Checked.

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

It will be in the backup list if you ever feel you need to restore it.

Does it seem to work faster now?

Ron

Hey Ron! First, Happy New Year!

Sorry for not answering to the thread earlier but I spent quiet some time out of town! It seems working a little faster. I will forward any changes to you! Thanks again for all your help and hopefully my wife will keep away from those nasty viruses, keeping my fingers crossed!

Thanks,

Mat

OK.  My usual recommendations:

Make sure you have System Restore running (toggle it off and On today to get rid of any bad stuff it may have retained)
and then you can just go back to an earlier time if you hit a bad site.

http://www.microsoft.com/windowsxp/using/helpandsupport/learnmore/systemrestore.mspx

One way to make an infection more obvious is to check everything in your current HijackThis and Add to Ignore List then set up Hijackthis to run at boot and to show you if it finds anything new.

 
To avoid going to a bad site you might want to install IE-SpyAd and SpywareBlaster and make the other changes recommended at:.
http://www.mvps.org/winhelp2002/restricted.htm
I used to recommend Spybot's Immunize system but have recently learned it is not as good as the one at:
http://www.mvps.org/winhelp2002/hosts.htm

Always run a firewall.  The one in XP SP2 is pretty good tho I think the free one from Zone Alarm is better.

http://www.zonelabs.com/store/content/company/products/trial_zaFamily/trial_zaFamily.jsp?lid=home_freedownloads

Turn on Autoupdates so you always get the latest patches from Windows.

Never hurts to do one of the free on line scans from Panda or Trend.  They take a while but are pretty good.
www.pandasoftware.com/activescan/activescan.asp?
http://housecall.trendmicro.com/
In addition to Microsoft AntiSpy
http://www.microsoft.com/athome/security/downloads/default.mspx
I like to run Spybot S&D. 
http://www.safer-networking.org/en/download/index.html
Also like to run AdAware once in a while. 
http://www.lavasoftusa.com/software/adaware/

Get the latest version of
Java:
http://www.java.com/en/download/windows_automatic.jsp

 Make sure you have removed any older versions of Java or JRE  with Control Panel, Add/Remove Programs.  Updates do not remove the older versions which have exploitable flaws.

If you are not running the latest version of Adobe you should consider updating.  There are reports of a loophole for hackers in pre 7.03 versions.
As an alternative you can dump adobe completely and use fox-it instead:
http://www.foxitsoftware.com/pdf/rd_intro.php

Ron