Computer Hope
Software => Computer viruses and spyware => Topic started by: MarleneD on October 19, 2005, 10:29:26 PM
-
Hey everyone. I've got a virus warning that just won't go away! Norton alerts me to the virus over and over even though the removal tool I used says it didn't find it on my computer. What gives ???
Here's how it appears on the warning window:
Virus Name Trojan.Vundo.B
Action Taken Unable to Repair this fle
Action Taken Access to the file denied
How can I get rid of the warning window?
Thanks for your help.
-
Did you run the removal tool in safe mode?
http://securityresponse.symantec.com/avcenter/venc/data/trojan.vundo.b.removal.tool.html
-
MarleneD.......Did you shutdown your system restore and then run the removal tool in the safe mode ?
dl65 ::)
-
I actually tried to run it in safe mode but, when I was in safe mode I just had a black screen and didn't know how to get to the repair tool which I had orignially downloaded onto my desktop. Then, I didn't know how to get out of safemode. I ended up finding the system restore window and ran that going back a few days which brought me back to the regular window.
So, I guess what I need to know is how to get back out of safe mode ???
Do you all think I still have this virus on my computer?
By the way, I did shut off system restore to run the tool but I was not in safe mode.
-
MarleneD....If you had saved the removal tool to your desktop...it should have been there when you were in safe mode....you were able to see your desktop in safe mode weren't you ? To get out of safe mode.......simply reboot and you should go back to normal mode ....
dl65 ::)
-
Safe mode can sometimes take a long time to fully load, I don't know why this is because it should load faster than normal mode.
Anyway, did you give it long enough to load the icons & taskbar?
-
Maybe I didn't give it enough time to load the desktop. I will try again but I'm just a little afraid :-/ When you say reboot, is that the same as restart? When I restarted the computer it came back into safe mode ???
-
MarleneD...... reboot is the same as restart......
What O/S are you using ?
What happens if you repeatedly tap F8 as its restarting ...arent you given the option of selecting how you wish it to start ?
When in safe mode you should have the word safe displayed in each of the 4 corners ......and there will be no background shown .....the resolution will be differant . All of your normal desktop items will be shown.
dl65 ::)
-
I have Windows XP. Will try again now and report back what happens. Wish me luck.
-
Good luck....we're all counting on you.
-
O.k. gang,
So, I got into safemode by pressing F8. Black screen came up with no desktop. Brought up Task Manager (Ctl, Alt, Del) then navigated to my desk top (File, New Task, Browse button) and started the removal tool. After removal tool ran it reported that no trojan.Vundo.B had been detected. Then, I ran a full scan (Norton) in safemode, since I was already in that mode; again, through Task Manager. The scan revealed one virus - yes, that's right folks that Vundo.B bug! I deleted it, restarted and went back to normal mode but, I still got the same red flag virus alert message.
The Symantec website suggests that when persistent messages appear it could be that Windows may be using the file. Symantec also reccomended that if after using the scan in safemode and messages still appeared then the next step is to delete the value from the registry. Well, I still get the virus alert message so I guess that's my next step :-/
It gave some specific subkeys to delete:
HKEY_LOCAL_MACHINE\SOFTWATE\Microsoft\WindowsNT\CurrentVersion\Winlogon\Notify\[Trojan file name]
HKEY_LOCAL-MACHINE\SOFTWARE\Classes\CLSID\{44240BB5-BD7D-4D49-A1AA-8AB0F3D3CB44}
HKEY-LOCAL-MACHINE\SOFTWARE\Microsoft\Windows\urrentVersion\Explorer\Browser Je;[er Pbkects\{_44240BB5-BD7D-4D49-A1AA-8AB0F3D3CB44}
"Is it safe?" to delete?
-
Nothing to lose. Just backup your data in case of catastrophe.
I guess that is something to lose, though, isn't it?
-
Once it's fixed Marlene I'd be interested to know what real time protection you're using & if it's uptodate?
I thought you got your protection sorted out last time.
-
MarleneD.....I would be inclined to check the following before making the registry alterations......
1 make sure system restore is turned off .
2 go to control panel ....folder options and click view ......then make sure .......Show hidden files and folders is marked. Now click apply and ok.
3 Run a scan with your anti virus (make sure its up to date)
If its still there .......click start /Run .......in the run box type regedit and enter. when the registry editor opens ...click Edit , then Find .......in the "find what" box type Vundo then click Find next............let it search and it will take you directly that entry ......hilite it and right click and select delete .......now go back to the find what box .....and Vundo will still be entered ........so click find next again it will search until it either finds another entry or you will see the message ......finished searching through the registry. At this point go out reboot and see if things are ok.
dl65 ::)
-
Well, I finally got the alert window to disappear from everyone's log on except for mine (we each have our own log on windows in Windows XP). I'm very perplexed as to why it keeps popping up after I've run the removal tool , making sure I follow all instructions i.e. turn off system restore, run removal tool in safemode then scan in safemode etc. Then the result of the removal tool is always "trojan.vundo.b not found on computer". The result of the scan reveals 1 virus found (vundo) , I remove it and it always says that it was succesfully removed yet I still get that alert window!
BTW, it's curious to me that I still get a black screen in safemode with no desktop at all; only the word safemode on each corner and a sentence in the middle top screen (can't remember what it says). I click all around the screen and nothing happens. The only way to navigate to folders and files is through Task Manager which I just happen to try by Ctl-Alt-Del.
Running through the registry I found one key that said trojan.vundo.b and deleted it. The rest were anti-virus removal tool keys and still others did not say vundo at all even though the search was specific to vundo.
I have Norton Anti virus which came with my new computer (bought in May of 2005). I have a Dell 4700 Dimension.
Any other suggestions to remove this pesty alert window?
Thanks :)
-
You may be so badly FUBAR'ed that a complete reinstall would be in order. This should be followed by better prevention and maintenance.
A format and reinstall cures most Windows problems...for a while.
-
Just a quick note. I figured out, actually my husband did, that who ever logs on first gets that annoying pop up alert sign......curious. When switching to another user, the sign does not appear.
-
if you can live with that, then OK. If not, see above.
::) ::) ::) ::) ::) ::) ::) ::)
-
Well that means he must of installed something so it is effecting his account. It hasn't touch your account not yet anyways but open the wrong application and BOOM! Can't you scedual norton Antivirus to scan before windows loads? It can't delete it if the virus is causing the application to run. By the way the virus is still there even In your account so be very careful :-[
-
Did you scan & clean in safe mode with system restore turned off at the same time?
-
O.k., latest update: Ran the removal tool (which I downloaded for the 3rd time from Symantec) and ran it in safe mode with system restore turned off. This time the scan revealed the presence of the trojan.vundo.b and it's removal. All I had to do was reboot and it would eliminate it from the infected files. Well, I don't get the alert window on any of our log on's, so far.
I guess, I had to keep trying and trying until it finally removed it, I hope.
Thanks to all of you for your input and help :)
-
Don't forget to turn System Restore back on. ;)
-
Congrats...and way to stick with it!
patio. 8)
-
One more thing. When I downloaded the tool to clean up trojan.vundo I did name it differently when I saved it onto my desktop, just so I wouldn't confuse it with the other tools I had downloaded. Don't know if that made a difference in finally getting rid of :)
-
Oh, and yes FED I did clean and scan in safe mode with system restore off. And, I did turn the system restore back on. Thanks ;D
-
Once it's fixed Marlene I'd be interested to know what real time protection you're using & if it's uptodate?
I thought you got your protection sorted out last time.
-
If by "real time protection" you mean anti virus then I use Norton Internet Security 2005 Antispyware edition which includes anti-virus, anti-spam, and personal firewall. I also have Ad-Aware SE Personal and Ad-Watch SE Plus. Norton is set-up to automatically update but, I check for updates once a week just in case. The Ad-aware I run about every week and check for updates at that time.
-
Strange that Norton allowed it to infect your computer in the first place. ???
-
That's what my friend said FED. But, does an Alert box mean it's infected? It did detect it . Could it have been quaranteened? And, why did it take 3 attempts with the removal tool to finally get rid of it? Could it be that I named it differently the 3rd time? Curious, but glad it's done with!
-
MarleneD...... It's quite possible that Norton has quarantined .... open Norton , click reports and check the quarantine file .......or look in the activities log ....threat alerts ......it should all be listed there .
dl65 ::)