vundo

Trojan.Vundo free Removal Tool was designed to remove the infections of Trojan.Vundo

If you are on a network or have a full-time connection to the Internet, such as a DSL or cable modem, disconnect the computer from the network and Internet.

Disable or password-protect file sharing, or set the shared files to Read Only, before reconnecting the computers to the network or to the Internet.

Because this worm spreads by using shared folders on networked computers, to ensure that the worm does not re-infect the computer after it has been removed, Symantec suggests sharing with Read Only access or by using password protection.

This tool is designed to remove the infections of Trojan.Vundo.B.

Trojan.Vundo.B Free Removal Tool does the following:

- Terminates the Trojan.Vundo.B processes
- Deletes the Trojan.Vundo.B files
- Deletes the registry values that the Trojan added

Follow these steps to download and run the tool:

- Download the FxVundoB.exe file
- Save the file to a convenient location, such as your Windows desktop.
Optional: To check the authenticity of the digital signature, refer to the "Digital signature" section later in this writeup.

Note: If you are sure that you are downloading this tool from the Security Response Web site, you can skip this step. If you are not sure, or are a network administrator and need to authenticate the files before deployment, follow the steps in the "Digital signature" section before proceeding with step 4.

- Close all the running programs.
If you are on a network or if you have a full-time connection to the Internet, disconnect the computer from the network and the Internet.
If you are running Windows Me or XP, turn off System Restore.

- Locate the file that you just downloaded.
Double-click the FxVundoB.exe file to start the removal tool.
Click Start to begin the process, and then allow the tool to run.

- Restart the computer.
- Run the removal tool again to ensure that the system is clean.
If you are running Windows Me/XP, then reenable System Restore.
If you are on a network or if you have a full-time connection to the Internet, reconnect the computer to the network or to the Internet connection.

This tool will scan and remove W32.Vundo spyware from your computer.

Removal Instructions for Vundo Trojan:
- You must have Spyware Detector installed on your computer before running the Vundo Fix.
- Download and unzip the SDVundoFix.Zip on your desktop.
- Run SDVundoFix.exe, by double clicking on the file.
- Follow the instructions on the Dialog to scan your computer for Vundo Trojan.
- If the tool finds Vundo infection on your computer, it asks for restart.
- Click Yes, to allow VundoFix tool to restart your computer.
- After restart scan your computer with Spyware Detector to clean the remains of Vundo.
- Click on the Export Worm button in Spyware Detector and send us report with the reference to this SDVundofix and we can review and get back to you if Vundo was completely removed from your computer.

VundoFix.exe is a removal tool developed to remove Virtumonde infections. To use VundoFix follow the instrctions written below:
· Please download VundoFix.exe to your desktop.
· Double-click VundoFix.exe to run it.
· Put a check next to Run VundoFix as a task.
· You will receive a message saying vundofix will close and re-open in a minute or less. Click OK
· When VundoFix re-opens, click the Scan for Vundo button.
· Once its done scanning, click the Remove Vundo button.
· You will receive a prompt asking if you want to remove the files, click YES
· Once you click yes, your desktop will go blank as it starts removing Vundo.
· When completed, it will prompt that it will shutdown your computer, click OK.
· Turn your computer back on.

VundoFix.exe is a removal tool developed to remove Virtumonde infections.

To use VundoFix follow the instrctions written below:
· Please download VundoFix.exe to your desktop.
· Double-click VundoFix.exe to run it.
· Put a check next to Run VundoFix as a task.
· You will receive a message saying vundofix will close and re-open in a minute or less. Click OK
· When VundoFix re-opens, click the Scan for Vundo button.
· Once its done scanning, click the Remove Vundo button.
· You will receive a prompt asking if you want to remove the files, click YES
· Once you click yes, your desktop will go blank as it starts removing Vundo.
· When completed, it will prompt that it will shutdown your computer, click OK.
· Turn your computer back on.

VundoFix description
A removal tool developed to remove Virtumonde infections VundoFix.exe is a removal tool developed to remove Virtumonde infections.

To use VundoFix follow the instructions written below:
· Please download VundoFix.exe to your desktop.
· Double-click VundoFix.exe to run it.
· Put a check next to Run VundoFix as a task.
· You will receive a message saying vundofix will close and re-open in a minute or less. Click OK
· When VundoFix re-opens, click the Scan for Vundo button.
· Once its done scanning, click the Remove Vundo button.
· You will receive a prompt asking if you want to remove the files, click YES
· Once you click yes, your desktop will go blank as it starts removing Vundo.
· When completed, it will prompt that it will shutdown your computer, click OK.
· Turn your computer back on.

BHT was designed to be a compilation of utilities that will help you solve computer problems and also fix spyware and virus infections.

How to use: Download the above file. Extract to a folder somewhere convenient.

Run UniUpdate.cmd, and type option 1. Wait a while for BHT to download and build.

If you would like to create an Extended BHT disc, after building BHT, select option 4 - wait a little while, and let it build. It will auto-create the ISO, which you can burn with ImgBurn, or any other burner program that supports Image Burning.



Whats included?

APPS

RUN
· Fabs Autobackup for Windows - Free backup application that gets the job done in 3-15 clicks. Highly recommended for quick-backup use.
· Micro CD Burner 5.x - Free, single-file-based CD burning application (audio/data/ & dvd/cd)
· MiniAIM v0.4 Beta - Latest version of the miniature AOL IM app
· Power Defragmenter GUI - Free Defragment app based on Sysinternals Contig Defragment engine
· PuTTY - SecureSHell & Telnet client software
· Startup Control Panel - An enhanced msconfig-like startup program utility
· Unstoppable Copier v2.x - Free and Easy corrupted file copier.

INSTALL
· AIM AdHack - AIM v4.9 installer w/o spyware
· AIM AdHack - AIM Triton-beta IM Client w/o spyware
· BurnAtOnce - Free CD Imaging and Burning application. Can create ISO, BIN/CUE, and TOC images.
· Context Menu Editor - allows you to edit your right-click context menu
· Daemon Tools x86 - DVD/CD emulation software, new version - WARNING: When installing, be sure to uncheck the DaemonTools Toolbar, if you dont want any Adware installed!!!
· .NET Framework 2.0 - Latest version of .NET, for running BHT Launcher
· DVD Decrypter - Free DVD Copying software
· Firefox - Alternative WebBrowser made by the Mozilla Foundation
· Java Runtime Environment - Framework software to run Java-based applications
· K-Lite Codec Pack [Basic] - A small, efficient audio/video codec pack
· Liveupdate- To ensure you have the latest updates for your Symantec products, install LiveUpdate v3.0
· Install Missing MSVC++/MSVB runtimes - contains controls and runtime binaries from Microsoft VC++ and Visual Basic
· MozBackup - Free Mozilla profile backup tool. Works with Netscape, Firefox, and Thunderbird in addition to Mozilla
· PhotoFiltre - free photo-manipulation software. Very useful for scanning.
· ImgBurn - from the author of DVD Decrypter, comes a free piece of software designed for burning DVD images and various other DVD tasks.
· Thunderbird - Alternative Email Client made by the Mozilla Foundation
· VideoLanClient (VLC) - Free Media player with its own codec libraries
· Yamipod - Free iPod music managment software. Does NOT Require iTunes to be installed. Runs on Win98SE and up.

UTILS

RUN
· Fabs Autobackup for Windows (PE) - Free application to backup data from a secondary or primary windows installation. Very easy to use, and very fast. Highly recommended
· CPU-Z - CPU frequency measurement and feature detection
· Dial-A-Fix - Free app that has many different fixes, including: Microsoft Installer service, Windows update repair, IE reinstall, and many others.
· EzPCFix - A free utility with many differnt mini-utilities to perform on the locally running registry, or another systems registry
· Filemon - Free Filesystem file monitor
· Free hex editor - A free hex editor
· Hoster 3.1 - HOSTS file viewer/editor
· Index.dat Scanner - View site history and cookies on a system
· ieFix - Reinstall and re-register IE dlls and Executables. Useful with IE corruption.
· Keyfinder Thingy Lite - Find your cdkeys.
· Killbox - a utility to delete locked files, and replace locked files, on reboot, or right now.
· NetAlyzer - Free app that allows you to collect network information. From the creator of Spybot Search & Destroy.
· PageDefrag - Defragment the Windows Pagefile, as well as other boot-time files. Changed to an SFX for easier use.
· PC-De-Crapifier - Detects and removes junk software installed by Dell and other manufactorers.
· PhotoRec(overy) - Free Data Recovery application from the creator of Testdisk. Recovers more than just photos.
· PSTools - Free commandline Process tools
· Prefetch Utility - Clear and set prefetch options/files
· Regalyzer - A custom RegEdit-style utility, from the author of Spybot Search & Destroy
· RegeditPE - A script that allows reading from and writing to a registry that is on another hard drive or OS installation
· Registry Monitor - Free Registry monitoring tool
· Restoration - Free file undeleter.
· SigVerify(XP) - File signature verification application for Windows XP
· SigVerify(9x) - File signature verification application for Windows 9x
· SIW - System information viewer
· Symantec Product Removal - SymNRT included, as well as a batch file and registry file which are used to remove Norton Antivirus 2005/2006 entirely. Included here because of the overabundance of NAV2006 issues
· TCPview - Free TCP/IP connection viewer
· Testdisk - Free Partition recovery software
· Undead Pixel - A free utility to try and find, and fix dead pixels in LCD displays
· UnknownDevices - Find the correct drivers for harware with Question marks in device manager
· Windows File Protection Switcher - Toggle Windows File Protection on and off with this free tool from tcmagazine
· Winsock Restoration util - Fixes corrupt TCP/IP stack problems.
· Winsock-Fix - TCP/IP Stack corruption fix. Re-registers TCP/IP protocol files in XP/9x.
· UXTheme.dll Patcher - Allows Un-Signed Windows XP Themes
· Windows File Protection Switcher - Disables/Enables Windows File Protection.

INSTALL
· 7zip - Free Archiving Utility.
· Belarc Advisor - Computer Profile creation software. Great for retrieving CDKeys.
· CCleaner - Temporary and Junk file remover, Registry cleaner
· DriveImage XML - Free Drive Imaging software
· ERuNT/NTREGOPT - Registry Backup tool/Registry Optimization tool
· Free hex editor v1.1 beta - A free hex editor (installer)
· NetStumbler - Free Wifi Network Monitor
· Prime 95 v24.14 - Free Burn-in/benchmarking app
· PCI FileRecovery - Free file recovery software
· RescueMe v1.5x - A free set of tools to scan for viruses, & spyware. Features full updating and downloading from the internet, as well as several direct-downloaded free antivirus, and firewall applications. Highly recommended for a Quick and Easy repair. Extract to a user-specified directory on system.
· TweakUI(XP) - Microsoft-issued tweaking utility for Windows XP
· TweakUI(9x) - Microsoft-issued tweaking utility for Windows 9x
· Unlocker - Used to unlock locked files in order to modify or delete them
· WinPCap - Free Packet Capturing Software (used with packet analyzers)
· WireShark (Ethereal for Win32) - Free Packet-sniffing/capturing utility

FAILSAFE Software (VirusSpy)

RUN
· ADSSpy - Alternative Data Stream object viewer/deleter.
· AutoRuns - Free tool from Sysinternals, allows configuration of all startup items, as well as shell extensions and various other hidden windows boot files.
· HijackThis! - A utility to remove hidden startup entries on a system (Scripts removed...finally)
· Process Explorer - Free Taskmanager-like processview for examing system processes.
· RootKitRevealer - Free tool to search for discrepancies and hidden data in the system registry. (Does not remove, only scans.)
· SilentRunners - Scan system for all auto-running applications/scripts on bootup. (Log file is in %username%Local SettingsTemp folder).
· StartupList - View all startup applications

Virus Removal Apps

INSTALL
· Avast Antivirus - Free antivirus scanner/runtime protection for Windows 9x/XP.
· AVG Free Edition - Free On-demand antivirus application
· HaxFix - A tool designed to search for, and remove files associated the the Hax spyware infection.

RUN
· AimFix - AOL IM virus remover for Win2000/XP
· BlackLight Beta - From F-Secure, a free root kit removing/discovering application.
· Floppy-E Removal Tools - Removes Floppy-E
· Nyxem-E Stopper - Removes Nyxem-E
· McAfee Stinger - Find and remove 55 viruses, trojans, and variants
· TrendMicro Sysclean - Free Antivirus scanner from TrendMicro. Requires Internet connection to download executable and virus pattern files.
· VundoFix - Removes new varients of the Vundo Trojan (VX2)
· WinK Rootkit Remover - Removes the WinK.sys Rootkit

Spyware Removal Apps

INSTALL
· Ad-Aware SE - Spyware Removal tool from Lavasoft
· AVG AntiSpyware - 30-day Spyware Removal tool trial from GriSoft (Formerly Ewido). Specializes in Trojans and spyware. After 14 days, it will continue to function, however, it will no longer have background scanning capabilities.
· SmitRem - Smitfraud Removal tool. Extract to Root drive and run RunThis.bat
· Spybot Search & Destroy - Spyware Removal tool from safer-networking.org
· Spybot Search & Destroy Definition Update - Updates Spybots Spyware definitions
· Spybot Search & Destroy Advanced Checking Library Update - Updates Spybots Scanning Engine
· Spybot Search & Destroy Advanced Tools Update - Updates Spybots advanced tools
· SpySweeper (Latest Trial) - v5.0.x - Free trial of Webroots Commercial spyware Scanner/Removal tool. Only allows for a system scan, no actual spyware removal.
· AntiSpyware Silent Installer - Quickly install CCleaner, AdAware + definitions, Spybot + definitions, and Windows Defender, in only 3-4 clicks.
· Microsoft Windows Defender (Beta2) - Free AntiSpyware tool from Microsoft

RUN
· AboutBuster - Remove About:Blank page infectionsAd-Aware SE (9x/XP) - Spyware Removal tool from Lavasoft (Auto extracts. Tested & runs on 9x/XP)
· CWShredder - Remove CoolWebSearch-based spyware using this tool from TrendMicro
· E2TakeOut - Removes E2 Malware infections
· LSPfix - Displays all the installed Winsock filters
· Qoofix - Removes Qoologic Spyware infections
· Spybot Search & Destroy (9x/XP) - Spyware Removal tool from safer-networking.org (SFX-Runs on 9x/XP!)
· SpywareStrike Removal tool - Removes SpywareStrike v2.5 and lower
· SmitFraudFix - Remove infections from SmitFraud.C spyware (For Win2k/XP Only)
· ViewPointKiller - Remove ViewPoint from your system. Note: May cause instability on systems that run AOL.
· X-Clean Micro - Free tool to quickly and easily detect and remove common spyware threats.
· X-Cleaner Free - A more complex version of the above tool. Also cleans temporary files.