Re: trojan vundo in system 32

From: "hucho" <hucho@xxxxxxxxxxxxxxxxxxxxxxxxx>

| norton found trojan.vundo in system32\ssssjokr.dll and is unable to repair
| and access denied i tried lippmans winfix scans in normal and safe mode they
| find ssssjokr.dll but report unable to open file and no fix or removal
| happens what am i doing wrong? bear in mind i'm not a computer all star here!
| --
| huch

Huch:

It's "Lipman" :-)

You stated "...but report unable to open file and no fix or removal.."

My WinFixerFix tool in the McAfee scan mode does NOT report that kind of error.

Please Copy and Paste the contents of the HTML Log file; C:\mcafee\ScanReport.HTML in your
reply from the last scan.

I have updated the WinFixerFix tool to specifically handle the DLL you posted.
I suggest downloading the tool again. Here are the directions.


Two phase answer...

Perform Part 1 the perform part 2

Part 1
------------
Download Adware-Virtumundo Removal Tool v1.5 --
http://secured2k.home.comcast.net/tools/VirtumundoBeGone.exe

Information on the Adware-Virtumundo Removal Tool:
http://forums.mcafeehelp.com/viewtopic.php?t=57049

Part 2
------------
Download WinFixerFix.exe from the URL --
http://www.ik-cs.com/programs/virtools/WinFixerFix.exe

Execute; WinFixerFix.exe { Note: You must accept the default of C:\McAfee }
Choose; Unzip
Choose; Close

NOTE: You may have to disable your software FireWall or allow WGET.EXE to go through your
FireWall to enable WGET.EXE to download the needed McAfee related files.

Execute; c:\mcafee\clean.bat
{ or Double-click on 'Clean Link' in c:\mcafee }

A final report in HTML format called C:\mcafee\ScanReport.HTML will be generated. At the
end of the scan, it will be displayed in your browser (Opera, FireFox or Internet Explorer).
It is suggested that you move the report out of c:\mcafee before performing another scan.
It would be a good idea to scan in Safe Mode and in Normal Mode and save a copy of the HTML
report for each session.

Please Copy and Paste the contents of the HTML Log file; C:\mcafee\ScanReport.HTML in your
reply.

* * * Please report back your results * * *



--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm


.

Relevant Pages

  • Re: winfixer
    ... The Adware-Virtumundo Removal Tool will specifically clean the Vundo Trojan and Virtumundo ... A final report in HTML format called C:\mcafee\ScanReport.HTML will be generated. ... It is suggested that you move the report out of c:\mcafee before performing another scan. ... It would be a good idea to scan in Safe Mode and in Normal Mode and save a copy of the HTML ...
    (microsoft.public.security.virus)
  • Re: Winlogon.exe chewing up CPU
    ... Barryco indicated WinFixerFix cured his problem. ... The Adware-Virtumundo Removal Tool will specifically clean the Vundo Trojan and Virtumundo ... It is suggested that you move the report out of c:\mcafee before performing another scan. ... It would be a good idea to scan in Safe Mode and in Normal Mode and save a copy of the HTML ...
    (microsoft.public.windowsxp.general)
  • Re: How do I remove trojan.vundo
    ... Download Adware-Virtumundo Removal Tool v1.5 -- ... Information on the Adware-Virtumundo Removal Tool: ... It is suggested that you move the report out of c:\mcafee before performing another scan. ... It would be a good idea to scan in Safe Mode and in Normal Mode and save a copy of the HTML ...
    (alt.comp.anti-virus)
  • Re: Trojan Malware Virus
    ... It is suggested that you execute each tool in Normal Mode then in Safe Mode. ... then you are strongly urged to remove any/all versions that are prior to JRE ... On Win9x/ME platforms the report will not be shown in your bowser ... It would be best to scan in both Safe Mode and in Normal Mode and save a copy of the HTML ...
    (microsoft.public.windowsxp.help_and_support)
  • Re: virus problem... not sure
    ... It is suggested that you execute each tool in Normal Mode then in Safe Mode. ... On Win9x/ME platforms the report will not be shown in your bowser ...
    (microsoft.public.windowsxp.security_admin)
Loading