I have had this virus since yesterday. I have tried everything I know, to remove it, but I just can't get rid of it, this is the hardest virus Ive ever come accross!

It started with random Norton Popups, saying I have been infected with the "Trojan.Vundo" Virus. Please note this is not the Trojan.Vundo.B, that's the easy one to get rid of.

I ran a Norton scan, and not a single infection was found, and 3 times during the scan, this popup came up again!

I then downloaded the removal tool dedicated to removing the Torjan.Vundo,and after half an hour waiting for the tool to finish doing its work, it popped up with, "Trojan.Vundo was not found on your computer/.

I ran a scan with Spyware Doctor, and all I got was 2 known bad sites to delete.

I am out of ideas! I ao ran the removal tool in safe mode, but this virus is something else, as soon as I hover my mouse cursor over the "Yes" button to continue working in safe mode, the window closes! and im stuck on this black screen and forced to restart, it happened 3 times, and it disappeared as soon as a scrolled my mouse over the "yes" button.

Here is my HiJackthis log.

Logfile of HijackThis v1.99.1
Scan saved at 15:03:08, on 16/07/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Spyware Doctor\svcntaux.exe
C:\Program Files\Spyware Doctor\swdsvc.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Spyware Doctor\SDTrayApp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNo tifier.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\FREEDO~1\fdm.exe
C:\Program Files\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = vGaming Forums (Powered by Invision Power Board)
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = *.local
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: Norton Internet Security 2006 - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [LClock] C:\Program Files\LClock\LClock.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [SDTray] C:\Program Files\Spyware Doctor\SDTrayApp.exe
O4 - HKLM\..\Run: [icq.com] rundll32.exe "C:\WINDOWS\system32\gjoiyeud.dll",forkonce
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNo tifier.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\xfire.exe
O8 - Extra context menu item: Download all with Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm
O8 - Extra context menu item: Download selected with Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Download with Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - http://a1540.g.akamai.net/7/1540/52/...x/qtplugin.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkID=39204
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - http://www.fileplanet.com/fpdlmgr/ca..._2.3.2.100.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/webplayer/s...wserPlugin.cab
O16 - DPF: {69EF49E5-FE46-4B92-B5FA-2193AB7A6B8A} (GameLauncher Control) - http://www.acclaim.com/cabs/acclaim_v4.cab
O16 - DPF: {AF2E62B6-F9E1-4D4F-A10A-9DC8E6DCBCC0} - http://update.videoegg.com/Install/W...gPublisher.exe
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762# # (Bonjour Service) - Unknown owner - C:\Program Files\Bonjour\mDNSResponder.exe (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPwdSvc.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Norton Internet Security\comHost.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service - Unknown owner - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifEng.dll (file missing)
O23 - Service: MSCamSvc - Unknown owner - C:\Program Files\Microsoft LifeCam\MSCamS32.exe (file missing)
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: Spyware Doctor Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: Spyware Doctor Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe
O23 - Service: SmartLinkService (SLService) - Smart Link - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

I will repost my AVG Scan report in the minute. The internet is very slow and im worried it is going to freeze up and I will have to retype this post.

While AVG is scanning, I'll tell you the problems I come accross.

1. Major internet lagg - Everything freezes everytime I go to a new webpage, or open a new tab/window etc.
2. Letters I type don't come up, and I am having a trouble typing these posts as I have to keep adding missing letters to words.
3. Windows Startup takes over 5 mins before the loading process is finished.
4. I am seeing many pop-up windows advertising dating sites, and anti-spyware/anti-virus software, such as drive cleaner.
5. These programs sometimes try to automatically install themselves, but luckily Norton seems to be blocking them and removing them. DriveCleaner was one of the ones that Norton Picked up, soon after the pop-up.

The internet keeps freezing every few seconds now, mostly for a second, but sometimes up to 15 seconds.

Please help! Its madness! AVG is almost finished scanning, I will post the report in a moment.

Hi Slow2Die,

I presume you have been following the Prework (in my signature). I will move this to the Hijackthis Logs section so they can take a look for you.

Chris

haha, after all that waiting, and:

---------------------------------------------------------
AVG Anti-Spyware - Scan Report
---------------------------------------------------------
+ Created at: 16:28:48 16/07/2007
+ Scan result:

Nothing found.

::Report end

I need help!! fast!! Im open to any ideas that you guys have!

Sorry Slow2Ride, you'll have to wait for the Secruity team there the only people trained.

Symantec Removal Tool Report.

Symantec Trojan.Vundo Removal Tool 1.5.0
C:\Documents and Settings\Ashley\Local Settings\Application Data\Microsoft\Messenger\slow2die@hotmail.co.uk\Sh aringMetadata\0bsc3n3@2pro4u.com\DFSR\Staging\CS{B FC44CBF-167C-13FC-8AB2-EFE1C9303698}\01\10-{BFC44CBF-167C-13FC-8AB2-EFE1C9303698}-v1-{87A68F6C-D4BF-47D0-A069-A8C9B7C751DF}-v10-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\Ashley\Local Settings\Application Data\Microsoft\Messenger\slow2die@hotmail.co.uk\Sh aringMetadata\0bsc3n3@2pro4u.com\DFSR\Staging\CS{B FC44CBF-167C-13FC-8AB2-EFE1C9303698}\12\12-{85EF3B79-F3A8-4883-9D82-30733EFBCB82}-v12-{85EF3B79-F3A8-4883-9D82-30733EFBCB82}-v12-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\Ashley\Local Settings\Application Data\Microsoft\Messenger\slow2die@hotmail.co.uk\Sh aringMetadata\0bsc3n3@2pro4u.com\DFSR\Staging\CS{B FC44CBF-167C-13FC-8AB2-EFE1C9303698}\13\13-{85EF3B79-F3A8-4883-9D82-30733EFBCB82}-v13-{85EF3B79-F3A8-4883-9D82-30733EFBCB82}-v13-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\Ashley\Local Settings\Application Data\Microsoft\Messenger\slow2die@hotmail.co.uk\Sh aringMetadata\0bsc3n3@2pro4u.com\DFSR\Staging\CS{B FC44CBF-167C-13FC-8AB2-EFE1C9303698}\18\18-{85EF3B79-F3A8-4883-9D82-30733EFBCB82}-v18-{85EF3B79-F3A8-4883-9D82-30733EFBCB82}-v18-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\Ashley\Local Settings\Application Data\Microsoft\Messenger\slow2die@hotmail.co.uk\Sh aringMetadata\0bsc3n3@2pro4u.com\DFSR\Staging\CS{B FC44CBF-167C-13FC-8AB2-EFE1C9303698}\21\21-{85EF3B79-F3A8-4883-9D82-30733EFBCB82}-v21-{85EF3B79-F3A8-4883-9D82-30733EFBCB82}-v21-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\Ashley\Local Settings\Application Data\Microsoft\Messenger\slow2die@hotmail.co.uk\Sh aringMetadata\0bsc3n3@2pro4u.com\DFSR\Staging\CS{B FC44CBF-167C-13FC-8AB2-EFE1C9303698}\24\24-{85EF3B79-F3A8-4883-9D82-30733EFBCB82}-v24-{85EF3B79-F3A8-4883-9D82-30733EFBCB82}-v24-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\Ashley\Local Settings\Application Data\Microsoft\Messenger\slow2die@hotmail.co.uk\Sh aringMetadata\0bsc3n3@2pro4u.com\DFSR\Staging\CS{B FC44CBF-167C-13FC-8AB2-EFE1C9303698}\27\27-{85EF3B79-F3A8-4883-9D82-30733EFBCB82}-v27-{85EF3B79-F3A8-4883-9D82-30733EFBCB82}-v27-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\Ashley\Local Settings\Application Data\Microsoft\Messenger\slow2die@hotmail.co.uk\Sh aringMetadata\0bsc3n3@2pro4u.com\DFSR\Staging\CS{B FC44CBF-167C-13FC-8AB2-EFE1C9303698}\30\30-{85EF3B79-F3A8-4883-9D82-30733EFBCB82}-v30-{85EF3B79-F3A8-4883-9D82-30733EFBCB82}-v30-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\Ashley\Local Settings\Application Data\Microsoft\Messenger\slow2die@hotmail.co.uk\Sh aringMetadata\0bsc3n3@2pro4u.com\DFSR\Staging\CS{B FC44CBF-167C-13FC-8AB2-EFE1C9303698}\33\33-{85EF3B79-F3A8-4883-9D82-30733EFBCB82}-v33-{85EF3B79-F3A8-4883-9D82-30733EFBCB82}-v33-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\Ashley\Local Settings\Application Data\Microsoft\Messenger\slow2die@hotmail.co.uk\Sh aringMetadata\0bsc3n3@2pro4u.com\DFSR\Staging\CS{B FC44CBF-167C-13FC-8AB2-EFE1C9303698}\35\35-{85EF3B79-F3A8-4883-9D82-30733EFBCB82}-v35-{85EF3B79-F3A8-4883-9D82-30733EFBCB82}-v35-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\Ashley\Local Settings\Application Data\Microsoft\Messenger\slow2die@hotmail.co.uk\Sh aringMetadata\0bsc3n3@2pro4u.com\DFSR\Staging\CS{B FC44CBF-167C-13FC-8AB2-EFE1C9303698}\36\36-{85EF3B79-F3A8-4883-9D82-30733EFBCB82}-v36-{85EF3B79-F3A8-4883-9D82-30733EFBCB82}-v36-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\Ashley\Local Settings\Application Data\Microsoft\Messenger\slow2die@hotmail.co.uk\Sh aringMetadata\0bsc3n3@2pro4u.com\DFSR\Staging\CS{B FC44CBF-167C-13FC-8AB2-EFE1C9303698}\37\37-{85EF3B79-F3A8-4883-9D82-30733EFBCB82}-v37-{85EF3B79-F3A8-4883-9D82-30733EFBCB82}-v37-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\Ashley\Local Settings\Application Data\Microsoft\Messenger\slow2die@hotmail.co.uk\Sh aringMetadata\0bsc3n3@2pro4u.com\DFSR\Staging\CS{B FC44CBF-167C-13FC-8AB2-EFE1C9303698}\41\41-{85EF3B79-F3A8-4883-9D82-30733EFBCB82}-v41-{85EF3B79-F3A8-4883-9D82-30733EFBCB82}-v41-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\Ashley\Local Settings\Application Data\Microsoft\Messenger\slow2die@hotmail.co.uk\Sh aringMetadata\0bsc3n3@2pro4u.com\DFSR\Staging\CS{B FC44CBF-167C-13FC-8AB2-EFE1C9303698}\43\43-{85EF3B79-F3A8-4883-9D82-30733EFBCB82}-v43-{85EF3B79-F3A8-4883-9D82-30733EFBCB82}-v43-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\Ashley\Local Settings\Application Data\Microsoft\Messenger\slow2die@hotmail.co.uk\Sh aringMetadata\0bsc3n3@2pro4u.com\DFSR\Staging\CS{B FC44CBF-167C-13FC-8AB2-EFE1C9303698}\45\45-{85EF3B79-F3A8-4883-9D82-30733EFBCB82}-v45-{85EF3B79-F3A8-4883-9D82-30733EFBCB82}-v45-Downloaded.frx (WARNING: not scanned, path to long)
C:\System Volume Information: (not scanned)
Trojan.Vundo has not been found on your computer.

That was no good!

Anyone available yet? Norton is still popping up with the Trojan Virus, and IE is getting more and more laggy by the second.