Trojan.Vundo - Removal
Disable System Restore (Windows Me/XP)
For details on each of these steps, read the following instructions
To disable System Restore
If you are running Windows Me or Windows XP, we recommend that you temporarily turn off System Restore. Windows Me/XP uses this feature, which is enabled by default, to restore the files on your computer in case they become damaged. If a virus, worm, or Trojan infects a computer, System Restore may back up the virus, worm, or Trojan on the computer.
Windows prevents outside programs, including antivirus programs, from modifying System Restore. Therefore, antivirus programs or tools cannot remove threats in the System Restore folder. As a result, System Restore has the potential of restoring an infected file on your computer, even after you have cleaned the infected files from all the other locations.
Also, a virus scan may detect a threat in the System Restore folder even though you have removed the threat.
Update the virus definitions
To restart the computer in Safe mode or VGA mode
Shut down the computer and turn off the power. Wait for at least 30 seconds, and then restart the computer in Safe mode with Command Prompt or VGA mode.
scan for and delete the infected files
Click Start and Run
Type regedit Then click OK
Navigate to and delete the following registry entries:
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ATLEvents.ATLEvents\CLSID\”[DEFAULT VALUE]” = “{02F96FB7-8AF6-439B-B7BA-2F952F9E4800}”
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ATLEvents.ATLEvents.1\CLSID\”[DEFAULT VALUE]” = “{02F96FB7-8AF6-439B-B7BA-2F952F9E4800}”
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Runonce\”*WinLogon = “[TROJAN FULL PATH FILE NAME] ren time:[RANDOM NUMBER]”
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\”*[TROJAN FILE NAME]” = “[TROJAN FULL PATH FILE NAME] rerun” HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\”*[TROJAN FILE NAME]” = “[TROJAN FULL PATH FILE NAME]”
Navigate to and delete the following registry sub:
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\ActiveState
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02F96FB7-8AF6-439B-B7BA-2F952F9E4800}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02F96FB7-8AF6-439B-B7BA-2F952F9E4800}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2353FCBC-012D-487B-8BF3-865C0929FBEB}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ATLDistrib.ATLDistrib\CLSID\
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ATLDistrib.ATLDistrib.1\CLSID\
HKEY_USERS\S-1-5-21-2068663838-1736639611-1443527720-50\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2353FCBC-012D-487B-8BF3-865C0929FBEB}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{22E85F2A-4A67-4835-B2C3-C575FE4EC322}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ADOUsefulNet.ADOUsefulNet
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ADOUsefulNet.ADOUsefulNet.1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{22E85F2A-4A67-4835-B2C3-C575FE4EC322} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DE8BDE42-16D9-4CCC-9F4F-1C3167B82F60}
HKEY_CLASSES_ROOT\CLSID\{DE8BDE42-16D9-4CCC-9F4F-1C3167B82F60}HKEY_LOCAL_MACHINE\SOFTWARE\Classes\DPCUpdater.DPCUpdater HKEY_LOCAL_MACHINE\SOFTWARE\Classes\DPCUpdater.DPCUpdater.1
Exit the Registry Editor