Internetworkers: http://www.ibiblio.org/internetworkers/

["Jim Ray" <jim AT neuse.net>]

Once a system has been compromised, you are far better off loading your operating system and applications onto a freshly partitioned and formatted disk than trying to repair the system. Why? Because of the time and quality. You could spend a lot of time with remedies that may not have the quality of a system that has not been compromised.

 

Unless you love drilling down into the Windows registry and spending lots of time, backup you data and nuke/pave.

 

Regards,

Jim Ray, MCSE, NCSU EE '85
President
Neuse River Networks
tel: 919-838-1672 x111 cell: 919-606-1772
http://www.neuserivernetworks.com

Founded in 1997, Neuse River Networks is a Raleigh, NC based IT Outsourcing Partner that is committed to specialized customer solutions to reduce costs and increase productivity with The ONE Plan.  By taking a proactive approach The ONE Plan is designed to manage your computer network so you don’t have to.  Since its inception Neuse River Networks has built its foundation on earning the trust of its customers and will continue to strive toward this standard of excellence.

 

Contact Information:

 

Customer Referrals:

sales AT neuserivernetworks.com

 

Customer Service/Support:

support AT neuserivernetworks.com

 

From: internetworkers-bounces AT lists.ibiblio.org [mailto:internetworkers-bounces AT lists.ibiblio.org] On Behalf Of Jeanne Moyer
Sent: Tuesday, March 31, 2009 7:10 AM
To: Internet workers
Subject: Re: [internetworkers] Trojan Vundo

 

To all who have responded...thank you!  Colleen said you were a very knowledgeable and great group of folks.

More intel on viruses. Finally talked with Kaspersky late last night and here's what I found out.

There is NO product that will run on my old system.  The support rep made two suggestions (aside from buy a new laptop)

1. run two Kaspersky utilities to clean up the computer - KLWL.exe and Virus Removal tool.

These are NOT to replace virus protection but to clean up a machine before installing a product that will monitor and run in the background.

      2. Try combofix from bleepingcomputer.com which the rep said is a safe site

Last but not least Symantec offers a Trojan Vundo removal tool.

I'm inclined to try the two Kaspersky utilities as I had great experience with the Kaspersky product in the past. Don't even go to the question of why did I not continue using it.  Too long a story and one not worth repeating.

Thanks for any input you may have and hope this bit of intel is useful to someone in addition to me!
Jeanne

On Mon, Mar 30, 2009 at 6:24 PM, Jeanne Moyer <jeanne.moyer AT gmail.com> wrote:

Anyone have any experience really getting rid of this pesky virus?

I used Malware and the messages indicate it it quarantined and deleted successfully but I'm still getting hijacked.

The symptoms are

• redirected from a Google search to a similar but not the right website
• losing connection to Mozilla or IE.  Either browser IE or Mozilla does a hard shutdown and the usual message appears asking if I'd like to notify Microsoft about the problem
• HKEY-_LOCAL disabled security center

Any ideas of what to use?  I'm running XP Pro with an aging system that I'm getting ready to replace. Want to be sure I am not propagating problems when I move the data.   I have 1 meg of RAM and 40 GB hard drive with 5  GB free space.

Thanks so much for any advice or experience you can share.

--
Jeanne Moyer