Malware Removal Forums

Malware infection - possibly Vundo?

gdeych · 2009-03-20T15:20:21+00:00

Malwarebytes Anti-Malware program keeps reporting Vundo trojan presence, which it removes temporarily...but the symptoms reappear very quickly. The symptom is creation IE pop-up windows pointing mostly to url.adtrgt.com, but also to other sites as well. I would be grateful for help with this annoying problem. Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 8:11:12 AM, on 3/20/2009 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5508) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Google\Update\GoogleUpdate.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\RTHDCPL.EXE C:\WINDOWS\system32\RUNDLL32.EXE C:\

7 min read

✨ The volunteers who helped with this thread aren't active anymore, but you can still get a personalized answer — click Ask AI below.

Axephilic Retired Graduate

March 26, 2009, 11:54 PM UTC

Please post a new HijackThis log once you have installed both. Also, it doesn't look like Adobe is updated, please make sure to do that before posting a new log as well.

Regards,
Adam

Axephilic Retired Graduate

March 29, 2009, 2:48 PM UTC

Hello,

THREE DAY BUMP!

It has been three days since my last post.

Do you still need help with this?
Do you need more time?
Are you having problems following my instructions?

If after 48 hours you have not replied to this thread, then it will have to be closed!

Regards,
Adam

NonSuch Administrator

April 1, 2009, 12:04 AM UTC

a lack of response,

✨ Ask AI about this thread

No ads, no affiliate links — generated on request from this thread's own archived content, not written by forum staff. Never run a scan/removal tool as a self-service step if the original thread describes it being done under a helper's direct supervision, and don't include your name, email, or other personal details in a follow-up question. See our privacy page for details on how this works.