Windows XP Applications Hijacked

[VodkaIce]

Primarily Windows Explorerer - I found the culprit - deleted it and windows explorer was accessible once again, but within seconds - bang! the trojan was recreated elsewhere, and windows explorer is once again not accessible.

 

Now, Iobit 360 scan v. 1.0 seems to be having a problem eradicating the Vuendo trojan. It would delete the trojan along with the restore.exe file, but voila it's back again.

 

"Faulting application explorer.exe, version 6.0.2900.2180, faulting module unknown, version 0.0.0.0, fault address 0x00000000."

 

Winlogon:

"The shell stopped unexpectedly and Explorer.exe was restarted."

 

 

Checking file system on C:

The type of the file system is FAT32.

 

 

One of your disks needs to be checked for consistency. You

may cancel the disk check, but it is strongly recommended

that you continue.

Windows will now check the disk.

Volume Serial Number is 0547-0FEB

The size of the \WINDOWS\TEMP\20D.tmp entry is not valid.

\WINDOWS\TEMP\20D.tmp is cross-linked on allocation unit 73580.

Cross link resolved by copying.

Windows has made corrections to the file system.

9990656 KB total disk space.

949168 KB in 1074 hidden files.

32488 KB in 3751 folders.

8465488 KB in 51713 files.

543504 KB are available.

 

8192 bytes in each allocation unit.

1248832 total allocation units on disk.

67938 allocation units available on disk.

 

 

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

 

Recovery was performed successfully on PropertyStore in catalog c:\system volume information\catalog.wci.

 

Checking file system on C:

The type of the file system is FAT32.

 

 

One of your disks needs to be checked for consistency. You

may cancel the disk check, but it is strongly recommended

that you continue.

Windows will now check the disk.

Volume Serial Number is 0547-0FEB

The size of the \WINDOWS\TEMP\20D.tmp entry is not valid.

\WINDOWS\TEMP\20D.tmp is cross-linked on allocation unit 73580.

Cross link resolved by copying.

Windows has made corrections to the file system.

9990656 KB total disk space.

949168 KB in 1074 hidden files.

32488 KB in 3751 folders.

8465488 KB in 51713 files.

543504 KB are available.

 

8192 bytes in each allocation unit.

1248832 total allocation units on disk.

67938 allocation units available on disk.

 

 

Detection of product '{90500409-6D54-11D4-BEE3-00C04F990354}', feature 'Program_Files' failed during request for component '{F6B21A68-2423-4D00-97B0-C5278E69547F}'

 

Product: Microsoft Visio Professional 2002 SR-1 [English] -- Error 1706. An installation package for the product Microsoft Visio Professional 2002 SR-1 [English] cannot be found. Try the installation again using a valid copy of the installation package 'Visio.msi'.

 

(someone hijacked my pc attempting to install visio - attempts to capture my network, but I don't have a network - just my pc (laughs))

 

 

Just thought I post a few so that you guys would not think my it's my imagination gone south

[taleblou]

did yout ried these

 

Hi:

 

Scan your pc with Pc-tool antispyware and antivirus starter then with malwarebyte free and then superantispyware free and then dr. web cureit and avira antivir and prevx 3 free (need to remove malewares manualy in prevx 3 free) all in safe mod and you should be free clean and good to go. The other method is to do a a clean restore.

[VodkaIce]

PC-tools does not work ...

 

Reinstall twice - does not work ...

 

As of late, this is my findings - I can restore the defaults, but there is a script running that intercepts any changes to Windows Explorer, and clobbers my restore.

 

I bet once I purchase both Iobit products, this problem disappears.

 

Though since updating to IE8, it crashes all the time (laughs) :shock:

 

So, I am going to wait and see what happens when I purchase both Iobit products. I won't be surprise or dismayed when voila the problems all disappear.

[taleblou]

hmm. do these.

 

Hi:

 

If the infection is that deep then there is only 3 thing you can do right now since anti-malware softwres will not help you.

 

1. search online for the specific vundo virus you have and there will be tools specialy made and instruction on how to manualy remove that particular infection.

 

2. install comodo firewall with defense plus and then you can block the vundo in thje defense plus and it will lock it for good. if not then

 

3. Do a clean format and and afterward use shadow defender and pc-tool firewall plus (free). No antivirus or antimalwares or HIPS, etc. is ever needed because "shadow Defender" takes care of malwares and all infections and errors on a clean pc.

 

I go with step 3 and do use "shadow defender" since using it it turns your hard drives (c:; etc..) into a sand box type and everytime you restart your pc everything you had before you reboot will be AUTOMATICALY GET DELETED. your pc after each boot will go to the exact time when you first initiate it shadow defender. So any junk, malwares, or what ever gets on your pc is wiped clean. Also if you download safe files you can excluse them from shadow defender wiping by "COMMIT" option. ALso for each file you download scan them with "VIRUS TOTAL" online and then if safe then commit them or do not commit first and open it and if infected then simply reboot and the shadow defender will take care of that.

[VodkaIce]

Thanks!

 

I have another idea. I am going to install this other software and have since removed all Iobit products because it would not allow me to access any Microsoft Office software (e.g. Word or Powerpoint) - won't let me save my files.

 

This other security software allows me to SEE who is hijacking me and infecting my pc then I can return the favor (laughs) :mrgreen:

 

The upside of Iobit 360 is the Privacy Cleaner. Otherwise, it reeked more havoc, to which gave me more headaches than I wanted.

 

So, I hate to say adios, but maybe later down the road, I will give it a try and see if it's any better.