How to fix Vundo Virus on your Computer

from Mike Nagy, IT Consultant at Computer Works of Toledo

Malware is a broad term that refers to software designed to infiltrate or damage a computer system without the owner's consent. Popular forms of malware include spyware, adware, fraudware, viruses, worms and trojans. These programs are responsible for a significant decrease in user productivity due to their impact on PC performance and time spent on attempted self-repair. More catastrophic results include unauthorized access to company information by outside hackers, deletion of critical information and even operating system corruption leading to complete system failure. The solution is to proactively scan for and remove malware programs on a regular basis by a qualified PC administrator using utilities designed for the task.

If your proactive efforts have not been successful at preventing infection, it is often very difficult to completely remove infections like the Vundo virus or one of the myriad of variants (now classified as “Fraud Ware”). If you have physical access to the computer, then performing a “Clean Scan” process is the most reliable method of removing the Vundo Virus; however, as we often find ourselves attacking these types of infections on remote computers. The instructions below provide a reliable method of virus removal, for at least 80% of affected computers. This process can take between 2 to 6 hours, depending on the level of infection, with the average computer taking about 3 ½ to 4 hours.

1. Establish the Remote session using GoToAssist (G2A), GoToAssist Express (G2A-x), Log-Me-In or a similar utility.
• Make sure to upgrade the remote session to “Run As A Service” or setup the “Unattended Support” option if available


2. Verify the computer has a valid Antivirus program installed, and that it has the latest virus Definitions.
• If no valid Antivirus program is installed, the current Antivirus product has been disabled, or the current Antivirus product is expired; then download a current Trial or Free Antivirus program such as: AVG 8.x Free or ClamWin, which are available from http://www.filehippo.com


3. Download, install and update the most recent version of the following programs:
• SpyBot Search and Destroy (Spybot) http://www.filehippo.com/download_spybot_search_destroy/
• MalwareBytes’ Anti-Malware (aka: MBAM) http://www.malwarebytes.org/mbam.php
• Super Antispyware. http://www.superantispyware.com/
• A reliable Registry Cleaning Utility. I recommend one or both of the following:
i. Crap Cleaner (CCleaner) - http://www.filehippo.com/download_ccleaner/
ii. EasyCleaner - http://personal.inet.fi/business/toniarts/ecleane.htm

4. Disable System Restore:
• Right Click on the “My Computer” Icon
• Select “Properties”
• Select the “System Restore” Tab
• Check the box “Turn Off System Restore”
• Approve the prompt message, and Click “OK” to close the Properties Window


5. Perform Registry and Application Cleanup (the instructions provided here are for CCleaner. You can also perform similar operations using EasyCleaner)
• Select the ”Cleaner” button (Left Margin Bar)
i. Select the “Analyze” button (at the bottom) to catalog Temp files, the browser cache, and cookies
ii. Select the “Run Cleaner” button (bottom right)
• Select the “Tools” Menu (Left Margin Bar)
• Select the “Uninstall” Menu Button
i. Uninstall ALL toolbars (i.e. Yahoo Toolbar, Google Toolbar, MSN Tools, etc.)
ii. Uninstall All “Browser Helper” applications (i.e. Yahoo Browser Protection, WebX, Dell Redirector, etc.)
iii. Uninstall ALL Messenger programs (i.e. AOL, MSN, Yahoo Messenger, etc.)
iv. Uninstall Google Desktop and Microsoft Desktop Search (Indexer)
v. Uninstall all “search tools” or “search assistant” applications
• Select the “Startup” Menu Button
i. Delete all “deactivated” startup items
ii. Disable any item that is suspect (i.e. XP_Antispyware_2008.exe, ZEDO.exe, etc.)
• Select the “Registry” Button (Left Margin Bar)
i. Select the “Scan for Issues” button (at the bottom)
ii. Select the “Fix Selected issues…” button (bottom right) – approve all prompts, but do not save the current registry values
iii. Repeat the above registry cleaning as needed until all invalid registry entries are removed – this may take 6 or more times


6. Restart the PC in Safe Mode (With Networking)
• Use the Remote Utility to “restart in safe mode” if it is available.
• If not, force the PC into Safe Mode at the next startup
i. Click “Start”
ii. Select “Run…”
iii. Type “msconfig” in the Run Command prompt and select “Ok” or press the [enter] key
iv. Select the “Start in Safe Mode with Networking” radio button
v. Click Apply
vi. Click “OK”, then select “Restart the Computer” when prompted


7. Once the computer is at the desktop in Safe Mode, run Malwarebytes’ Anti-Malware (MBAM) and perform a “quick scan” (this scan usually takes 20 to 25 minutes) *** This scan can be performed at the same time as the Antispyware scan below, if the computer has sufficient hardware resources

8. Open Super Antispyware and perform a “Quick Scan” (this scan usually takes 20 to 25 minutes) *** This scan can be performed at the same time as the MBAM scan above, if the computer has sufficient hardware resources

9. Open Spybot, and select the “Check For Problems” button (this scan may take up to 1 ½ hours) *** This scan can be performed at the same time as the Antivirus scan below, if the computer has sufficient hardware resources
• Select “Fix All Problems” then approve any prompts from this program

10. Setup Spybot to automatically run on the next PC startup
• Click on the “Mode” Toolbar Menu
• Select “Advanced Mode” and approve the prompt
• Select the “Settings” Menu button
• Highlight the “Settings” sub-menu
• Scroll down to the “Scan Priority” sub-menu
i. Select the “Highest” radio button
• Scroll down to the “Automation” sub-menu
i. Select the “Run Spybot on the Next System Startup” radio button
ii. Select the “Run Scan when program starts” check box
iii. Select the “Fix all problems” check box
• Select the “Spybot S&D” Menu Button
• Close Spybot

11. Open the Antivirus program and perform a “Full System Scan” (this is typically a “console mode” scanner in Safe Mode and may take up to 2 hours) *** This scan can be performed at the same time as the Spybot scan above, if the computer has sufficient hardware resources


12. Repeat Registry Cleanup (Step # 5 above using CCleaner or Easy Cleaner)


13. Restart the Computer in Normal Operation Mode (Reset the MSCONFIG boot option if this method was used to force a restart in Safe Mode)

14. Upon login, Spybot should automatically start to run and check for problems.
• If Spybot does not startup automatically, then immediately repeat/verify step 13 above.
• Once Spybot completes the scan, and fixes any problems, review the “fixed” items to insure there is no evidence of persistent virus activity then close Spybot

15. Run the Antivirus program. Once the Antivirus program completes, review the log to insure there is no persistent virus activity, then close the Antivirus program


16. Open Internet Explorer and verify the Home Page and security options, and that there are no installed Toolbars

17. Verify the clients Data is intact and programs are working normally.
• Re-install any programs which do not work normally

NOTES:
If no persistent virus activity is encountered:
• Perform a final registry cleanup for EACH user login on the computer (using CCleaner or Easy Cleaner)


If persistent virus activity is encountered:
• The computer cannot be “cleaned by normal means” and should have the Hard Disk Drive formatted and the Operating system reinstalled. If a format and OS reinstallation are still not an option, then a “Clean System Scan” must be performed, or the system should be removed from service or replaced.

5 Good Computing Habits

Working off a slow, disorganized computer can be frustrating—and it happens to the best of us. This article is designed to give you some easy-to-follow guidelines on how to keep your computer on the right track using tools in Microsoft Windows Vista and Microsoft Windows XP.


1. Organize your folders
We all know how easy it is to dump files into the wrong folder when we're in a hurry. But one way to make sure you'll keep your files organized is to remove the clutter with a filing system that makes sense for the way you use your computer. Here are a few tips to get you started:

Start clean
Begin by deciding which files you no longer need on your hard drive.


Think it through
Take the time to plan the best way to organize your files. How do you spend your time on the computer and what do you create? Do you work with photos and image editing software, surf the Web, write short stories, research school projects, or play games? The folders you create in Documents (called My Documents in Windows XP) can be easily tailored to show you just the kind of data about your files that you need to track.


Use subfolders
After you have an idea of the kinds of items you produce and want to save, create folders and subfolders to store your files. Be sure to use logical, easy-to-understand names. For example, within Documents, you might create additional folders called Projects, HR Benefits, and Career. Then, within the Projects folder, you could create subfolders for each different project.

Windows Tip
To create a new subfolder with Windows Vista or Windows XP, simply right click anywhere in the folder, select New, and Select Folder. Type the name for the new folder and press Enter. For more tips about creating a well-organized filing system, see 7 tips to manage your files better.

Create a new folder using the File and Folder task pane.


2. Clean up your hard disk
Now that you've organized your files and folders, and cleaned up your desktop, you can organize the data itself. Windows includes two utilities—Disk Cleanup and Disk Defragmenter—that help you free up more space on your hard drive and help your computer work more efficiently.


Disk Cleanup compresses your old files so you can free up storage space.


Disk Defragmenter scans your hard drive and consolidates files that may be scattered across the disk


Not sure how often to run these utilities? It's really up to you—some people like to run both weekly, others prefer monthly, and a few only run them every few months. It's not a bad idea to do both at least once a month. Windows Vista users take note: Disk Defragmenter is automatically scheduled to run once a week (Sunday at 4 a.m.). You can change the scheduled time for this feature or turn it off, if you prefer.


To find both programs, click Start, point to All Programs, then point to Accessories, and then choose System Tools.


3. Use System Restore
System Restore is one of those programs that can be a life-saver when you've been the unfortunate recipient of unstable software, a badly timed power outage, or a damaging thunderstorm. System Restore records important documents, settings, and preferences on your computer. If the unthinkable happens and your computer files are damaged or inaccessible, you can use System Restore to restore your computer back the same state it was in before the data was lost.


System Restore creates restore points daily, and whenever you install device drivers, automatic updates, and some applications. Still, it's a good idea to get into the habit of creating a system checkpoint (called a restore point) whether you're about to install new software, or take any action you suspect might make your computer unstable. That way, if there's any conflict at all, you can restore your computer to the point just before you began the installation.


To use System Restore:

• Click Start, and choose All Programs.
• Point to Accessories, then point to System Tools, and then choose System Restore.
• When the program begins, choose Create a restore point and click Next.
• Enter a description of the restore point and click Create. After a few seconds, the program will tell you the date, time, and description of the new restore point.
• Click Close to exit System Restore.

4. Keep Windows and Office up-to-date

Computer programs are continually improved based on customer feedback and continuing product testing. As problems are resolved, you should benefit from those improvements. By checking Microsoft Update regularly, you can make sure you've got the most recent Windows and Office improvements available to you.


If you're using Windows XP, visit Microsoft Update to start the update process. If it's your first time to visit Microsoft Update, you might need to sign up to the service. Windows Vista users don't need to sign up for Microsoft Update: an account is automatically created for you during the registration process.


To use Microsoft Update:


For high-priority updates, click Express Install (recommended). If you're just looking for general updates that aren't critical, choose Custom Install.


The site will do a quick check of your system to see whether any new updates are available that have not been downloaded to your computer. When the check is finished, a window appears showing you any new updates ready for download.


Follow the on-screen instructions and click Install Now to update your computer with the latest software improvements.


Once you've visited the Microsoft Update site, you should also configure your computer to receive critical updates automatically. This service is called Automatic Updates (Windows Update in Windows Vista) and it's free. Learn how to turn it on in Windows Vista and Windows XP.

Turn Windows Update on in Windows Vista

• Click Start, and then click Control Panel.
• Under Windows Update, select Turn automatic updating on or off.
• Select a setting. Microsoft recommends selecting Automatic: Automatically download recommended updates for my computer and install them. You can schedule Automatic Updates for any time of day. Remember, your computer must be on at the scheduled time for updates to be installed. We recommend choosing a time when you will not be using the computer for other tasks.
• Change Settings dialog box
• Turn Windows Update on in Windows XP
• Click Start, and then click Control Panel.
• Click Performance and Maintenance.

Note: If the Performance and Maintenance category is not visible, click Switch to Category View.

• Click System.
• In the System Properties dialog box, click the Automatic Updates tab.
• Select a setting. Microsoft recommends selecting Automatic: Automatically download recommended updates for my computer and install them. You can schedule Automatic Updates for any time of day. Remember, your computer must be on at the scheduled time for updates to be installed. We recommend choosing a time when you will not be using the computer for other tasks.

If you choose to have Automatic Updates notify you in step 5, you will see a notification balloon when new downloads are available to install. Click the notification balloon to review and install updates.

Important : If you choose an option in step 5 other than the one we recommend, you must download and install every critical update. If you download the updates, but forget to install them, your computer will not be protected with all the latest enhancements.

Turn Windows Update on in Windows XP

• Click Start, and then click Control Panel.
• Click Performance and Maintenance.

Note: If the Performance and Maintenance category is not visible, click Switch to Category View.

• Click System.
• In the System Properties dialog box, click the Automatic Updates tab.
• Select a setting. Microsoft recommends selecting Automatic: Automatically download recommended updates for my computer and install them. You can schedule Automatic Updates for any time of day. Remember, your computer must be on at the scheduled time for updates to be installed. We recommend choosing a time when you will not be using the computer for other tasks.
• Ifyou choose to have Automatic Updates notify you in step 5, you will see a notification balloon when new downloads are available to install. Click the notification balloon to review and install updates.

Important : If you choose an option in step 5 other than the one we recommend, you must download and install every critical update. If you download the updates, but forget to install them, your computer will not be protected with all the latest enhancements.


5. Run antivirus software AND a spyware detection and removal tool

Updating your Windows software is just the first step in keeping your computer safe. Next, you'll want to download and install antivirus software and keep it up to date. Your computer may have come with a free trial of antivirus software, but if you don't renew your subscription, you won't be protected from all the latest threats.

If your computer seems sluggish or if you begin to see lots of pop-up advertisements, even when you're not surfing the Web, your computer may be infected with spyware, adware, or other unwanted software. Learn more about spyware and what it can do to your computer. Fortunately, there's Microsoft Windows Defender, which is included in Windows Vista, and is available as a free download for Microsoft XP SP2. Alternatively, there are other free anti-spyware software programs available.

Find more tips at the Microsoft at Work website