Please help with Vundo and others

[Bryanr]

I have followed all the directions in the read me first topic.
The following issues should be noted.:

Step 1: My computer does not give me the option to disable system restore. I am the administrator.
Step 7: Kaspersky did not give me an option to clean the infections (21)
Step 8B: AVG did not let me save the report (the save report button was greyed out); the report settings were correct automatic, and "only if threats were found" was unchecked.

PLease help!

Thanks in advance!

[jholland1964]

First of all, don't worry about resetting System Restore, that is not to be done until we are certain the computer is clean. The items listed in there are not a problem at the moment.
Kaspersky doesn't allow cleaning, but does show where infections are found, that is the reason for running that scan.
For now, we won't worry about saving that scan report. Do you recall if there were infections found and what they were?
You might open the program again and then click on Reports. See if there is a report there. If there is see if you can get a copy from there.

Reboot to SAFE MODE
Navigate to the following folders and delete the item shown in RED

C:\WINDOWS\system32\chkfig5\d0125.exe
C:\WINDOWS\system32\f02WtR\f02WtR1065.exe
C:\WINDOWS\tk58.exe

Also clear out that C:\VundoFix Backups\

Reboot to normal mode and run a new HJT scan, save the log and post it here.

[Bryanr]

OK files have been deleted.
I did open AVG Anti Spyware and was able to extract the report (attached).
Also attaching HJT log.

Thanks for your help!

[jholland1964]

Did you run the AVG in SAFE MODE?
Also, can you spell out exactly the problems you were having which caused you to begin with this cleaning procedure? We sort of need to know what we might be dealing with here and symptoms experienced are a great help so that we can get an idea what other steps, other than those in the sticky, what might need to be run.

[Bryanr]

I did run it in safe mode. I know that because my monitor cannot display the entire AVG control panel when in safe mode.

Original problem and a bit of history if it helps:
I started getting many many unsolicited pop-ups on my computer, even when IE is not open. That has never happened before. Then <*insert random internet security program here*> told me that I have spyware on my computer. This was a program that I never installed but it was going to "clean all the spyware off my computer for the low low price of $29.99". I removed it immediately!

I Downloaded PCtools Spydoctor and ran it, that utility found 21 infections, but could not stop the original problem (Unsolicited popups). Much searching led me to your site here.

[jholland1964]

Ok, I would like you to run the cleaning steps again from here

Run Kaspersky again but also run at least one of the others FIRST. Kaspersky will not clean but the others will I believe. Have them clean everything found.

Then follow on through with the other steps. Once you have completed those then Disconnect from the internet, actually remove the plug from the computer.
Boot to safe mode and continue with the remaining steps, including running AVG Anti-spy again exactly as the instructions state. Have it fix whatever it finds and try to save the log.
Once all is complete then reboot to normal mode and run HJT again, save the log and post back here with all the logs you have saved.

You are showing at least one trojan on the computer, maybe more, we need to see if we can get rid of most of them before going forward to other steps or tools.
Judy

[Bryanr]

I followed your directions to the letter:

I ran Panda Scan (log attached)
I ran Kaspersky (log attached)
I ran AVGScan (no report was avaliable)
I ran WinDefender (said my computer is running normally - although I did get a popup as soon as I logged back on in normal mode)
HJT log is attached as well.

Thanks in advance

[jholland1964]

First of all you still do have a vundo infection on the computer.
Removal Steps:

1. Download Vundo Fix and save it to your desktop.

• Double-click VundoFix.exe to run it.
• Click the Scan for Vundo button.
• Once it's done scanning, click the Remove Vundo button.
• You will receive a prompt asking if you want to remove the files, click Yes
• Once you click yes, your desktop will go blank as it starts removing Vundo.
• When completed, it will prompt that it will reboot your computer, click OK.

Note: It is possible that VundoFix encountered a file it could not remove.
In this case, VundoFix will run on reboot, simply follow the above instructions starting from Click the Scan for Vundo button when VundoFix appears at reboot.

• Please post the contents of C:\vundofix.txt and a new HiJackThis log.

[Bryanr]

I ran vundofix twice - no infections found
I reinstalled Vundofix and ran it 2 more times - no infections found
I rebooted and ran Vundofix twice more - still no infections found

Still getting unsolicited popups

[Bryanr]

oops forgot the vundofix.txt