trojan.vundo.h -- help, please! Options

[xTINAA]

I've tried researching this all over the internet and I cannot get this virus off of my roommate's computer. I've read that I should use Malwarebyte's Anti-Malware and then it will delete the virus. I have scanned the computer several times (with Malwarebyte) and it always shows up that there are 4 items infected. 3 of them are registry keys and 1 is a file. All four are the trojan.vundo.h. I try to remove all items and it says they will all delete on reboot, but even after the computer reboots, it still stays infected because I scan the computer again and the 4 items are STILL there. The logfile is always the same, saying that they will be deleted on reboot. What do I do?! Now I cannot access the internet on her computer (through IE) even though our connection is perfect because I can access the internet on another computer.

Can someone please help??

[xTINAA]

How can I install it on her computer if her computer can't access the internet? :( I don't know if its because of that virus (I don't really know anything about how this virus works) but her computer says its connected to the wireless internet.

[Uronacid]

How can I install it on her computer if her computer can't access the internet? :( I don't know if its because of that virus (I don't really know anything about how this virus works) but her computer says its connected to the wireless internet.

Chances are she has a rouge device river installed on her computer.

Can you access regedit from Start>Run? Can you access cmd from Start>Run? If you answer yes to both of these then you may have to do the following.

1. Rename your regedit.exe located in c:\windows to a file like pctech.exe then double click and open your registry.
2. Browse to the following location. HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32. You'll see an entry called aux2 and if you double click it you will see the file path.
3. Goto the path of the viral file (mine was "C:\\WINDOWS\\system32\\..\\bbk.igj"), in my case it was called: bkk.igj
4. Click start then go to run and paste the path and click ok.
5. You should see the file listed there. If not you may have to turn on hidden files.
6. Use TrendMicro Hijackthis to delete the file on reboot, and remove the registry entry from the registry

This came from a trouble ticket that I completed at work.


C:\\WINDOWS\\system32\\..\\bbk.igj = C:\WINDOWS\SYSTEM32\..\bbk.igj = C:\WINDOWS\bbk.igj