Windows XP and trojan.vundo

nobody is showing u any attitude.Infact Vinay is trying to explain and discuss but you are not
ready to listen to anyone..n plz dont double post..

abid,i think you have got your answer...hope you would make a note of this...keep sharing your knowledge

thatts gr8 abid i liked ur temprament to fight for ur point
i can confirm that u have good idea about virus
hope we will again have some healthy fruitful discussion on some other topic
it all sharing knowledge which makes us better. no one is perfect
thatns for the information dudu
gym

abid861 wrote:when a TEAM member tries to show some atitude or efficiency, then I have right to act stubborn

You did a little mistake..
I just explained this topic in my way.. Is it attitude ?
Be Positive ! No one is perfect... that's why pencils have erasers

abid861 wrote:I guess u better read carefully.. and try it then. its a two step procedure, first to run the group policies configuration after that perform the second step

It means 1- From Group Policy Editor and 2- From the Run Menu are two steps of a particular way.. ?

Ok, Check this and answer me

Enable/Disable Regeditor using the Group Policy Editor

Click Start, Run and type gpedit.msc and press ENTER
Go to the following location:

Code:

User Configuration | Administrative Templates | System

Double-click Disable registry editing tools and set it to Not Configured
Exit the Group Policy Editor..

PROBLEM SOVED !!!

Oops! I think this method is same with your first way i mean first step

check this out:

abid861 wrote:1- From Group Policy Editor
Go to Run –> gpedit.msc
In the left hand menu, go to User Config –> Administrative Templated –> System.
Now In the right hand pane, select “Prevent access to registry editing tools”. It will probably be not configured or enabled. If it’s enabled, disable it and if it’s not configured, first enable it, apply settings and then disable it.

This error occurs if the DisableRegistryTools Policy is enabled.

If the problem has been solved in the 1st step then what the next step you gonna apply ? Hm ?

It means the problem will be solved in your first step then why you've posted the second one ?

abid861 wrote:its the way how you preceived "two ways"

can someone please differentiate these two terms: step and way ?

abid861 wrote:How to remove...!
its v.easy to remove. when you enable your task manager and/or registory editor... bring up the task manager and end the torjan's process...

trojan processes

.exe
winlogon.exe

Ok.. all files removed ! But Its a temporary process..
What about vundo's registries ?

We have to DELETE all the registries of trojan.vundo using the registry editor if we want to remove it completely..

Here is the next step:

Find and Delete the following entries

Code:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02F96FB7-8AF6-439B-B7BA-2F952F9E4800}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ Browser Helper Objects\{02F96FB7-8AF6-439B-B7BA-2F952F9E4800}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2353FCBC-012D-487B-8BF3-865C0929FBEB}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ATLDistrib.ATLDistrib\CLSID\
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ATLDistrib.ATLDistrib.1\CLSID\
HKEY_USERS\S-1-5-21-2068663838-1736639611-1443527720-500\Software\Microsoft\Windows \CurrentVersion\Ext\Stats\{2353FCBC-012D-487B-8BF3-865C0929FBEB}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{22E85F2A-4A67-4835-B2C3-C575FE4EC322}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ADOUsefulNet.ADOUsefulNet
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ADOUsefulNet.ADOUsefulNet.1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{22E85F2A-4A67-4835-B2C3-C575FE4EC322}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DE8BDE42-16D9-4CCC-9F4F-1C3167B82F60}
HKEY_CLASSES_ROOT\CLSID\{DE8BDE42-16D9-4CCC-9F4F-1C3167B82F60}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\DPCUpdater.DPCUpdater
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\DPCUpdater.DPCUpdater.1

Now you are completely free from trojan.vundo...

We can also remove it using a little tool (Made by symantec)

Download: Trojan.Vundo Remover click twice on the exe file to execute it (first extract the exe using WinRAR)..

@abid, I thought it is a friendly discussion but you are taking it in a wrong way..
So, no more replies from my side
I don't have to attend every argument I'm invited to.

thank you !

How I missed this topic

However guys, we've now very clear explaination regarding trojan.vundo

Happy to see gym bro again and is former tech of this forum.

Abid bro, first i've to thank for you that you've share a nice topic

look, normally anyone can add comments for the topic and here our forum tech add his comments. its gr8 and appreciate that, thats all

this is a place to share ideas, comments and etc..
not a place to prove genius

and abid bro. u done a gr8 job here
in future, we hope more from you like this useful tips

My special thanks to vinay bro.
Keep it up

excellent staff vinay...everything is damn clear now...i think abid got the difference between the two ways and two steps...have nice time guys

vinay dude heated discussion is good u shoul not loose uR cool
everyone can be wrong
the discussion with moRe passion the forum gets more intresting
challenging other post is inpiration
so take it easy
its all in the game

thanks! ...

man! cool signature !... haahh!

We have all about trojan.vundo here

Discussion Over !

Topic Locked !