Trojan Vundo RUNDLL help

Asylum · Posted: Sat, 02 Feb 2008 02:04:42 Post Subject: Trojan Vundo RUNDLL help

Hey guys remember me? Been a while.

One of my hunting buddies talked me into fixing his computer for him.

He ended up with a virus (called trojan vundo) that caused relentless popups. I was able to successfully remove the virus with a program called "vundofix" but now I get two errors that come up when I log into windows. Both of them are RUNDLL errors. The first says "error loading C:\WINDOWS\system32\qvsbnkpc.dll" and the second "error loading C:\WINDOWS\system32\aoijlbsy.dll" they both also say "the specific module cannot be found."

Does anyone know how to remove these errors or at least keep them from displaying at startup? Any help would be appreciated.

BeerCheeze · Posted: Sat, 02 Feb 2008 12:36:13 Post Subject:

Try looking through what Symantec says, specially the registry entries. That's where I bet you're getting the errors from:

http://www.symantec.com/security_response/writeup.jsp?docid=2004-112111-3912-99&tabid=3

Asylum · Posted: Sat, 02 Feb 2008 15:08:22 Post Subject:

Cheeze your a stud.

I actually had been to that same page looking for a Vundo removal tool and got one from them called fixvundo, it didn't work. so I gave up on there website all together. Laughing

Thanks, all is well again.

BeerCheeze · Posted: Sat, 02 Feb 2008 18:53:41 Post Subject:

Big B · Rated NC-17 Joined: 30 Apr 2006 Posts: 194

Try rebooting the system in safe mode

Goto the system 32 folder and remove this file if it is there. C:\WINDOWS\system32\qvsbnkpc.dll"

Do the same for this file
aoijlbsy.dll"

They may be hidden so you may have to change the file type thing to show hidden files. More in less these files are trying to run but the program that they need is gone so they dont start so you get that error,you should be able to remove the two files and problem should be fixed.But Vundo is bad and might be more to it.(rootkit)

Big B · Rated NC-17 Joined: 30 Apr 2006 Posts: 194

hello, did what said to try todo fix the problem?

Asylum · Posted: Thu, 14 Feb 2008 11:56:00 Post Subject:

Yes the problem was fixed. The registry errors were found on the symantec website here: http://www.symantec.com/security_response/writeup.jsp?docid=2004-112111-3912-99&tabid=3