# Tech guys. A little help... **URL:** \ **Category:** Shift518 Off Topic\ **Created:** [October 21, 2009, 8:16am UTC](https://forums.speedlife.net/t/tech-guys-a-little-help/247749 "2009-10-21T08:16:59Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![99FRC](https://yyz2.discourse-cdn.com/flex034/user_avatar/forums.speedlife.net/99frc/32/6335_2.png) [@99FRC](https://forums.speedlife.net/u/99FRC)\ **Post date:** [October 21, 2009, 8:16am UTC](https://forums.speedlife.net/t/tech-guys-a-little-help/247749/1 "2009-10-21T08:16:59Z")
I have a customer PC with a virus that I just can’t beat. It is showing up on my scans as a Trojan.Vundo. A relatively simple virus that I have never had an issue defeating in the past. However none of the normal registry entries for this virus are present? Therefore I can’t delete it. I have even tried using Vundo removal software, and the virus is just simply not detected. The symptoms are by the book for a Vundo, including massive numbers of IE Popups, etc. Anyone have any ideas on where else the virus could be hiding? Also, I do am trying to avoid the factory restore. Which is why I am going through all of this trouble. Any help appreciated. ---
**Author:** ![Shady](https://avatars.discourse-cdn.com/v4/letter/s/6de8d8/32.png) [@Shady](https://forums.speedlife.net/u/Shady)\ **Post date:** [October 21, 2009, 8:23am UTC](https://forums.speedlife.net/t/tech-guys-a-little-help/247749/2 "2009-10-21T08:23:31Z")
> [@Welcome to the old people's club JayS](https://forums.speedlife.net/t/welcome-to-the-old-peoples-club-jays/24726/10): > > I have a customer PC with a virus that I just can’t beat. It is showing up on my scans as a Trojan.Vundo. A relatively simple virus that I have never had an issue defeating in the past. However none of the normal registry entries for this virus are present? Therefore I can’t delete it. > > I have even tried using Vundo removal software, and the virus is just simply not detected. The symptoms are by the book for a Vundo, including massive numbers of IE Popups, etc. > > Anyone have any ideas on where else the virus could be hiding? > > Also, I do am trying to avoid the factory restore. Which is why I am going through all of this trouble. Any help appreciated. Honestly dude IMO if it takes more than an hour to try and get a virus off, back up what you can and restore it. Dicking around to much is doing nothing but wasting your time and the customers. Anyways Im not sure if you just tried a virus scan saw what it was and then tried to remove it, if not use Malwarebytes see if something else is hiding in there… If you have bootable software such as avast/norton/Eset or Dr Webb that will do a bootable scan than give those a try. Sometimes dude certain viruses get so embedded its nearly impossible to get rid of them without spending hours on it. IMO it just wouldent be worht it to me. ---
**Author:** ![Ilya](https://yyz2.discourse-cdn.com/flex034/user_avatar/forums.speedlife.net/ilya/32/6404_2.png) [@Ilya](https://forums.speedlife.net/u/Ilya)\ **Post date:** [October 21, 2009, 8:24am UTC](https://forums.speedlife.net/t/tech-guys-a-little-help/247749/3 "2009-10-21T08:24:38Z")
Don’t do jack shit besides download and run ComboFix. You’ll thank me. I beat EVERY virus with this utility. [http://www.forospyware.com/sUBs/ComboFix.exe](http://www.forospyware.com/sUBs/ComboFix.exe) My coworker (also a tech) just gave me a laptop he couldn’t beat. I ran ComboFix, then CCleaner to clean it up some more, ComboFix again (only take 10 minutes per run) and the machine is no longer having any issues. He’s ready to ship it back out to the agent in Buffalo. The virus the laptop had wouldn’t allow you to open task manager. Even in Safemode. ---
**Author:** ![Shady](https://avatars.discourse-cdn.com/v4/letter/s/6de8d8/32.png) [@Shady](https://forums.speedlife.net/u/Shady)\ **Post date:** [October 21, 2009, 8:25am UTC](https://forums.speedlife.net/t/tech-guys-a-little-help/247749/4 "2009-10-21T08:25:49Z")
> [@Sale feedback?](https://forums.speedlife.net/t/sale-feedback/24732/2): > > Don’t do jack shit besides download and run ComboFix. > > You’ll thank me. I beat EVERY virus with this utility. > > [ForoSpyware](http://www.forospyware.com/sUBs/ComboFix.exe) Ehh, Ive come across quite a few that ComboFix hasnt been able to get rid of, but it is a great utility. ---
**Author:** ![99FRC](https://yyz2.discourse-cdn.com/flex034/user_avatar/forums.speedlife.net/99frc/32/6335_2.png) [@99FRC](https://forums.speedlife.net/u/99FRC)\ **Post date:** [October 21, 2009, 8:49am UTC](https://forums.speedlife.net/t/tech-guys-a-little-help/247749/5 "2009-10-21T08:49:59Z")
Thanks I am going to try that utility now. infinite plus rep if it works… ---
**Author:** ![Boost\_Creep](https://yyz2.discourse-cdn.com/flex034/user_avatar/forums.speedlife.net/boost_creep/32/6366_2.png) [@Boost\_Creep](https://forums.speedlife.net/u/Boost_Creep)\ **Post date:** [October 21, 2009, 8:52am UTC](https://forums.speedlife.net/t/tech-guys-a-little-help/247749/6 "2009-10-21T08:52:39Z")
Malware Bytes got rid of it for me btw. ---
**Author:** ![swaiknow](https://yyz2.discourse-cdn.com/flex034/user_avatar/forums.speedlife.net/swaiknow/32/6359_2.png) [@swaiknow](https://forums.speedlife.net/u/swaiknow)\ **Post date:** [October 21, 2009, 9:21am UTC](https://forums.speedlife.net/t/tech-guys-a-little-help/247749/7 "2009-10-21T09:21:55Z")
> [@Sale feedback?](https://forums.speedlife.net/t/sale-feedback/24732/2): > > Don’t do jack shit besides download and run ComboFix. > > You’ll thank me. I beat EVERY virus with this utility. > > [ForoSpyware](http://www.forospyware.com/sUBs/ComboFix.exe) > > My coworker (also a tech) just gave me a laptop he couldn’t beat. I ran ComboFix, then CCleaner to clean it up some more, ComboFix again (only take 10 minutes per run) and the machine is no longer having any issues. He’s ready to ship it back out to the agent in Buffalo. The virus the laptop had wouldn’t allow you to open task manager. Even in Safemode. thanks for the program dude. i just ran it on my laptop, and it deleted a SHITLOAD of useless garbage! ---
**Author:** ![Ilya](https://yyz2.discourse-cdn.com/flex034/user_avatar/forums.speedlife.net/ilya/32/6404_2.png) [@Ilya](https://forums.speedlife.net/u/Ilya)\ **Post date:** [October 21, 2009, 9:59am UTC](https://forums.speedlife.net/t/tech-guys-a-little-help/247749/8 "2009-10-21T09:59:25Z")
No problem. I found it while being owned by a virus last summer at work. ---
**Author:** ![RocketPunch](https://yyz2.discourse-cdn.com/flex034/user_avatar/forums.speedlife.net/rocketpunch/32/6429_2.png) [@RocketPunch](https://forums.speedlife.net/u/RocketPunch)\ **Post date:** [October 21, 2009, 10:09am UTC](https://forums.speedlife.net/t/tech-guys-a-little-help/247749/9 "2009-10-21T10:09:45Z")
FDISK Format will take care of it :lol:lol:lol ---
**Author:** ![99FRC](https://yyz2.discourse-cdn.com/flex034/user_avatar/forums.speedlife.net/99frc/32/6335_2.png) [@99FRC](https://forums.speedlife.net/u/99FRC)\ **Post date:** [October 21, 2009, 11:18am UTC](https://forums.speedlife.net/t/tech-guys-a-little-help/247749/10 "2009-10-21T11:18:20Z")
> [@Music Making Programs](https://forums.speedlife.net/t/music-making-programs/24736/4): > > FDISK Format will take care of it :lol:lol:lol Sure would!! I am beginning to think that this has become the Chuck Norris virus though. Everything I throw at it gets thrown back at me and can feel the pain and hear the “pshh” sound like in Walker Texas Ranger when hes kicking some guys head in. If I did use Linux to format the HDD, it would probably chew up Linux and spit back out, all the while teleporting the bad virus to all known Linux system in the world, destroying the system as we know it. Seriously, though, this is a tough one. ---
**Author:** ![Ilya](https://yyz2.discourse-cdn.com/flex034/user_avatar/forums.speedlife.net/ilya/32/6404_2.png) [@Ilya](https://forums.speedlife.net/u/Ilya)\ **Post date:** [October 21, 2009, 11:35am UTC](https://forums.speedlife.net/t/tech-guys-a-little-help/247749/11 "2009-10-21T11:35:30Z")
ComboFix didn’t work? ---
**Author:** ![99FRC](https://yyz2.discourse-cdn.com/flex034/user_avatar/forums.speedlife.net/99frc/32/6335_2.png) [@99FRC](https://forums.speedlife.net/u/99FRC)\ **Post date:** [October 21, 2009, 11:44am UTC](https://forums.speedlife.net/t/tech-guys-a-little-help/247749/12 "2009-10-21T11:44:58Z")
> [@Picture needed - twint turbo honda (?) 4banger from 2005 carlisle](https://forums.speedlife.net/t/picture-needed-twint-turbo-honda-4banger-from-2005-carlisle/24741/5): > > ComboFix didn’t work? It just finished and yes it did work. It is the only thing out of a bunch of things I have tried including manual deletion. It will forever be in my “toolbox”. Awesome and plus rep to Ilya for recommending. ---
**Author:** ![Ilya](https://yyz2.discourse-cdn.com/flex034/user_avatar/forums.speedlife.net/ilya/32/6404_2.png) [@Ilya](https://forums.speedlife.net/u/Ilya)\ **Post date:** [October 21, 2009, 12:17pm UTC](https://forums.speedlife.net/t/tech-guys-a-little-help/247749/13 "2009-10-21T12:17:46Z")
Awesome. Yeah I run that first before I run anything else when trying to get rid of nasty stuff. That and CCleaner (CCleaner more for the registry side than the application side). Glad to see that it worked for you. I haven’t had it fail on me yet. Add this bout to the list haha. ---
**Author:** ![black\_bb4](https://avatars.discourse-cdn.com/v4/letter/b/ed655f/32.png) [@black\_bb4](https://forums.speedlife.net/u/black_bb4)\ **Post date:** [October 21, 2009, 1:47pm UTC](https://forums.speedlife.net/t/tech-guys-a-little-help/247749/14 "2009-10-21T13:47:17Z")
> [@Sale feedback?](https://forums.speedlife.net/t/sale-feedback/24732/2): > > Don’t do jack shit besides download and run ComboFix. > > You’ll thank me. I beat EVERY virus with this utility. > > [ForoSpyware](http://www.forospyware.com/sUBs/ComboFix.exe) > > My coworker (also a tech) just gave me a laptop he couldn’t beat. I ran ComboFix, then CCleaner to clean it up some more, ComboFix again (only take 10 minutes per run) and the machine is no longer having any issues. He’s ready to ship it back out to the agent in Buffalo. The virus the laptop had wouldn’t allow you to open task manager. Even in Safemode. damn, i know i have a couple little things on my comp that shouldnt be there, and i would love to run this program, but the link is all in spanish and i cant figure that shit out :lol ---
**Author:** ![Alpine](https://avatars.discourse-cdn.com/v4/letter/a/4da419/32.png) [@Alpine](https://forums.speedlife.net/u/Alpine)\ **Post date:** [October 21, 2009, 1:55pm UTC](https://forums.speedlife.net/t/tech-guys-a-little-help/247749/15 "2009-10-21T13:55:53Z")
Basically take what Shady says, and do the complete opposite. :lol ---
**Author:** ![Ilya](https://yyz2.discourse-cdn.com/flex034/user_avatar/forums.speedlife.net/ilya/32/6404_2.png) [@Ilya](https://forums.speedlife.net/u/Ilya)\ **Post date:** [October 21, 2009, 1:56pm UTC](https://forums.speedlife.net/t/tech-guys-a-little-help/247749/16 "2009-10-21T13:56:00Z")
> [@real or fake ghosts](https://forums.speedlife.net/t/real-or-fake-ghosts/24745/4): > > damn, i know i have a couple little things on my comp that shouldnt be there, and i would love to run this program, but the link is all in spanish and i cant figure that shit out :lol Hmm…they must have deleted the direct link. Here is another link to download it: [http://download.bleepingcomputer.com/sUBs/ComboFix.exe](http://download.bleepingcomputer.com/sUBs/ComboFix.exe) ---
**Author:** ![Shady](https://avatars.discourse-cdn.com/v4/letter/s/6de8d8/32.png) [@Shady](https://forums.speedlife.net/u/Shady)\ **Post date:** [October 21, 2009, 2:08pm UTC](https://forums.speedlife.net/t/tech-guys-a-little-help/247749/17 "2009-10-21T14:08:49Z")
> [@Another project....](https://forums.speedlife.net/t/another-project/24748/2): > > Basically take what Shady says, and do the complete opposite. :lol Yeah yeah yeah… I gave hime good advice… ComboFix is a great tool and I deffinatly use it on stubborn shit but ive had it fail on me in tough virus situations such as the one 99 was experiancing, along with it corrupting system files when doing so with virus that were deep down in. I had a virus much like the one 99 described about a month back, nothing worked on it… Honestly if I have to spend more than an hour or hour and a half on a computer, Ill back it up and reformat, its honestly not worth the headache to try and get rid of something and fix anything it corrupts. 90% of the time a person isnt even aware that I reformat it unless theres some random program that I couldet get ahold of. Im sure Ilya and 99 know, even when it appears as thou a virus is gone, sometimes it comes back to bite you in the ass. ---
**Author:** ![Ilya](https://yyz2.discourse-cdn.com/flex034/user_avatar/forums.speedlife.net/ilya/32/6404_2.png) [@Ilya](https://forums.speedlife.net/u/Ilya)\ **Post date:** [October 21, 2009, 2:16pm UTC](https://forums.speedlife.net/t/tech-guys-a-little-help/247749/18 "2009-10-21T14:16:31Z")
99FRC, if you’re worried about possible system files issues…put in your OS CD (probably XP?) and run _sfc /scannow_ from the command prompt. This will replace any corrupt/fishy DLL’s and SYS files. And Shady’s advice was fine. I also reformat when it gets to a certain time point. Not worth charging the user more and more. I don’t work that way. I’m honest and try to give them the best bang for the buck. ---
**Author:** ![crAppAchic0](https://yyz2.discourse-cdn.com/flex034/user_avatar/forums.speedlife.net/crappachic0/32/6306_2.png) [@crAppAchic0](https://forums.speedlife.net/u/crAppAchic0)\ **Post date:** [October 21, 2009, 2:20pm UTC](https://forums.speedlife.net/t/tech-guys-a-little-help/247749/19 "2009-10-21T14:20:30Z")
> [@If you are sitting next to someone who irritates you on a plane or train..](https://forums.speedlife.net/t/if-you-are-sitting-next-to-someone-who-irritates-you-on-a-plane-or-train/24749/2): > > 99FRC, if you’re worried about possible system files issues…put in your OS CD (probably XP?) and run _sfc /scannow_ from the command prompt. This will replace any corrupt/fishy DLL’s and SYS files. > > And Shady’s advice was fine. I also reformat when it gets to a certain time point. Not worth charging the user more and more. I don’t work that way. I’m honest and try to give them the best bang for the buck. ‘sfc’ will replace the files with the original versions from the disc you’re running- i.e., if you’ve installed SP2 or whatever, the files replaced in the SP install will be replaced by whatever file versions are on the disc sfc is referencing… we’ve run into that a time or two. ---
**Author:** ![Ilya](https://yyz2.discourse-cdn.com/flex034/user_avatar/forums.speedlife.net/ilya/32/6404_2.png) [@Ilya](https://forums.speedlife.net/u/Ilya)\ **Post date:** [October 21, 2009, 2:23pm UTC](https://forums.speedlife.net/t/tech-guys-a-little-help/247749/20 "2009-10-21T14:23:33Z")
It’s saved my ass a few times with BSoD’s, etc. If you have SP2, just use an SP2 CD…etc. For me, that’s easily done as I have all sorts of XP CD’s. [Next page](https://forums.speedlife.net/t/tech-guys-a-little-help/247749.md?page=2)