Windows Defender detection of Vundo trojan

Windows Defender detection of Vundo trojan

Secure Home | Search | About

Microsoft Applications Security - Microsoft's general security discussions and announcements 

Bookmark this page:  YahooMyWeb Yahoo!  Google Google  Windows Live Favorites Windows Live  del.icio.us del.icio.us  digg digg  Add to Netscape Netscape
Subject Author Date
Windows Defender detection of Vundo trojan ColBla 08-10-2008
Posted by =?Utf-8?B?Q29sQmxh?= on August 10, 2008, 3:15 pm
If you were  Registered and logged in, you could reply and use other advanced thread options


Apologies if this is the wrong board for this - if so, happy to re-post in a
more appropriate place, just tell me where !

Windows Defender keeps reporting an infection with Vundo.gen!E. The advice
on the MS site says remove it using an AV program. I use McAfee, but when I
run a scan it can't find it - checking the update status of McAfee, I have
the right updates that should detect this version of Vundo. So I can't
actually follow the "how to remove" advice. So is Defender giving a false
positive, or should I be really worried because I seem to have an infection
that McAfee can't find ? Any advice on how to proceed gratefully received.

Not sure whether this is relevant or not, but since getting the first Vundo
detections, in the same account that apparently hosts Vundo, the user gets a
message on logon to the effect that the system can't find a file
opnkjghf.dll. Could this be related to the Vundo problem ?

System:
XPSP2
IE7
Windows Live Mail
Windows auto-update checked ON
AV & Firewall: McAfee, latest engines & updates installed.

Thanks in advance

Posted by Milo on August 11, 2008, 12:55 am
If you were  Registered and logged in, you could reply and use other advanced thread options


Be advised the Vundo.Gen!E - Gen correspond to generic detection its based
on a heuristic pattern wherein a finger print code of the vundo is visible
and was seen on such file
that its why its being tagged as a part of Vundo family.

> Apologies if this is the wrong board for this - if so, happy to re-post in
> a
> more appropriate place, just tell me where !
>
> Windows Defender keeps reporting an infection with Vundo.gen!E. The advice
> on the MS site says remove it using an AV program. I use McAfee, but when
> I
> run a scan it can't find it - checking the update status of McAfee, I have
> the right updates that should detect this version of Vundo. So I can't
> actually follow the "how to remove" advice. So is Defender giving a false
> positive, or should I be really worried because I seem to have an
> infection
> that McAfee can't find ? Any advice on how to proceed gratefully received.
>
> Not sure whether this is relevant or not, but since getting the first
> Vundo
> detections, in the same account that apparently hosts Vundo, the user gets
> a
> message on logon to the effect that the system can't find a file
> opnkjghf.dll. Could this be related to the Vundo problem ?
>
> System:
> XPSP2
> IE7
> Windows Live Mail
> Windows auto-update checked ON
> AV & Firewall: McAfee, latest engines & updates installed.
>
> Thanks in advance


Posted by Blackavar on August 25, 2008, 4:51 pm
If you were  Registered and logged in, you could reply and use other advanced thread options


Blackavar had written this in response to
http://www.secure-gear.com/microsoft.public.security/7/Windows-Defender-detection-of-Vundo-trojan-article24813-.htm
:


-------------------------------------
=?Utf-8?B?Q29sQmxh?= wrote:




> Apologies if this is the wrong board for this - if so, happy to re-post
> in a
> more appropriate place, just tell me where !

> Windows Defender keeps reporting an infection with Vundo.gen!E. The
> advice
> on the MS site says remove it using an AV program. I use McAfee, but
> when I
> run a scan it can't find it - checking the update status of McAfee, I
> have
> the right updates that should detect this version of Vundo. So I can't
> actually follow the "how to remove" advice. So is Defender
> giving a false
> positive, or should I be really worried because I seem to have an
> infection
> that McAfee can't find ? Any advice on how to proceed gratefully
> received.

> Not sure whether this is relevant or not, but since getting the first
> Vundo
> detections, in the same account that apparently hosts Vundo, the user
> gets a
> message on logon to the effect that the system can't find a file
> opnkjghf.dll. Could this be related to the Vundo problem ?

> System:
> XPSP2
> IE7
> Windows Live Mail
> Windows auto-update checked ON
> AV & Firewall: McAfee, latest engines & updates installed.

> Thanks in advance


Vundo is good at hiding. If you want to ensure that you do not have an
infection.
1. run msconfig.msc
2. Under the Startup Tab remove checkmarks next to each program
Note: vundo usually uses rundll32 to run its self at startup
3. Apply changes and reboot
4. download and install Windows Defender from Microsoft
5. download the definition file from MS.
http://www.microsoft.com/security/portal/ADL.aspx
Note: Windows update can be used to retrieve the latest definition, but
vundo disables Windows update.
6. Perform a full scan, if vundo is located you will have the option to
quarantine or remove it.
7. Once finished you may not re-enable startup programs and restart the
machine.

Note: Until vundo is killed or undable to run, it will continue to protect
its self by creating xml files in your system32 dir and renaming them to
random file names ending with the extention .dll. PKini seems to be
another related file.




##-----------------------------------------------##
Delivered via
http://www.secure-gear.com
The Internet Knowledge Base for the security industry
no-spam access to your favorite newsgroup -
microsoft.public.security - 24681
messages and counting!
##-----------------------------------------------##


Similar ThreadsPosted
Trojan 'Vundo' December 30, 2005, 7:23 pm
Downloader & Vundo? June 11, 2007, 12:25 am
Vundo Virus! Heeeelp! January 4, 2009, 1:01 pm
Windows Defender/Windows Live One Care March 22, 2008, 10:21 pm
Trojan horse Clicker.BGC--------- C:\WINDOWS\system32 January 4, 2006, 1:53 am
WARNING: Winfixer and Errorsafe [AKA Vundo] being distributed via WL/MSN Messenger banner ads February 18, 2007, 10:53 am
WINDOWS DEFENDER May 13, 2006, 8:16 pm
Windows Defender May 15, 2006, 9:59 am
Windows Defender May 22, 2006, 12:26 pm
Windows Defender November 13, 2006, 6:46 am

The site map in XML format XML site map

Contact Us | Privacy Policy