1 min read

How To Remove Trojan.Vundo

Bogdan Botezatu

July 01, 2008

Promo Protect all your devices, without slowing them down.
Free 30-day trial
How To Remove Trojan.Vundo

Many users who had to deal with a Vundo infection on their computer know how hard it is to remove. It usually copies itself into %windows%system32 with a 5 to 7 characters long random name, and executes at windows startup.

We. at Malware City, have taken a closer look at this threat and have come up with a removal guide for the latest versions. In order to do so, we have used two freely available applications: AutoRuns and process explorer. Before starting our guide, please download them from the links provided.


Now, in order to make sure you are indeed infected with the correct versions of Vundo this guide has been written for, please follow these steps:



1. Start AutoRuns



2. Navigate to the Winlogon tab



3. Locate a dll file with random name residing in %windows%system32 (often also without Description and Publisher)


 


Autoruns

 


4. Write down that filename



5. Start Process Explorer



6. In the upper menu navigate to the Find button and select

tags


Author



You might also like

Bookmarks


loader