Trojan.agent.sd6! removal?

[Alan T]

Originally Posted by Eaglesfan27

Is it possible that FOFC is somehow spreading the virus? .

What parts of this site do you go to? The parts I visit, I have not seen anything that would have likely done this. (ie: someone hacking the server and implanting an invisible iframe or such). If you visit parts of the operationsports site that I don't, I can take a look there to see if I notice anything.

I just visit these forums is all I go to. Unless there is something in the sitemeter counter or such that is doing it (since I block the scripting for that in my browser).

[Eaglesfan27]

I'm just going to the forums as well. I don't have ad-blocker or anything like that, so I see the various ads on the top of the page. Anyway, either the virus has mutated or something that my work runs for virus protection is fighting against the malware removal program. Either way, I'm getting tons of errors when I try to run the program that beat this trojan on my home computer and I had no luck removing it before I had to leave work today. I guess I'll turn it over to IT.

[DaddyTorgo]

friggin weird. i'd think that might be it, but i ran a virus scan this weekend and a malware scan and didn't see it on my home-laptop...

[Alan T]

Originally Posted by Eaglesfan27

I'm just going to the forums as well. I don't have ad-blocker or anything like that, so I see the various ads on the top of the page. Anyway, either the virus has mutated or something that my work runs for virus protection is fighting against the malware removal program. Either way, I'm getting tons of errors when I try to run the program that beat this trojan on my home computer and I had no luck removing it before I had to leave work today. I guess I'll turn it over to IT.

Oh, I don't see the ads above. I have heard of sites having a particular advertisement hijacked with some infected code though.

It is pretty unusual for a decent sized group of individuals to all get hit by the exact same variation of a trojan at roughly the same time though. If many of you are getting the exact same trojan on your systems, and all view the ad banners, that is something worth looking into.

Right now, the sample size here is pretty small though, so don't see any reason to raise the bat-signal until we have a bit more of something to go with.

[DaddyTorgo]

then again i have this home-computer locked down much tighter than the work computer. my best bet would be to run a scan on the work computer tomorrow...

[Eaglesfan27]

Originally Posted by Alan T

Right now, the sample size here is pretty small though, so don't see any reason to raise the bat-signal until we have a bit more of something to go with.

Agreed. I just threw it out there as a thought during the "oh shit" moment of realizing my work computer is infected. Maybe it is something that I browsed (such as hotmail) a few days ago that suddenly struck. Who knows, but if we get a larger sample size, it might be worth investigating further.

[Maple Leafs]

I had been on FOFC shortly before I got the trojan too.

[st.cronin]

Originally Posted by Maple Leafs

I had been on FOFC shortly before I got the trojan too.

I got this trojan just after visiting this very thread, fwiw.

[jbergey22]

add me to this list

[DaddyTorgo]

fuckin weird. at what point does this stop being a small-sample-size?

[jbergey22]

FYI

For those of you not getting anywhere with Malwarebytes. Combo Fix saved me a couple of weeks ago my computer was running just like brand new until I suddenly ran into this Vundo problem.

I am going to do another complete clean and Ill let everyone knows how it goes..

1. Turn off system restore(sometimes viruses will regenerate this way)
2. Scan with Malwarebites
3. Run combo fix
4. Turn back on system restore
5. Reboot in safe mode
6. Run another scan and see if its gone

[jbergey22]

Ok this worked

You can download combofix from this website no cost

Just save it to your desktop

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Good luck

Here is a step by step from majorgeeks.com If you want to follow this

READ & RUN ME FIRST. Malware Removal Guide - MajorGeeks Support Forums

[CU Tiger]

one more victim....malware took it out. Feel like a dumb ass for not adding NS back in in a recent FF update...its back now

[Greyroofoo]

I think I got the same thing that bullet had. It was redirecting all my searches and messing with my anti-virus software.

The fix for me was going into device manager and disabling some service.

[Kodos]

I've had this on both my work and home computer.

[kcchief19]

I had the Vundo trojan strike Monday night. I think I may have been hit earlier because my Windows Update had been turned off. The day before the Trojan hit I ran Windows Update to apply the new IE fix. My computer rebooted following installation and all seemed well. When the trojan hit the next day, I went to Windows Update again and not only were automatic updates turned off again but the patch didn't install.

In an ill-advised move I tried to install the XP SP3 and totally lost control of my computer -- wouldn't boot to Windows. I had to go into safe mode and restore settings before I apply SP3. Unforunately, all of my reset points except for the one before I applied the IE fix and the one before SP3 were deleted. Don't know if that was the trojan or Microsoft genius at work.

Once I got control, two runs of Malwarebytes cleaned it up. Third run was completely clean.

[JW]

My daughter's laptop got to vundo virus, and I used the Windows Onecare Live safety scan to fix it. I have no idea how good this is, but it did fix that problem on my daughter's laptop when nothing else I had would.

http://onecare.live.com/site/en-us/default.htm

[Kodos]

It took Malwarebytes a couple runs to get both of my computers clean.