HOW TO REMOVE>>>TROJ_VUNDO.ATO ? - System Admin Discussion Boards

Re: run an EXE for all users on a computer

Mike Dimmick14-Jul-07 6:13

14-Jul-07 6:13

If you're an administrator, right-click the Start button and select Open All Users. That opens the folder to the right location.

Stability. What an interesting concept. -- Chris Maunder

Re: run an EXE for all users on a computer

Vasudevan Deepak Kumar17-Jul-07 4:29

Vasudevan Deepak Kumar

17-Jul-07 4:29

Windows service?

Vasudevan Deepak Kumar
Personal Homepage
Tech Gossips

procmon from Sysinternals

devvvy9-Jul-07 22:58

devvvy

9-Jul-07 22:58

Hi - is there a command line alternative to Sysinternals' procmon to monitor proesses running on a machine?

Thanks in advance

Re: procmon from Sysinternals

Vasudevan Deepak Kumar10-Jul-07 2:16

Vasudevan Deepak Kumar

10-Jul-07 2:16

I prefer TaskManager Extension from CodeProject. It is not a commandline but a rich GUI which plugs itself into the existing TaskManager.

Vasudevan Deepak Kumar
Personal Homepage
Tech Gossips

Re: procmon from Sysinternals

devvvy10-Jul-07 20:50

devvvy

10-Jul-07 20:50

pslist seems to do the job!

Re: procmon from Sysinternals

Sebastian Schneider10-Jul-07 23:04

Sebastian Schneider

10-Jul-07 23:04

Why would you recommend a GUI when he asked for a Commandline?

Cheers,
Sebastian

--
"If it was two men, the non-driver would have challenged the driver to simply crash through the gates. The macho image thing, you know." - Marc Clifton

Re: procmon from Sysinternals

Vasudevan Deepak Kumar12-Jul-07 20:35

Vasudevan Deepak Kumar

12-Jul-07 20:35

Sebastian Schneider wrote:
Why would you recommend a GUI

It actually is an extension only and available in Source. So you can try getting the source and integrate into any of the commandline application also. TME is not an independant application. It actually hooks up into the Windows (default) Task Manager.

Vasudevan Deepak Kumar
Personal Homepage
Tech Gossips

HOW TO REMOVE>>>TROJ_VUNDO.ATO ?

codingrocks9-Jul-07 19:13

codingrocks

9-Jul-07 19:13

i am using a WinXp machine in office. recently i found that there is a virus named TROJ_VUNDO.ATO in the machine..

i wanna get rid of this and clean it.....i tried VundoFix.exe..not working...
Here i can attach my Hijack Log file

Plz someone help me get rid of this.....

Thanx in advance....

Logfile of HijackThis v1.99.1
Scan saved at 10:42:14 AM, on 7/10/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Microsoft SQL Server\MSSQL\Binn\sqlservr.exe
C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe
C:\Program Files\Trend Micro\OfficeScan Client\ofcdog.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\TortoiseSVN\bin\TSVNCache.exe
C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\PROGRA~1\MICROS~3\rapimgr.exe
C:\Program Files\Microsoft Visual Studio 8\Common7\IDE\devenv.exe
C:\Program Files\Flock\flock\flock.exe
C:\Documents and Settings\Administrator\Desktop\VundoFix.exe
C:\Documents and Settings\Administrator\Desktop\hijackthis1991\HijackThis.exe

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {830675A3-6EEA-44C5-A464-83A939A0DD95} - C:\WINDOWS\system32\xkgplbvf.dll (file missing)
O2 - BHO: (no name) - {CD3447D4-CA39-4377-8084-30E86331D74C} - C:\WINDOWS\system32\pdobohaa.dll (file missing)
O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O4 - HKLM\..\Run: [S3Trayp] S3trayp.exe
O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe" -HideWindow
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [setup] rundll32.exe "C:\WINDOWS\system32\thyhpefp.dll",realset
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {00134F72-5284-44F7-95A8-52A619F70751} (ObjWinNTCheck Class) - http://192.168.1.3/officescan/ClientInstall/WinNTChk.cab
O16 - DPF: {08D75BC1-D2B5-11D1-88FC-0080C859833B} (OfficeScan Corp Edition Web-Deployment SetupCtrl Class) - http://192.168.1.3/officescan/clientinstall/setup.cab
O16 - DPF: {5EFE8CB1-D095-11D1-88FC-0080C859833B} (OfficeScan Corp Edition Web-Deployment ObjRemoveCtrl Class) - http://192.168.1.3/officescan/clientinstall/RemoveCtrl.cab
O16 - DPF: {66D393D5-4D80-497C-9F4F-F3839E090202} (PlayerOCX Control) - http://www.pysoft.com/Downloads/WebCamPlayerOCX.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = TELESOFTBLORE.COM
O17 - HKLM\Software\..\Telephony: DomainName = TELESOFTBLORE.COM
O17 - HKLM\System\CCS\Services\Tcpip\..\{5F6E2A4A-7F0F-44C2-84AE-A389334EA3F5}: NameServer = 192.168.1.3,85.255.112.99
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = TELESOFTBLORE.COM
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = TELESOFTBLORE.COM
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O20 - Winlogon Notify: winxnz32 - C:\WINDOWS\SYSTEM32\winxnz32.dll
O23 - Service: SQL Server (SQLEXPRESS) (MSSQL$SQLEXPRESS) - Unknown owner - C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe" -sSQLEXPRESS (file missing)
O23 - Service: Visual Studio 2005 Remote Debugger (msvsmon80) - Unknown owner - C:\Program Files\Microsoft Visual Studio 8\Common7\IDE\Remote Debugger\x86\msvsmon.exe" /service msvsmon80 (file missing)
O23 - Service: OfficeScanNT RealTime Scan (ntrtscan) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe
O23 - Service: OfficeScanNT Listener (tmlisten) - Unknown owner - C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe

SAJAN A PILLAI

C#.NET Programmer
TELESOFT INDIA PVT LTD...
BANGALORE

Re: HOW TO REMOVE>>>TROJ_VUNDO.ATO ?

akseli14-Jul-07 3:17

akseli

14-Jul-07 3:17

Hello,
after a quick search at Symantec's threat library I found the following removal software for Trojan.Vundo: http://www.symantec.com/security_response/writeup.jsp?docid=2004-112111-3912-99&tabid=3[^]

Now, I'm not positive whether or not this will also remove Trojan.Vundo.ATO, but I'd recommend trying it. Download the software from symantec and follow their step-by-step instructions.

To avoid any further infections you should take care to keep your anti-viru's definitions up to date, preferably downloading daily definition updates.

Good luck!

Error in installation of VS6

sandeepkavade9-Jul-07 3:14

sandeepkavade

9-Jul-07 3:14

hi everybody,

i am trying to install VS6 just to review the old code on my machine (XP Prof SP2). but it is giving following error.

setup has encountered a problem in launching the followning command line:
"wpie15.exe" /q:a/r:n.
if you have a system directory that contains a % sign, or the directory names *starts* with a space (i.e. 'C:\win95\system'), then setup will fial. please restart setup and ensure your system directory names does not contain the aforementioned problems, setup will now abort...

i am having Visual Studio 2003 also installed on my machine. is this is the reason why i am getting this error. but i dont want to convert that code to VS2003 i have also uninstalled VS2003 and tried to install VS6. but still it is giving same error. i dont want to format my machine as it will take a couple of days to restore all the things.

Re: Error in installation of VS6

Paul Conrad14-Jul-07 13:48

Paul Conrad

14-Jul-07 13:48

Have you solved this problem?

"Any sort of work in VB6 is bound to provide several WTF moments." - Christian Graus

MSI Install Problems over UNC Share

martin_hughes9-Jul-07 3:01

martin_hughes

9-Jul-07 3:01

Hi All,

I have a shared folder on an SBS2003 Server. The folder contains an MSI, and the permissions on the folder give Everyone & Guest full access.

Whenever a user attempts to double click the MSI via the share (\\Server\Share1\folder\App.msi) Windows Installer pops up the following message "The Installation package could not be opened. Verify the package exists..." and the Event ID is: 11708 Install Operation Failed.

However, if a user maps a drive - such as Z:\ - and runs the msi, installation works fine.

I'm not sure what the problem here is... anyone got any ideas?

Thanks,

Martin.

Re: MSI Install Problems over UNC Share

akseli14-Jul-07 3:22

akseli

14-Jul-07 3:22

Hey,

there are two possibilities as far as I can tell ...

1. the windows installer package, when run from the shared folder, does not know how to parse its own 'home address' and thus tells you that it doesn't exist... In this case I think that your only solution is to have your users map the network drive in order to access the software.

2. it's also possible that, since users enter a username and password (I'm supposing they are) when mapping the network drive, they are getting different permissions to the file than when they access the share. You should make sure that users are not accessing the shared folder as a 'guest' or 'anonymous' user. Also, you might want to check your permissions to make sure that "Eeveryone" and "Guest" have the "Execute" box checked off, as sometimes "Full Access" still leaves "execute" disabled.

I'm sorry that I can't be of any more help, good luck!

Akseli A.

Re: MSI Install Problems over UNC Share

martin_hughes14-Jul-07 4:38

martin_hughes

14-Jul-07 4:38

Hi Akseli,

Thanks for the suggestions -

akseli wrote:
the windows installer package, when run from the shared folder, does not know how to parse its own 'home address' and thus tells you that it doesn't exist... In this case I think that your only solution is to have your users map the network drive in order to access the software.

I think you may be on to something here - I think the developer is using an old version of the package tool (VB 6 or earlier), I shall have a go at using a more recent version of the tool.

Thanks,

Martin.

Unable to browse pages through IIS using IE7

pubududilena5-Jul-07 22:14

pubududilena

5-Jul-07 22:14

Hi,

We need to browse WebSites through IIS .Our Browser is IE7.

Go to ComputerManagement---->IIS-->WebSites--->xbrandsite-->public/default.aspx

When I Right click on the Default.aspx and select Browse,
The Page is not browssing.

So How Can I fix that error?.

Thanks in Advance..

Re: Unable to browse pages through IIS using IE7

originSH5-Jul-07 22:32

originSH

5-Jul-07 22:32

Define "not browsing".

It opens up but you get a 404? It doesn't even open up?

If you get an error then either IIS is configured wrong or the page is broken Wink | ;)

Re: Unable to browse pages through IIS using IE7

pubududilena5-Jul-07 22:48

pubududilena

5-Jul-07 22:48

It doesn't even open up.

Please help to solve the problem.

Re: Unable to browse pages through IIS using IE7

akseli14-Jul-07 3:44

akseli

14-Jul-07 3:44

Hey,

you might want to check to make sure that you have IE set as the default browser both for the whole OS and in IIS. I don't have a server right here to check, but I seem to recall that there is an option in IIS's preferences which asks you to tell it which broswer it should default to. In case that nothing is filled out you can simply type in 'iexplore.exe' and it should start working.

If you're going to be browsing dynamic pages you should also note that Windows Server 2003's IE security settings are extremely restricted and you should make it a point to review your LOCAL settings to make sure that you can correct display your pages.

Good luck!

Akseli A.

FTP Server Disabled

Tad McClellan5-Jul-07 8:37

Tad McClellan

5-Jul-07 8:37

Why is it when I log out of a machine the FTP Server disables itself? How do I keep this from happening?

TadMcClellan.Com

Re: FTP Server Disabled

Jeffrey Walton5-Jul-07 16:33

Jeffrey Walton

5-Jul-07 16:33

Hi Tad,

It sounds like it is tied to the logged on user. Can you verify where the server is starting? It should start as a System Service, or perhaps the Run key from the registry...

Jeff

IE7

stevepqr5-Jul-07 2:48

stevepqr

5-Jul-07 2:48

I just installed IE7 on a Toshiba Tecra laptop running XP Pro because of a minor irritation with IE6. I assumed that IE7 would remove the problem - it didn't but now my laptop won't shutdown! I can hibernate it using the power button only, also when typing text into a text box it doesn't always accept the text 1st time like it doesn't receive the focus always.

Are these common problems with IE7? Are they related to IE7 at all? Anyone seen anything like this? Do I have to go back to IE6?

Thanks Smile | :)

Re: IE7

originSH5-Jul-07 4:18

originSH

5-Jul-07 4:18

When you updated to IE7 did you do it via windows/microsoft update? If so did any other patches/drivers get installed?

Re: IE7

stevepqr5-Jul-07 5:22

stevepqr

5-Jul-07 5:22

I installed it directly from the Microsoft download page. On further investigation the power off problem has 'gone away' by starting up without the port replicator fitted and then shutting down without it fitted. Now I can shut down normally even when its fitted - some sort of installation issue with the port replicator perhaps?

Maybe someone can help with the original problem - occasionally I get corruption of some sort when a web page is displayed, the top of the page will be displayed normally then there will be a half displayed HTML tag such as

Re: IE7

Dan Neely5-Jul-07 5:34

Dan Neely

5-Jul-07 5:34

sounds like your http connection is breaking in mid transfer. Most likely its either a problem on the server or a network issue between your PC and the webserver. Unless it's part of your internal network there's probably not anything you can do about it.

--
You have to explain to them [VB coders] what you mean by "typed". their first response is likely to be something like, "Of course my code is typed. Do you think i magically project it onto the screen with the power of my mind?" --- John Simmons / outlaw programmer

Request for "One-Way Tunnel" implementation [modified]

unforgiven_wild_rose3-Jul-07 21:38

unforgiven_wild_rose

3-Jul-07 21:38

Hi
if anyone has an implementation of "One-Way Tunnel" problem in any programming languages please tell me with my email : mohammad_razavi_d@yahoo.com

there is a one way tunnel in the middle of the road and cars in the road are moving in 2 directions ( north to south & south tho north )
when one car is in the tunnel others that are in the reverse direction must wait out of tunnel until the car in the tunnel moves out

this implementes with classes like Semaphore, Monitor & Lock Queues

Thanx to every one

-- modified at 3:43 Wednesday 4th July, 2007

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.