Re: WINFIXER - VIRTUMONDE - VUNDO - GEEBY.DLL
Succesfull Trojan Removal Program
I have spent MANY hours
trying to get rid of this devil
Have tried many methods found on web to remove it, including Symantec and McAfee. Was getting ready to reformat my harddisk and start over when I found a small (94.7KB), privately written program on the McAfee Help forum that did the job in a quick, simple snap:
Read the information - 45 seconds;
Downloaded VirtumundoBeGone.exe - 10 seconds;
Ran VirtumundoBeGone.exe - 2 minutes;
Computer rebooted - 2 minutes;
Read VGB.TXT report on my desktop - 30 seconds;
Deleated all remaining remnants of this freak - 60 seconds.
Now plan to party ALL NIGHT.
It worked, it was simple.
THANK YOU!!!!!
Can't guarantee that it will work for you, but it did work for me and was real easy to run.
Additional information:
EWIDO <
http://www.ewido.net/en> has been good at spoting GEEBY.DLL. EWIDO removed it from 14 locations on my computer plus fixxing a number of other problems that my other more well known, expensive programs did not remove. However, it could not get GEEBY.DLL in window/system32 that was called by winlogon.exe. It recognizes it there, and attempts to remove it, but with no luck. EWIDO is free to try, and free to use permanently except that the real time protection is disabled after two weeks. Still, not a bad manual scanner and remover to have as a backup if you don't want to pay for it.
_______________________
For those of you interested, I ran the program twice. The first time it found Virtumundo and removed it. The removal process involved rebooting the computer. The second time it did not find Virtumundo and there was no computer reboot:
At the bottom I have copied the the thread that led me to this program. If it doesn't work for you, maybe some of the other leads will.
Here are the removal reports that Virtumundobegone.exe put on my desktop. I am not enough of a cumputer person to know how much of this will be universal and how much unique:
[12/23/2005, 23:12:46] - VirtumundoBeGone v1.5 ( "c:\My Downloads\0-LoadFromHere\VirtumundoBeGone.exe" )
[12/23/2005, 23:13:08] - Detected System Information:
[12/23/2005, 23:13:08] - Windows Version: 5.1.2600, Service Pack 2
[12/23/2005, 23:13:08] - Current Username: XXXXX XXXXXXX (Admin)
[12/23/2005, 23:13:08] - Windows is in NORMAL mode.
[12/23/2005, 23:13:08] - Searching for Browser Helper Objects:
[12/23/2005, 23:13:08] - BHO 1: {02478D38-C3F9-4efb-9B51-7695ECA05670} (Yahoo! Companion BHO)
[12/23/2005, 23:13:08] - BHO 2: {06647158-359E-4D10-A8DE-E6145DA90BE9} (Trend Micro Antifraud Toolbar)
[12/23/2005, 23:13:08] - BHO 3: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (AcroIEHlprObj Class)
[12/23/2005, 23:13:08] - BHO 4: {53707962-6F74-2D53-2644-206D7942484F} ()
[12/23/2005, 23:13:08] - WARNING: BHO has no default name. Checking for Winlogon reference.
[12/23/2005, 23:13:08] - Checking for HKLM\...\Winlogon\Notify\SDHelper
[12/23/2005, 23:13:08] - Key not found: HKLM\...\Winlogon\Notify\SDHelper, continuing.
[12/23/2005, 23:13:08] - BHO 5: {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} (PCTools Site Guard)
[12/23/2005, 23:13:08] - BHO 6: {7c1ce531-09e9-4fc5-9803-1c2956615786} (IeCaptureBho Object)
[12/23/2005, 23:13:09] - BHO 7: {AA58ED58-01DD-4d91-8333-CF10577473F7} (Google Toolbar Helper)
[12/23/2005, 23:13:09] - BHO 8: {B56A7D7D-6927-48C8-A975-17DF180C71AC} (PCTools Browser Monitor)
[12/23/2005, 23:13:09] - BHO 9: {FC148228-87E1-4D00-AC06-58DCAA52A4D1} (MSEvents Object)
[12/23/2005, 23:13:09] - ALERT: Found MSEvents Object!
[12/23/2005, 23:13:09] - Finished Searching Browser Helper Objects
[12/23/2005, 23:13:09] - *** Detected MSEvents Object
[12/23/2005, 23:13:09] - Trying to remove MSEvents Object...
[12/23/2005, 23:13:10] - Terminating Process: IEXPLORE.EXE
[12/23/2005, 23:13:10] - Terminating Process: RUNDLL32.EXE
[12/23/2005, 23:13:10] - Disabling Automatic Shell Restart
[12/23/2005, 23:13:10] - Terminating Process: EXPLORER.EXE
[12/23/2005, 23:13:10] - Suspending the NT Session Manager System Service
[12/23/2005, 23:13:11] - Terminating Windows NT Logon/Logoff Manager
[12/23/2005, 23:13:12] - Re-enabling Automatic Shell Restart
[12/23/2005, 23:13:12] - File to disable: C:\WINDOWS\system32\geeby.dll
[12/23/2005, 23:13:12] - Renaming C:\WINDOWS\system32\geeby.dll -> C:\WINDOWS\system32\geeby.dll.vir
[12/23/2005, 23:13:12] - File successfully renamed!
[12/23/2005, 23:13:12] - Removing HKLM\...\Browser Helper Objects\{FC148228-87E1-4D00-AC06-58DCAA52A4D1}
[12/23/2005, 23:13:12] - Removing HKCR\CLSID\{FC148228-87E1-4D00-AC06-58DCAA52A4D1}
[12/23/2005, 23:13:12] - Adding Kill Bit for ActiveX for GUID: {FC148228-87E1-4D00-AC06-58DCAA52A4D1}
[12/23/2005, 23:13:12] - Deleting ATLEvents/MSEvents Registry entries
[12/23/2005, 23:13:12] - Removing HKLM\...\Winlogon\Notify\geeby
[12/23/2005, 23:13:12] - Searching for Browser Helper Objects:
[12/23/2005, 23:13:12] - BHO 1: {02478D38-C3F9-4efb-9B51-7695ECA05670} (Yahoo! Companion BHO)
[12/23/2005, 23:13:12] - BHO 2: {06647158-359E-4D10-A8DE-E6145DA90BE9} (Trend Micro Antifraud Toolbar)
[12/23/2005, 23:13:12] - BHO 3: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (AcroIEHlprObj Class)
[12/23/2005, 23:13:12] - BHO 4: {53707962-6F74-2D53-2644-206D7942484F} ()
[12/23/2005, 23:13:12] - WARNING: BHO has no default name. Checking for Winlogon reference.
[12/23/2005, 23:13:12] - Checking for HKLM\...\Winlogon\Notify\SDHelper
[12/23/2005, 23:13:12] - Key not found: HKLM\...\Winlogon\Notify\SDHelper, continuing.
[12/23/2005, 23:13:12] - BHO 5: {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} (PCTools Site Guard)
[12/23/2005, 23:13:12] - BHO 6: {7c1ce531-09e9-4fc5-9803-1c2956615786} (IeCaptureBho Object)
[12/23/2005, 23:13:13] - BHO 7: {AA58ED58-01DD-4d91-8333-CF10577473F7} (Google Toolbar Helper)
[12/23/2005, 23:13:13] - BHO 8: {B56A7D7D-6927-48C8-A975-17DF180C71AC} (PCTools Browser Monitor)
[12/23/2005, 23:13:13] - Finished Searching Browser Helper Objects
[12/23/2005, 23:13:13] - Finishing up...
[12/23/2005, 23:13:13] - A restart is needed.
[12/23/2005, 23:13:25] - Attempting to Restart via STOP error (Blue Screen!)
--------------------------
Here is the second report when Virtumundo had already been removed. (No reboot because it had been cleaned):
[12/23/2005, 23:27:16] - VirtumundoBeGone v1.5 ( "c:\My Downloads\0-LoadFromHere\VirtumundoBeGone.exe" )
[12/23/2005, 23:27:20] - Detected System Information:
[12/23/2005, 23:27:20] - Windows Version: 5.1.2600, Service Pack 2
[12/23/2005, 23:27:20] - Current Username: XXXXXX XXXXXXXX (Admin)
[12/23/2005, 23:27:20] - Windows is in NORMAL mode.
[12/23/2005, 23:27:20] - Searching for Browser Helper Objects:
[12/23/2005, 23:27:20] - BHO 1: {02478D38-C3F9-4efb-9B51-7695ECA05670} (Yahoo! Companion BHO)
[12/23/2005, 23:27:20] - BHO 2: {06647158-359E-4D10-A8DE-E6145DA90BE9} (Trend Micro Antifraud Toolbar)
[12/23/2005, 23:27:20] - BHO 3: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (AcroIEHlprObj Class)
[12/23/2005, 23:27:20] - BHO 4: {53707962-6F74-2D53-2644-206D7942484F} ()
[12/23/2005, 23:27:21] - WARNING: BHO has no default name. Checking for Winlogon reference.
[12/23/2005, 23:27:21] - Checking for HKLM\...\Winlogon\Notify\SDHelper
[12/23/2005, 23:27:21] - Key not found: HKLM\...\Winlogon\Notify\SDHelper, continuing.
[12/23/2005, 23:27:21] - BHO 5: {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} (PCTools Site Guard)
[12/23/2005, 23:27:21] - BHO 6: {7c1ce531-09e9-4fc5-9803-1c2956615786} (IeCaptureBho Object)
[12/23/2005, 23:27:21] - BHO 7: {AA58ED58-01DD-4d91-8333-CF10577473F7} (Google Toolbar Helper)
[12/23/2005, 23:27:21] - BHO 8: {B56A7D7D-6927-48C8-A975-17DF180C71AC} (PCTools Browser Monitor)
[12/23/2005, 23:27:21] - Finished Searching Browser Helper Objects
[12/23/2005, 23:27:21] - Finishing up...
[12/23/2005, 23:27:21] - Nothing found! Exiting...
-------------------------------------------------------
The following thread led me to the above program. If it doesn't work hopefully something else here will work:
Hi Barryco - Five approaches to removing Winfixer (Vundo). Not all will
work on all variants. It's suggested that you try them in this order.
4 - Then, courtesy of MVP Suzi Turner and Mosaic1:
"Atribune, a guy in the forums, has a Vundo fix tool as well:
Instructions for use by user as posted in the SpywareWarrior forum:
'Please download VundoFix.exe to your desktop. Here's a link:
Double-click VundoFix.exe to extract the files
This will create a VundoFix folder on your desktop.
After the files are extracted, please restart your computer into Safe Mode.
Once in safe mode open the VundoFix folder and double-click on KillVundo.bat
A command window will open and it should look like this:
VundoFix V2.1 by Atri
By pressing enter you agree that you are using this at your own risk
At this point press enter one time.
Next you will see:
Type in the filepath as instructed by the forum staff
Then Press Enter, to continue with the fix.
At this point please type the following file path (make sure to enter it
exactly as below!):
C:\WINDOWS\system32\geeby.dll
Press Enter.
Next you will see:
Please type in the second filepath as instructed by the forum staff
At this point please type the following file path (make sure to enter it
exactly as below!):
C:\WINDOWS\system32\ybeeg.*
Press Enter to continue.
The fix will run then HijackThis will open.
In HijackThis, please place a check next to the following items and click
FIX CHECKED:
O2 - BHO: MSEvents Object - {52B1DFC7-AAFC-4362-B103-868B0683C697} -
C:\WINDOWS\system32\geeby.dll
O20 - Winlogon Notify: geeby - C:\WINDOWS\system32\geeby.dll
After you have fixed these items, close Hijackthis.
The fix will tell you to shutdown using the Power button. Hold in your power
button until the computer shuts down. Wait about 15 seconds and then restart
the computer into regular windows.
Chkdsk will run. This is normal. It will take a few minutes and is checking
your file system because of the Bad Shutdown we caused.
Go for free online Virus scans here:
Allow them to clean
Panda will have the option to create a log after the scan has finished.
Click
the See Report button. Then click the save Report button. It will be saved
under the name activescan.txt Do that and post that log into your next reply
here.
Run hijackthis and post the new log and the vundofix.txt file from the
vundofix folder into as well.'
----------------------------------------------------------------------------
--
The forum helpers have reported this fix from Atribune works. I don't know
about the Symantec tool.
If you'd like to join Spyware Warrior, you could see the thread where the
helpers are discussing this.
Suzi"
|