19 replies to this topic

[MBLisa]

Hi everyone,

About 3 days ago my homepages in FF and IE were changed and my google search at the top right corner of FF was changed to something called Web Search. My computer is really slow and I get virtual memory low warnings.

Well I immediately started googling for information. I came across two different spyware removal forums and as I was reading through everything, and one of the malware names caught my eye, Vundo. In that topic I noticed that it had a fix for it called Vundofix.

Ok well right after that I ran Malwarebytes and sure enough it found Trojan.vundo. I was shocked, but also so excited that I actually had run across earlier a removal 'specifically' for this trojan. So like a dummy I told Malwarebytes to ignore it, and I ran back to that website and downloaded Vundofix and ran it. Well, it didn't even find it! So, here I sat, stuck with this thing on my computer and now MB couldn't find it because I told it to ignore it!

Well, I went through the two forums and I did all the steps for self removal of malware. And there were alot, let me tell ya. Anyway, with my computer still slugglish and virtual memory warnings, I went back to MB and looked around in there and I found a tab labeled Ignore List. I went in and found something but it didn't have the Vundo name on it. Maybe it was different, I don't know. So I hit remove. So ~ now I'm wondering if hitting remove only just took it off the ignore list and now I still might have creepy malware still on my machine.

Ok, so my question is, when you delete it from the Ignore List does it remove that particular malware or does it just remove it from the list?

Thanks for taking the time to read my rant. And thanks in advance for your help.

[Hardhead]

I'm not sure what OS you are running but you need to be sure that you have show hidden files showing in View/Folder Options.
In Vista the file is located at C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware.

You can safely delete ignore.dat and rescan with MBAM and the file will show up again for removal.
I also suggest that you read this post here and post here afterwards.

[MBLisa]

Thanks so much for the fast reply. I don't have Vista, I have Windows XP Home edition. Where would the .dat file be in XP? I'll read the other posts that you suggested. But I'll wait to hear from you as to where the file is for XP. Thanks again.

Hardhead, on Nov 5 2009, 10:07 PM, said:

I'm not sure what OS you are running but you need to be sure that you have show hidden files showing in View/Folder Options.
In Vista the file is located at C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware.

You can safely delete ignore.dat and rescan with MBAM and the file will show up again for removal.
I also suggest that you read this post here and post here afterwards.

[Hardhead]

Here you go...
You will find it at the below location.
Be sure that hidden files are showing and post back if you need help to show hidden files

C:\Documents and Settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware

[MBLisa]

I unhid files and folders. I followed the path. The only things that are in the Application Data folder are a folder called Microsoft and another folder called MSN6 and a desktop.ini. There is no Malwarebytes folder. What could be wrong?

Hardhead, on Nov 5 2009, 11:29 PM, said:

Here you go...
You will find it at the below location.
Be sure that hidden files are showing and post back if you need help to show hidden files

C:\Documents and Settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware

[Hardhead]

MBLisa, on Nov 6 2009, 02:40 AM, said:

I unhid files and folders. I followed the path. The only things that are in the Application Data folder are a folder called Microsoft and another folder called MSN6 and a desktop.ini. There is no Malwarebytes folder. What could be wrong?

You have to be logged in as admin.

Look in All Users.

[MBLisa]

Ok I'll switch to that one. I'll get right back to you, if you're going to be here for a little while.

Hardhead, on Nov 5 2009, 11:44 PM, said:

You have to be logged in as admin.

[Hardhead]

You are looking in Administrator instead of C:\Documents and Settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware

[MBLisa]

What does that mean?

Am I not looking in that path now?

I did look there before I saw your post, and the same two things are in there, nothing else.

Where should I look for administrator?

Hardhead, on Nov 5 2009, 11:48 PM, said:

You are looking in Administrator instead of C:\Documents and Settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware

[Hardhead]

MBLisa, on Nov 6 2009, 02:54 AM, said:

What does that mean?

Am I not looking in that path now?

I did look there before I saw your post, and the same two things are in there, nothing else.

Where should I look for administrator?

Take a look at this pic please...
Note that I have it in D:\ drive and yours will be in C:\.

[Hardhead]

The ignore.dat file will be regenerated after you delete it and reboot.

[MBLisa]

I followed the path exactly. I didn't accidentally slip into the Admin folder And this is what's in there:

Hardhead, on Nov 5 2009, 11:58 PM, said:

Take a look at this pic please...
Note that I have it in D:\ drive and yours will be in C:\.

ignore.JPG

Attached Images

• 

[Hardhead]

Also be sure that you have hidden files setup this way please.
Open Control Panel and click on Tools/Folder Options.
Click apply and OK.

[MBLisa]

Yep, I did that.

Hardhead, on Nov 6 2009, 12:05 AM, said:

Also be sure that you have hidden files setup this way please.
Open Control Panel and click on Tools/Folder Options.

ignore1.JPG

[MBLisa]

SUCCESS! I found it.


It was in the All Users.WINDOWS folder. I found it in there and deleted it. Now to run MB again....yea, I think I'll do that tomorrow. Off to bed.

I shall return. I'll run MB tomorrow and see if it finds it. I will post a final post to end the thread. Thanks!

MBLisa, on Nov 6 2009, 12:06 AM, said:

Yep, I did that.

[Hardhead]

Be sure to reboot please and then run new scan.

[MBLisa]

Ok I will. I'll be back tomorrow to finish the thread.

Hardhead, on Nov 6 2009, 12:19 AM, said:

Be sure to reboot please and then run new scan.

[Hardhead]

MBLisa, on Nov 6 2009, 03:21 AM, said:

Ok I will. I'll be back tomorrow to finish the thread.

Good work..
Please follow the directions here.

[MBLisa]

Hi again Hardhead! I'm sorry I didn't get on here last night when I said I would.

After I deleted the Ignore.dat out of the folder, the next morning I ran the Malwarebytes scan and low and behold it found it! There was one piece of Vundo in the registry. It cleaned it so I think I'm all set. I haven't been having any more problems. I've also been doing alot of other self cleaning processes (from the "geek" forums) on this computer so it's running alot better now.

Thanks very much for sticking with me and helping me find that file to get rid of. I totally appreciate your help. It's more help than I've gotten from any of those other "geek help" forums!

God bless,
Lisa

Hardhead, on Nov 6 2009, 12:23 AM, said:

Good work..
Please follow the directions here.

[Hardhead]

My pleasure MBLisa.
Great to hear everything is running better for you now.
Nice work.