Lets see what this scan looks like.

Please download Malwarebytes' Anti-Malware to your desktop. Click here
Double Click mbam-setup.exe to install the application.
Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select "Perform Full Scan", then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.
Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediately.

Go ahead and turn the windows machine back on then click on the link above where it says click here, and download Malwarebytes, make sure you update it then do a full scan with it may take an hour depending on the amount of files on machine.

I will look at log and then advise and also get you an Anti Virus program running on the machine.

Lets do 1 thing at a time here.... If I feel you need additional help from a malware removal forum I can direct you there. All free.

zep, do I need to remove SUPERantispyware before loading Malwarebytes?

Thanks.

No, where going to get you going here. Malwarebytes will remove most of Vundo.

zep, here you go.

Malwarebytes' Anti-Malware 1.45
www.malwarebytes.org

Database version: 3976

Windows 5.1.2600 Service Pack 2
Internet Explorer 7.0.5730.13

4/11/2010 11:15:10 AM
mbam-log-2010-04-11 (11-15-10).txt

Scan type: Full scan (C:\:D:\:E:\:)
Objects scanned: 247480
Time elapsed: 54 minute(s), 47 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 4
Registry Values Infected: 2
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 18

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msascui.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCmdRun.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msseces.exe (Security.Hijack) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fapoviseg (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sonodotage (Trojan.Vundo) -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

As I said, I did have Trend Micro on my machine, but I think the trojan did something to that. Shall I try to remove and re-install it again, or go with AVAST or something like that. I do have six months left on my subscription.

Folders Infected:
(No malicious items detected)

See if you can get Trend Micro to run, since you have 6 months left. Let me know.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msseces.exe (Security.Hijack) -> Quarantined and deleted successfully.

Looks like you have Microsoft Security Essentials installed, is that true?

do not pay for removal! stick with zep he will get you going and we can send you to a forum that does the step by step removal help for free and they are the best at what they do. But it is essential you stay put with one helper and not post at other forums looking for help because that can be very frustrating and confusing for the ones assisting you and also dangerous if you get conflicting advice.

Zep, yes Microsoft Security Essentials is installed. When I go there it shows that Microsoft Firewall is on and that Trend Micro Internet Security is up to date and virus scanning is on. However, when I click on Trend I get the following message:

C:\Program Files\Trend Micro (TM) Internet Security\Setup\Framework\32bit\200\UfNavi.exe

The application has failed to start because the application configuration is incorrect. Reinstalling the application may fix this problem.

As I mentioned before, I didn't learn NOT to uninstall and reinstall Trend due to this Trojan till after I did. Since I have done the Malwarebytes would it be best to uninstall and try re-installing it again?

Raven, between you and zep, I've always gotten the help I've needed and won't pay for anything unless absolutely necessary.

You guys are the greatest.

Part of the problem is we can only run 1 Anti Virus program, running more can cause all sorts of problems. If it were me I would keep Microsoft Security Essentials and get rid of TrendMicro all together, the final decision is yours. If you decide to keep TrendMicro then yes try an uninstall using the link below and reinstall.

Removing these programs usually requires a special removal tool or they will not fully uninstall see link for that tool.

Here is a link that might be useful: Trend-Micro-products

I don't see in the Security Essentials any virus program - it only shows that Trend micro is on, which as I said, turns out not to be the case. Is there a virus program associated with Essentials and I'm not finding it?

I will try the link you provided and let you know how that goes.

Thanks

Ok let me know how that goes. I am going to need a hijackthis log so I can see what's taking place, It really makes it easier for me to see that and give instructions. And it's real simple to do. Will give direction for that below.

Click Here to download HJTInstall.exe
· Save HJTInstall.exe to your desktop.
· Doubleclick on the HJTInstall.exe icon on your desktop.
· By default it will install to C:\Program Files\Trend Micro\HijackThis .
· Click on Install.
· It will create a HijackThis icon on the desktop.
· Once installed, it will launch Hijackthis.
· Click on the Do a system scan and save a logfile button. It will scan and the log should open in notepad.
· Click on "Edit > Select All" then click on "Edit > Copy" and Paste the entire contents of the log (no attachments) into your next post.
DO NOT use the AnalyzeThis button, its findings are dangerous if misinterpreted.
DO NOT have Hijackthis fix anything yet. Most of what HJT lists will be harmless or even required by your Operating System.

zep - all is well now. I got Trend Micro reinstalled and it's working fine once again. All traces of Vundo are gone as far as I can tell.

Do I need to run SUPERspyware or Malwarebytes frequently or should I be o.k. now?

I REALLY, REALLY, REALLY appreciate your help.

Many thanks

I'd run it again on wed. Malwarebytes is constantly up-dated so it's possible it could catch something that was missed today never know. After that you can run it at your own discretion. Once every 2 weeks or so.

Post the Hijackthis log I asked for above when you get time. I would like to see it while your here. It's real easy to do, and may show something that needs attention.

Just remember, every time you run Malwarebytes or any other anti-spyware type program to update it first each time before scanning

zep, it'll be a bit before I can post as I'm going out of town for a week and won't be near my computer or have access to it.

I'll post the info you want once I get back.

Ok will watch for it. Thanks for that!!