could you please tell that poster to come here to this forum her pc can be cleaned we can help with that and send her to the proper security clean up forum to get her back up and running and clean, an infection will not destroy the pc they can always simply reformat, wipe the drive clean and re install windows but we can help them get it back up with out that more than likely.

now as to where the malware came from it is anyones guess, there are many sites that have been infected with bad code which can cause what is called a drive by infection I personally have not seen anything about photobucket being the link to any recent infections.

I got the virus this morning and I believe it was from photobucket as that is the site I was on. It's taken all day to scan etc. I had 2 viruses yesterday while on Photobucket but they were caught by AVG. Wish I didn't go back.

This one was a fake anti-virus software and said Windows detected...something to that affect. It was called Spyware Protect 2009. It's a nasty one. I didn't click to accept but I clicked the x and it still caused a lot of grief. Between AVG, a Microsoft Scan and Malwarebytes, I think I have removed it. I hope! Still looking into it.

ravencajun,

I have posted to the member to come over here for help. I hope she does come.

her name is karen, GW name is kqcrna

Spyware Protect 2009 is a rogue anti-malware program that uses false results, fake malware, and fake security alerts to scare you into purchasing the software. Historically, Spyware Protect 2009 has been installed via a variety of Trojans and malware. Starting in April 2009, this rogue is now being advertised through the use of the Conficker worm. The Conficker worm has spread to supposedly over 10 million computers, so it goes without saying that the amount of people who may potentially fall for the Spyware Protect 2009 scam is now incredibly large.

See link below

Here is a link that might be useful: .bleepingcompute

Hi Computer Folks,

I'm Karen, the wintersower with the trojan vundo virus. I have to say that I'm a computer idiot but my husband is good with them and if you have suggestions I will show them to him . He has been unable to do much because our internet connection went out shortly after getting the virus. Now, the infected computer is still unable to connect but another in the house is online.

Thanks in advance for helpful suggestions.

Karen

Need to go to either forum an follow directions for posting a hijackthis log,

http://www.landzdown.com/index.php
http://www.help2go.com/forum/

Both forums are very good, don't delay..

Try these things to see if you can get connected,

Go to Start > Control Panel - If you are using Windows XP's Category View, select the Network and Internet Connections category. If you are in Classic View, go to the next step.

* Double-click the Network Connections icon.
* Right-click the Local Area Connection icon and select Properties.
* Highlight Internet Protocol (TCP/IP) and click the Properties button.
* Be sure Obtain DNS server address automatically is selected.
* OK your way out.

Go to Start > Run and type in cmd
Click OK

* This will open a command prompt.
* Type the following line in the command window:

ipconfig /flushdns (note the space between ipconfig and /)

* Press Enter on the keyboard.
* Exit the command window

Restart your computer. If that does not work see below:

Try this next,

Click Start > Control Panel > System > Hardware > Device Manager > View > Show Hidden Devices.

* Scroll down to "Non-plug and Play Drivers" and click the plus icon to open those drivers.
then search for any of the following:

* T Seneka.sys
- clbdriver.sys
- TDSSserv.sys

Let me know if you find this or not.
* If you do find it, right click on it, and select "Disable". Do not try to uninstall it.
* Also if this is found and you disable it, then reboot and see if you can run the other scans that would not run.

If none of the above work, boot the computer to "Save Mode with Networking" then try to connect to the malwarebytes link below.

If any of the above things work for the connection issue below is the Malwarebytes link, Malwarebytes will remove that infection but you need to follow up at the forums suggested above in other post.

Here is a link that might be useful: malwarebytes

Tried the above suggestions to no avail. When I rebooted, I got an error message: "HP Cue status has encountered a problem and needs to close." Have previously run malwarebytes in normal and safe mode . It catches 4 trojan vundos immediately but cannot delete them until restarting. Rebooting does not correct the problem even if turning off system restore. We have Symantic antivirus. It initially became disabled so I reinstalled it. It is no longer disabled but it does not recognize the virus. Have also run Symantic's Fixvundo and a file called Vundofix.exe. Also tried sophos antiroot. No help there either. Will try the suggestion re the hijack this file. Thanks much.

My husband tried the hijack this file. Didn't work.

Thanks anyway.

Karen

no no you do not clean anything with hijack this you must go to the landzdown forum that was listed and start a thread there in the hijackthis area then post your results from hijack this there in your post, also tell them everything you have done they will come and help you with step by step directions, the hijackthis produces a log file that is what you need to post there for them to review so they know what steps to take, the team there is one of the best on the net so be assured they will help you but it takes time it is not a one deal cure all it is a step by step proceedure.

Just tell Corrine that I and Zep sent you there and you can also link back to this thread here so they can see this info.

There have been many with that infection recently and they are able to be cleaned.
go here register at the forum and post your thread in this area
HijackThis Logs

There have been many with that infection recently and they are able to be cleaned.
So does that infection only come from Photobucket, or is it any/everywhere?

Is there anything on the net to be found that PB is dangerous to use at this time? If one has enough protection, shouldn't they be fine to go there? I've been there numerous times yesterday and today...is it only a matter of time until I 'get' it?

There is never enough protection the thought seems to be that if I have an Anti Virus installed an a firewall, an a spyware scanner that you will be safe, every computer I see infected has all the above, the ones that don't have protection simply have more infections.

I don't see a problem with PB, I was also there quite a bit yesterday & today

"HP Cue status has encountered a problem and needs to close".

That's a Printer error most likely. See link..

Here is a link that might be useful: HP Cue

ravencajun: That is what my husband did. He just got home, first chance I've had to talk to him.

He said the suggestions he has received so far are either things he has already done or fixes involving downloading things. The computer cannot access the internet to download anything.

Karen

You can download on the working computer, put the download on a flash drive and transfer it to the infected one that way.

grandms: A couple of days ago neither computer worked (after the virus). We had a service guy come (from the phone company- provider for high speed service) and he switched out the modem. After that the laptop worked and my husband was able to download the fixvundo and vundofix on the laptop (wireless network from the same modem) and transfer to the infected PC with flash drive.

He has only had 2 days with any internet access and limited time (got home late last night) so maybe over the weekend.

Also, laptop now working fine so now problem with the modem. He has also sent out pings and gotten replies, checked all cables on the infected PC.

Thanks for the suggestions. If he makes any progress we will let you know.

Karen

Hubby was just surfing pics in photobucket and Avast set off any alarm. What I was able to write down was:
Http:/privatereserveyachtcharters.com/sitemap.html
Malware html:lframe-inf
Version 090425-0, 04/25/2009

I guess I was lucky, I am in there almost everyday and haven't had a problem. I did run my Avast, it came up clean and will run my spyware software to be sure.

See below for what Google safe browsing says about that site.

Terry

Here is a link that might be useful: Google Safe Browsing diagnostic page