Trojan Duncan Process

Original Message

Name: Matthewitt
Date: August 13, 2007 at 13:00:13 Pacific
Subject: Trojan Duncan Process
OS: XP Prof
CPU/Ram: AMD 64X2 Dual Core 4000+

Comment:

I keep getting new dll's in system32 on startup that then connect my internet and pop up anti spyware ads. I can clear them with Superantispyware but they return under a different dll name at the reboot. I run Spybot and it finds Virtumonde. I have done everything on all the other Virtumonde replies on here and it keeps coming back. I managed to get rid in safe mode but on the reboot to normal windows it was back. There is nothing in the registry under any of the entries people advise to delete either. Would appreciate some help. Thank you.

Report Offensive Message For Removal

Response Number 1

Name: Pappy
Date: August 13, 2007 at 20:46:42 Pacific
Subject: Trojan Duncan Process

Reply: (edit)

Instructions for removal at Bleepingcomputer:
http://www.bleepingcomputer.com/forums/topic18610.html

Report Offensive Follow Up For Removal

Response Number 2

Name: btk1w1
Date: August 13, 2007 at 21:17:24 Pacific
Subject: Trojan Duncan Process

Reply: (edit)

Have you turned off system restore prior to scanning in safe mode then turning system restore back on afterwards?

Report Offensive Follow Up For Removal

Response Number 3

Name: Matthewitt
Date: August 14, 2007 at 04:25:31 Pacific
Subject: Trojan Duncan Process

Reply: (edit)

Yes I did turn it off and on.
Cheers for the advice so far. I am trying the bleeping thing today.

Report Offensive Follow Up For Removal

Response Number 4

Name: Matthewitt
Date: August 14, 2007 at 04:44:54 Pacific
Subject: Trojan Duncan Process

Reply: (edit)

Tried that. I have even more dll's popping up now. Superantispyware is showing at least 6 cases of Trojan Duncan Process whereas yesterday it was only one.

Report Offensive Follow Up For Removal

Response Number 5

Name: Matthewitt
Date: August 15, 2007 at 04:19:36 Pacific
Subject: Trojan Duncan Process

Reply: (edit)

Got it! I ran Vundo fix from Bleeping computers then went to safe mode and ran VirtumondeBeGone from Bleeping computer. Back in normal windows I ran Superantispy and then Spybot. They both found aspects of the virus that they weren't finding originally and when they deleted these it was gone.
Cheers for the help and good luck to anyone else trying to get rid of this thing.

Report Offensive Follow Up For Removal


Trojan horse Proxy.MVL (among other virus/trojan self mailer Internet Explorer pops up on Startu Secure32 Infection WORM_ASSARM.A trouble	virus alert!! Vundo Virus X Rated file (shortcut) Weird Processes...Trojans? Is this process a trojan?

Response Number 6

Name: btk1w1
Date: August 16, 2007 at 00:41:12 Pacific
Subject: Trojan Duncan Process

Reply: (edit)

Thats awesome!, thanks for the follow-up post with successful removal method

Report Offensive Follow Up For Removal