[RESOLVED] Trojan Vundo H

worked that time. Here's the new scan log. I will perform a full scan just to be sure. Also, I wasn't paying attention when it shut down but there was no beep for the error either. Will update in a few.

Malwarebytes' Anti-Malware 1.36
Database version: 2036
Windows 5.1.2600 Service Pack 2

4/24/2009 1:33:33 PM
mbam-log-2009-04-24 (13-33-33).txt

Scan type: Quick Scan
Objects scanned: 80031
Time elapsed: 4 minute(s), 38 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

Great, full scan found nothing and error message is gone.

Just one question left and that is from before - windows firewall vs. pc tools firewall plus

thanks guys, especially Broni. I really owe you.

I'm glad, things are good.

Quote:

---

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.

---

You should allow the above fix, and it'll stop bothering you.
It's nothing malicious, but Malwarebytes own fix for some script error from earlier Bytes version.

Quote:

---

First, would you recommend windows firewall or pc tools firewall?

---

From these two, definitely PC Tools, because it gives you two-way protection, while Windows firewall provides only inbound protection.

Quote:

---

the first time it was AvSvc.exe programm error and the second was SpoolsTV or something similar .exe

---

AvSvc.exe seems to be rather bad file; as for the other, I need to know exact name.

Download avz4.zip from here

• Unzip it to your desktop to a folder named avz4
• Double click on AVZ.exe to run it.
• Run an update by clicking the Auto Update button on the Right of the Log window: https://discussions.virtualdr.com/
• Click Start to begin the update

Note: If you recieve an error message, chose a different source, then click Start again

• After the update, from the "File" menu, choose "Standard Scripts"
• Put a check next to item 2: Advanced System Analysis
• Click Execute selected scripts
• At the next prompt, click the Yes button
• Let the scan run and click "OK" when the completion prompt pops up
• Now Close out of the Standard Scripts window, and exit AVZ
• Navigate to the avz4 folder and locate the folder LOG
• Inside the LOG folder you will find virusinfo_syscheck.htm and virusinfo_syscheck.zip
• Attach the compressed file, virusinfo_syscheck.zip, to your next reply.

Here it is

I see no sign of AvSvc.exe, and the only file starting with "Spool" is spoolsv.exe , which is legit file.

there were only the two errors first he AvSvc and then spoolsv. I haven't seen them since so i am not going to worry unless they start to cause problems but i haven't had any so far and im hoping i won't. If i do, i'll be back:). Thanks again for all your help. I hope i don't encounter anymore issues.

Alrighty then :)