loebar.dll!?

[northernpuppy]

Hi everyone,

I'm having some recent problems with my laptop. With my university, I get free antivirus software (symantec antivirus). It is an auto-scan so when a trojan is found, it pops up and lets you know it either cleaned, quarantined, or deleted it. However, I recently got a Trojan vundo threat in the dir C:\WINDOWS\Web\printers\loebar. It won't do any of the three options because it claims it is in use. I've tried almost everything to delete it. Does anyone know a) what loebar actually does and b) how do I remove it? Thanks.

[Monty007]

Have you run the scan in safe mode? What is happening it is running at start up so you need to run a scan in safe mode to try and deleate it.

[northernpuppy]

When I run scan mode, explorer doesn't work. The screen is black with safe mode printed at the top of the screen...when I go ctrl+alt+del and run the task 'explorer' explorer shows up but then disappears again..any suggestions?

[Monty007]

I would download and insatall this program http://www.superantispyware.com/ and run a full scan.

[Vish_555]

The loebar file is clearly a system file so i suggets that you change your av to ignore it.

[northernpuppy]

Originally Posted by Vish_555

The loebar file is clearly a system file so i suggets that you change your av to ignore it.

But see the thing is the av claims it is a trojan vundo

[oddjob]

Originally Posted by Vish_555

The loebar file is clearly a system file so i suggets that you change your av to ignore it.

Definitely NOT.


northernpuppy .... that .dll file is definitely part of Vundo. You need to get rid of it.

First ... Download HijackThis from here ...

http://www.majorgeeks.com/download3155.html

unzip & install it.

Now you need to rename Hijackthis.exe to hjt.exe. You will need to do this by going to C:\Program Files\Hijackthis folder, right-click on Hijackthis.exe, click on rename and change it. Thanks.


Second .... Download VundoFix.exe to your desktop from here ......

http://www.atribune.org/ccount/click.php?id=4

> Double-click VundoFix.exe to run it.
> Click the Scan for Vundo button.
> Once it's done scanning, click the Remove Vundo button.
> You will receive a prompt asking if you want to remove the files,
click YES
> Once you click yes, your desktop will go blank as it starts removing
Vundo.
> When completed, it will prompt that it will shutdown your computer,
click OK.
> Turn your computer back on.

[Note >>> It is possible that VundoFix encountered a file it could not
remove. In this case, VundoFix will run on reboot, simply follow the above
instructions starting from "Click the Scan for Vundo button." when VundoFix appears at reboot.]


Third .... Open HJT and,from the menu, click on "Do a system scan and save a logfile".


In your next post please post the contents of C:\vundofix.txt and the HJT log.

MOST IMPORTANTLY ... PLEASE TELL US HOW YOU COMPUTER IS OPERATING NOW AND WHETHER THAT AV MESSAGE STILL APPEARS OR NOT.


OJ

[northernpuppy]

Well I added the file to the ignore list and I don't seem to have any problems, if I just keep using spybot and adware to get rid of the spyware, won't that be just as good?

Originally Posted by oddjob

Definitely NOT.


northernpuppy .... that .dll file is definitely part of Vundo. You need to get rid of it.

First ... Download HijackThis from here ...

http://www.majorgeeks.com/download3155.html

unzip & install it.

Now you need to rename Hijackthis.exe to hjt.exe. You will need to do this by going to C:\Program Files\Hijackthis folder, right-click on Hijackthis.exe, click on rename and change it. Thanks.


Second .... Download VundoFix.exe to your desktop from here ......

http://www.atribune.org/ccount/click.php?id=4

> Double-click VundoFix.exe to run it.
> Click the Scan for Vundo button.
> Once it's done scanning, click the Remove Vundo button.
> You will receive a prompt asking if you want to remove the files,
click YES
> Once you click yes, your desktop will go blank as it starts removing
Vundo.
> When completed, it will prompt that it will shutdown your computer,
click OK.
> Turn your computer back on.

[Note >>> It is possible that VundoFix encountered a file it could not
remove. In this case, VundoFix will run on reboot, simply follow the above
instructions starting from "Click the Scan for Vundo button." when VundoFix appears at reboot.]


Third .... Open HJT and,from the menu, click on "Do a system scan and save a logfile".


In your next post please post the contents of C:\vundofix.txt and the HJT log.

MOST IMPORTANTLY ... PLEASE TELL US HOW YOU COMPUTER IS OPERATING NOW AND WHETHER THAT AV MESSAGE STILL APPEARS OR NOT.


OJ

[oddjob]

Originally Posted by northernpuppy

Well I added the file to the ignore list and I don't seem to have any problems, if I just keep using spybot and adware to get rid of the spyware, won't that be just as good?

Not in my view. you can "ignore" malware till the cows come home but it will still be on your machine. Why don't you want to get rid of it?

Is there something hard about following my advice?


OJ

[Monty007]

Originally Posted by oddjob

Not in my view. you can "ignore" malware till the cows come home but it will still be on your machine. Why don't you want to get rid of it?

Is there something hard about following my advice?


OJ

I would have to agree, download and run anti-spyware as I suggested....why would anyone want to leave it (spyware or Malware) on a operating system?