Page 1 of 1

Vundo transferred to mp3 player and/or eBookwise Reader?

PostPosted: Mon Dec 31, 2007 4:56 pm
by biveg
I just went through H-E-double-toothpicks getting Vundo off my main computer. Now that it's gone, my mp3 player and eBookwise Reader are acting wonky. I was recording a voice file onto my mp3 and it froze up during saving, had to be restarted by pressing the Reset button, and I lost all 10 minutes of the voice recording. Then later in the day, when it was off, it randomly flashed at me as if it was being accessed. I turned it on to see what was the matter and it started randomly playing an older voice file. It's a Creative Zen 8GB.

The eBookwise Reader also froze while plugging it into its USB port just after I'd fully cleared the virus. It also had to be reset, but I haven't had any further problems yet. It's an eBookwise-1150 64MB.

My question is, could Vundo have transferred itself to these devices without my knowledge? How do I find out, and how do I get them off?

I was under the impression that I got the virus on 12/30/07 at 2.30PM when accessing an (apparently) unsafe music lyrics site. I hadn't plugged my devices into the computer until after the virus was purged. But perhaps I got the virus earlier than I had thought and it just activated itself then? :?:

I'm sorry if this is the wrong place to post this. I know it's 'HiJackThis Support.' But as I was using HJT to remove the Vundo from my main system and I think this could be related (I just posted yesterday about that), I thought I should keep it in the family, so to speak.

If I need to be directed somewhere else, please let me know and I'll take the questions there. Thank you.

PostPosted: Tue Jan 01, 2008 1:20 am
by Gecko
Hi biveg,

I am not aware of any vundo infection that can infect a usb device on it's own.
Please realize that a vundo type infection only works on a windows operating system, no windows OS no infection.

Also realize that the combofix makes a number of changes to the registry, resetting a number of user and device settings to default.
That is what most likely happened to you.

:)

PostPosted: Tue Jan 01, 2008 1:39 am
by biveg
Thanks again, Gecko. You put my mind at ease. :)