How to Remove the Trojan Zlob & Trojan Vundo

Trojan viruses can slow your computer and even cause it to crash.

Zlob and Vundo are Trojan viruses are designed to flood your computer with unsolicited pop-up advertisements. The Zlob Trojan is the more dangerous of the two because, in addition to flooding your computer with popup advertisements, it downloads additional malware onto your computer. Both Trojans can be removed using your antivirus program. However, if you do not have access to the Internet or if you do not have an antivirus program, you can remove the Trojans manually.

Difficulty:

Moderately Easy

Instructions

End Processes

1. Press\"Ctrl\" + \"Alt\" + \"Delete.\"

2. Click on the \"Task Manager\" and then click on the \"Processes\" tab.

3. End each of the following processes by clicking on the process and then clicking \"End Process.\"<br /><br />\"nvctrl.exe\"<br />\"msmsgs.exe\"<br />\"System\\regperf.exe\"<br />\"System\\ld100.tmp\"

Delete Registry Values

1. Click on the \"Start\" menu. Type\"regedit\" into the \"Search Programs and Files\" box and press \"Enter.\" Or, If you are using a version of Windows prior to Windows Vista, click on the \"Start\" menu , click \"Run,\" type \"regedit\" into the Run box and press \"Enter.\"

2. Locate the following registry values in the left pane of the Registry Editor and delete them. To delete a registry value, right-click on it and select \"Delete.\"<br /><br />\"HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRunRegSvr32<br />=System/msmsgs.exe\"<br />\"HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsNTCurrentVersionWinlogonShell<br />=explorer.exe\"<br />\"HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SharedTaskScheduler<br />{af73a174-ea1b-4f0b-b0b1-fe1486a6719c} = communa\"<br />\"HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Main\\Active State\"<br />\"HKEY_CURRENT_USER SoftwareMicrosoftWindows CurrentVersionRunOnce*WinLogon\"<br />\"HKEY_LOCAL_MACHINE SoftwareMicrosoftWindows CurrentVersionRunOnce*[filename]\"<br />\"HKEY_CLASSES_ROOTCLSID{2316230A-C89C-4BCC-95C2-66659AC7A775}\"<br />\"HKEY_CLASSES_ROOTCLSID{8109AF33-6949-4833-8881-43DCC232B7B2}\"<br />\"HKEY_LOCAL_MACHINE SOFTWAREClassesATLEvents.ATLEvents\"<br />\"HKEY_LOCAL_MACHINE SOFTWAREClassesATLEvents.ATLEvents.1\"<br />\"HKEY_LOCAL_MACHINE SOFTWAREMicrosoftWindows CurrentVersionExplorerBrowser Helper Objects{2316230A-C89C-4BCC-95C2-66659AC7A775}\"<br />\"HKEY_LOCAL_MACHINE SOFTWAREMicrosoftWindows CurrentVersionExplorerBrowser Helper Objects{8109AF33-6949-4833-8881-43DCC232B7B2}\"<br />\"HKEY_CURRENT_USER SoftwareMicrosoftInternet ExplorerMainActive State\"

3. Close the Registry Editor.

Delete DLL Files

1. Click on the \"Start\" menu and type \"cmd\" into the \"Search Programs and Files\" box and press \"Enter.\" Or, If you are using a version of Windows prior to Windows Vista, click on the \"Start\" menu, click \"Run,\" type \"cmd\" into the Run box and press \"Enter.\"

2. Type “regsvr32 /u qdsba.dll” (without the quotation marks) into the Command Prompt and press \"Enter.\"

3. Close the Command Prompt window.

Delete Files

1. Click on the \"Start\" menu.

2. Click on the \"Search Programs and Files\" box.

3. Search for and delete the following files. To delete a file, right-click on it and select \"Delete.\"<br /><br />\"hp[X].tmp\"<br />\"msvol.tlb\"<br />\"ncompat.tlb\"<br />\"RSA\"<br />\"Protect\"

Tips & Warnings

• If you do not want to infect your computer with the Zlob virus again, avoid the following websites: <br /><br />\"Vnp7s.net\"<br />\"zxserv0.com\"<br />\"www.Flwplayer.com\" <br />\"www.Swfcompressor.com\" <br />\"www.Wmadirection.com\"

References

• FasterPCCleanClean.com: How to Remove Trojan Vundo
• FasterPCCleanClean.com: How to Remove Zlob Trojan