There's three things that you need to have to fix it:
(1) Spybot
(2) Process Explorer (PE)
(3) Hijack This
Make sure you disconnect the PC/Laptop from the network. (If its ethernet, unplug the cable). If its Wi-fi, disable the Wireless card). Do this before cleaning and after downloading the above files.
The way Vundo works is it adds HKLM../RUN registry entries to your Windows startup. Also, it adds BHOs (Browser Helper Objects to Internet Explorer) . Also, it adds CLSIDS to your registry. What this means is that when your PC/Laptop is started, Rundll32.exe is called (Don't delete this .exe file, its a WIndows system file) in conjunction with DLL files (which are Vundo). What rundll32.exe does is it "injects" the infected DLL files into Windows processes, such as the windows shell (Explorer.exe) or the logon client (Winlogon.exe). This means that if you want to delete the infection, you can't because its "hiding" behind a system application, which cannot be stopped because it has SYSTEM authority.
You're probably thinking, "why don't I just end these processes using the Windows Task Manager?". Well, if you end Winlogon.exe, you will get a Blue Screen and will have to reboot. If you end Explorer, you halt your shell, which means you can't do anything unless you reboot. This is a recent trend of malware/trojans/viruses/worms - they add DLL files, usually to the system32 folder, then add registry keys to your startup so that Rundll32.exe loads these DLL files (rundll32.exe = Run dll as an application = application extension).
What you need to do is use Hijack this to locate the O4 entries (These are the HKLM../Run entries) that point to Vundo. Usually, Hijack this will tell you where the .DLL files are. You need to open the MISC tools section of Hijack this and click the "delete file on reboot". Navigate to the location of the DLL files (as pointed to by the Hijack this O4 entries), and select them for deletion on reboot. Some of these DLL files are "super hidden", which means that you will not see them when navigating to the file. You will need to type the name of the path and the file in order to delete it on a reboot. There should be 3-4 files that need to be deleted on reboot.
Then, go back and scan again using Hijack this. You will notice that you have "HKLM../RunOnce" lines. These were created by Hijack this. Do not delete these. Only delete the original "HKLM..Run" keys that point to the System32/*.dll file. Select these and click "fixed checked"
There also will be an O20/O21 entry in the Hijack this scan. These entries will point to the same dll files as the O4 cases. Select these entries, click the "Fixed Checked" button.
Now, for the spybot part:
(1) Download and run process explorer (from System Internals, and can be downloaded from Microsoft's website).
(2) Click the line that has "explorer.exe".
(3) Start spybot (but don't scan yet)
(4) Go back to PE, select "explorer.exe", right click, "suspend". This will pause/suspend explorer.exe and will let you delete the DLL files (Caused by Vundo) that are "hooked" onto Explorer.exe.
(5) Start the spybot scan. 3/4 of the way, it will detect Vundo.
(6) Select "fixed selected items" from spybot.
(7) Go back to PE, right click on EXPLORER.exe, select "RESUME"
(8) Now select Winlogon.exe, right click, select "SUSPEND"
(9) Re scan using Spybot. Fix selected items, as needed.
Now, you won't be able to "RESUME" Winlogon.exe, so you need to force your PC to turn off. Hold the power button for > 5 seconds, and your PC will turn off. Wait about 15 seconds, then turn on again.
You should see a couple of error messages at login, saying that it can't find the DLL files. (That's good, Vundo is gone).
Go back to Hijack this, Scan, and if the O2 (BHO), O4 (HKLM../Run), O20 and O21 entries are back, select them, and click the "fixed checked" button. This should finish the job.
Last, I would download ccleaner, install it, and run it. It will clear out all the temporary/Cache locations.
Reboot the PC, and you should be good to go.
Hopefully you learned something here about DLL injection, and why its so hard to remove it (because its hooked onto a Windows process)
Good luck!
Best Regards,
Thomas B Toy