With Vundo (virtumonde) still ever changing I have added a third detection, well sorta.

When the first vundofix was released it used CLSID's to find the files. When I recreated VundoFix I removed the CLSID's and went to a binary string method of finding the files. The next version of VundoFix had binary strings searching and pure registry searching.

It was working great but now it's time to make it even better, at the request of my fellow Microsoft MVP and security expert Tony Klein I have re added CLSID detection to VundoFix, 225 CLSID's total have been added. The older version of VundoFix only had 106 in it.

Hope this tool is helping lots of people still. If it doesn't work for you let us know.  We will do our best to get you cleaned up.

Vundofix and instructions are available here 

Atri