polonus: the cleaning means also fixing the registry etc… what i’m talking about is a try to make some generic detection to stop the smit/vundo before it spreads over the system… i’ve made many vundo detections before and hopefully new variants should have similar weaknesses… the biggest problem is, that someone who’s infected often does a quasi-manual cleaning, but does not store the files and unfortunately does not send them to us… i’m grabbing vundo related files from virtotal, but that’s not fast enough…
