Virus! HEEEELP :D

Not really an interesting thread title huh?

I have been infected it seems by a quite annoying virus/malware that is affecting my system pretty bad.

As of now, I am unable to surf the net properly (certain limited address still work), I get random pop ups for porn websites as well as redirects. My connection is acting randomly and goes off without warning despite both router/modem working.

Also, the Automatic Update for Windows has been disabled so I cannot update it from Microsoft either.

Adaware 8.0 scanned it as Vitromonde something and attempted to remove but it always reappear. Avast (latest definition) has done both boot up scan and removes stuff, as well as full regular scan but either does not detect or rather removes it but always come back.

Any help possible beside the usual reformat (which i want to keep as ultimate solution)?

Virtumonde is a complete pain in the dick and routine virus software generally can't do shit about it, but it's possible to win if you're persistent.

Several Virtumonde (also called Vundo) specific fixes are here. You might kill it on the first try or you might need to try all of them.

I had this problem a little over a month ago. Some fixes are available in that thread, too.

My mom's computer seemed to have picked it up around the same time, too, but was a complete bitch about it. My computer was able to get rid of it using a startup scan with Spybot S&D, but my mom's computer hung on to it for over a month. Nothing seemed to get rid of it. Well, that's a lie--it seems to be OKAY now, after several trials of different fixes.

VundoFix is probably the best utility to get rid of it, assuming S&D can't zap it. Give both a try.

Anyway, good luck trying to get rid of it!

try to use Trojan Remover,Spyware Doctor,Spyware Terminator & Webroot Spy Sweeper Pro.sure will remove all spyware and Trojan from any pc.or use ultimate Spyware remover Hitman Pro.

Well I've tried a couple of fixes.

First was Spybot S&D... It seems to have disable some of the virtumonde and I am able once more to log on and put the automatic update for Windows.

Sadly I still get the odd redirect while I am browsing a website (completely random).
Vundofix and Virtumondebegone seemed to have little effect at this point.

It seems I'm gonna have to use Hijack This and go at it hard core.

You know, I've never had ANY luck using ANY spyware program removal tool.

I always end up reinstalling windows.

Originally Posted by Kamui

Adaware 8.0 scanned it as Vitromonde something and attempted to remove but it always reappear.

Probably because it's still kept in memory when Adaware attempts to remove it (although most sophisticated anti-malware manage to kill malware threads or to remove them on next startup), whatever.


Maybe you should try posting your HJT log here ?

Originally Posted by Zephyrin

You know, I've never had ANY luck using ANY spyware program removal tool.

I always end up reinstalling windows.

^ ^ ^

The quickest and nearly fail-proof anti-virus.

Originally Posted by DeLorean

The quickest and nearly fail-proof anti-virus.

Go back to Concert Hall with the rest of your gay rape playmates, would you?

I had Vundo a while back and it was a pretty huge pain in the ass to fix. I wound up using one of the really specific fixes in conjunction with the Spybot registry protection thing. It notifies you whenever a modification is trying to be made to it, so you can actually see when Vundo is trying to make its own self-replicating entries (and deny those changes if you want).

Later versions of Vundo inject itself into Unlocker. I was thoroughly amused

It's fairly easy to remove Vundo/virtumondo/etc. I've removed it from several of my company's PCs. Search in google for bleepingcomputer and vundo fix. Should give you a step-by-step, idiot-proof way of removing it completely.

Edit: Whoops, here it is
How To Remove Winfixer / Virtumonde / Msevents / Trojan.vundo.b
Enjoy