Virtumonde

I have NOD32 as my antivirus and Spybot as my backup, but unfortunately, something called Virtumonde still managed to get in. I started noticing symptoms of the trojan after NOD popped up consecutively last night, reporting a quarantine in my TEMP folder. It was odd but I wasn't concerned since it just means it protected me from some attack, right?

However, after weird popups started to repeatedly show up, I thought something was wrong and so I started googling and eventually found that it was something called Vondo. So then I ran Spybot and it does delete stuff with the names Virtumonde and I guess some stuff that it installed. So I thought, there we go, and went along my way.

Then today, when I turned on the computer, my Windows Automatic Updates got turned off. I checked a Wiki page about Virtumonde and it said that that was another symptom of it. Now, I go to Spybot again, and again, it seems to delete it. But then I started getting even more popups than before! (and more variety, if you must know..) So I ran Spybot again, but it just seems to find more every time I run the scan. Since my normal methods weren't working, I decided to google for help. I get a bunch of hits claiming to be Vondo removers but they don't seem trustworthy and few work as advertised, so I skip to pages with other users asking for help. They tried a bunch of methods, but no solution was posted.

I tried Vundofix but it failed to even spot the trojan. There were a lot of guides but all of them said to install this and install that, but I have no idea whether they're safe or not. There was a guide I saw yesterday that involved disabling explorer.exe and Winlogin.exe, and it seemed pretty detailed with pictures, although Winlogin.exe is a System Process and I was afraid that disabling that process will screw it up. I thought I didn't need it after spybot apparently deleted the trojan, and now I can't find it anymore. This is getting extremely frustrating, since the popups seem to be getting more and more frequent and annoying. Can anyone help me? Whether with a good guide/program or just instructions. Thank you very much for any help.

Summary: I got infected with a trojan called Virtumonde and can't get it off my computer. Please help.

This is a wonderful site you can use to check if you actually have Virtumonde: Link I had that virus and it took me about two weeks to get rid of it. I used a combination of NOD32 and avast to get rid of it. PM me for more info if you can't get rid of it using housecall.

Wow, Virtumonde. Plagued my old computer. The only thing I could do about it was set it to auto-quarantine, that way it couldn't do much.

Virtumonde is a complete peach. Worst virus ever. Do a system restore :/

Virtumonde is a complete peach. Worst virus ever. Do a system restore :/

Best advice, Virtumonde actually infected my computer a few months back. Apparently it's not that fatal to your comp it just continuously makes copies of it self and makes series of ads that plague your computer. No definite program can remove it since it's multiplying constantly as long as you have internet connection or any program. I tried every little thing which all failed and ultimately lead to me reformatting, which wasn't too terrible since my comp had alot of crap anyway, I just wish I had backed up all my music

But yeah reformatting may be your only option.

Thank you for the replies.

@Meeks
What do you mean by "Do a system restore." Will that remove the virus? I will likely do one tomorrow anyway because my screen now gets frozen when I boot normally, but it would be nice if there was such an easy way.

@Ape
I'm considering Formating but that really will be my last resort. Redownloading stuff and backing up my documents and songs will be almost too big a hassle, though I'm starting to think fighting Virtumonde is just as troublesome.

The system restore will pretty much wipe everything. Think of it this way, your computer will be like it was just pulling it out of the box and setting it up for the first time, again.

Redownloading stuff and backing up my documents and songs will be almost too big a hassle.

That's why you are meant to do it on a regular basis. But no one really does.

Fixed!

A big thank you to RahlsSoldier for guiding me through the process.

Among the program I used, Spybot Search & Destroy, CCleaner, and MoveOnBoot had the most direct effect for the removal, though the others may have helped the process. What I basically did, after trying with a bunch of programs to no avail, was use Spybot to look up infected registry keys, and .dll and .ini files in system32. After that, I deleted the registry keys, and then searched for all the .dll files in system 32 that have blank "company" and "description" in its details and were created recently. I moved all of them into one place on my desktop and renamed them such that they were simply "File" files. Adding those files to the custom delete on CCleaner, all the dll files were gone. Next, I unchecked the "Hide protected system files" in folder options and discovered the hidden ini files. These I needed MoveOnBoot to remove. Now, scans are all clean. No pop ups. And automatic updates can be enabled.

(Just in case it might help anyone else who gets Virtumonde.)