2008-12-07, 01:02 AM
Fixed!
A big thank you to RahlsSoldier for guiding me through the process.
Among the program I used, Spybot Search & Destroy, CCleaner, and MoveOnBoot had the most direct effect for the removal, though the others may have helped the process. What I basically did, after trying with a bunch of programs to no avail, was use Spybot to look up infected registry keys, and .dll and .ini files in system32. After that, I deleted the registry keys, and then searched for all the .dll files in system 32 that have blank "company" and "description" in its details and were created recently. I moved all of them into one place on my desktop and renamed them such that they were simply "File" files. Adding those files to the custom delete on CCleaner, all the dll files were gone. Next, I unchecked the "Hide protected system files" in folder options and discovered the hidden ini files. These I needed MoveOnBoot to remove. Now, scans are all clean. No pop ups. And automatic updates can be enabled.
(Just in case it might help anyone else who gets Virtumonde.)
A big thank you to RahlsSoldier for guiding me through the process.
Among the program I used, Spybot Search & Destroy, CCleaner, and MoveOnBoot had the most direct effect for the removal, though the others may have helped the process. What I basically did, after trying with a bunch of programs to no avail, was use Spybot to look up infected registry keys, and .dll and .ini files in system32. After that, I deleted the registry keys, and then searched for all the .dll files in system 32 that have blank "company" and "description" in its details and were created recently. I moved all of them into one place on my desktop and renamed them such that they were simply "File" files. Adding those files to the custom delete on CCleaner, all the dll files were gone. Next, I unchecked the "Hide protected system files" in folder options and discovered the hidden ini files. These I needed MoveOnBoot to remove. Now, scans are all clean. No pop ups. And automatic updates can be enabled.
(Just in case it might help anyone else who gets Virtumonde.)