Help with Trojan infection

[zoobernut]

First off this is not ffxi related that I know of and I do not think that I got this trojan from any ffxi website. On my laptop I noticed a lot of pop up windows so I did a search and found out it has a trojan on it called virtumonde. I was wondering if anyone has heard of this or has any idea how to get rid of it. It keeps coming back every time I try to delete it. Any help would be incredibly helpful.

[Cephius]

That's a tough one to get rid of, its more spyware than virus so a virus scanner might get a few files but not the whole deal. Your best bet is to scan in safemode using a good anti-spyware scanner like Spybot, SuperAntiSpyware, or Spyware Doctor. Don't scan just once, do it a few times until nothing comes up.

Symantec has a removal tool for this, direct download link is here: http://securityresponse.symantec.com/av ... VMonde.exe

Just note that sometimes this tool won't do the job, but its a good starting point. Use a spyware scanner to clean up the stuff it misses.

Hope this helps you out.

[zoobernut]

Thanks for the reply. I am using spybot search and destroy on my laptop and that is how I found it. Each time I scan with it less files show up but so far there are a few. I will try that tool you suggested and let you know how it turns out.

[Elesirdur]

Full format and re-install of Windows is pretty much the only 100% sure-fire cure.

Hope you can locate it with tools or find info online regarding a specific removal process.

[Vyvian]

I've seen like 30 systems with that on it now, usually the most obvious symptom you have it is you have bogus "security" software that installed itself that you didn't put there, such as WinFixer. What makes this particular malware tough to remove is it isn't always the same, its files have different names, uses different types of temp files, bundles different types of bogus software into it.

To remove it manually requires an advanced understanding of windows, and the ability to recognize what stuff in system32 is real and what doesn't belong, you should probably get someone to help you if you don't know how to do this, doing it wrong can damage windows and require a reinstall:

1. Boot into Safe Mode, and run all your spyware and virus scans[/*:m:1swah1ql]
2. Go to C:\Windows\System32 and arrange all icons by date modified[/*:m:1swah1ql]
3. If you have anything here it will be at the very bottom, examine the last 6-10 files (the most recently used) and delete files that don't belong, they're usually gibberish named dlls, sometimes an exe.[/*:m:1swah1ql]
4. Dump windows prefetch, and windows temp, and go into each user folder and dump their temp and temp internet files. The core of the malware will hide in these places and attempt to use code to recreate itself.[/*:m:1swah1ql]
5. Since you're in safe mode, the bogus uninstaller functions of the fake security programs usually won't run, so go into Program Files and attempt to delete the program folders manually. Sometimes they're locked and won't allow you to, if this is the case rename the folder to some stupid name, and it will allow you to kill it on reboot.[/*:m:1swah1ql]
6. Sometimes this will latch itself onto BHOs, damage the Winsock, or mount itself into some other invisible windows component, you can use a tool call HijackThis to clean these entries out. (http://www.majorgeeks.com/download3155.html) HijackThis is not like a spyware scan tool, you don't just run it and fix everything it lists, many of the things it will pop up are legitimate or required for things to work.[/*:m:1swah1ql]
7. Run that Symantec remover tool also, in case it finds anything you might have missed. [/*:m:1swah1ql]

Usually completing all of the above steps properly, while still in safe mode and without rebooting is enough to get rid of it, after all the effort some systems still just need a reinstall of windows. Virtumonde tends to bundle with random other malware so sometimes the symptoms are worse, more difficult to remove. I've seen it be easy and I could clean it in an hour, I've seen really severe cases of it take closer to 3, where it did stuff like knock out the tcp/ip winsock so they could not connect to the internet. If you don't think you know enough to do the above, or are not sure if you've truly completely removed it, a reformat is a guaranteed fix and might speed up your computer too.

Oh, side note, most of the infections I've seen of this come from spoofed Myspace.com pages.