Jump to content
Science Forums

Virtumonde


Recommended Posts

HELP! :painting:

 

My computer is continually becoming infected with a pesky adware trojan called Virtumonde.

 

I'm running McAfee Internet Security Suite, which does not detect it, and Spy Sweeper which detects it as a BHO (Browser Helper Object) at the point it is trying to enter my machine.

 

But even though I tell it not to install the object, it is getting in anyway and is found when I conduct a sweep. I'm able to quarantine it and delete it after a reboot, but it keeps showing up again.

 

This thing is either replicating itself in my machine, or it is repeatedly being downloaded through my internet connection, even when I'm not online.

 

Every time I conduct a search, some spyware company is trying to get me to buy their products. I'm beginning to think that they are the one's creating these stupid viruses.

 

Do any of you computer geniuses have any experience with this or any recommendations?

Link to comment
Share on other sites

Here are a couple of manual removal instructions, among the first in a google search: Adware.VirtuMonde - Symantec Corp.; VirtuMonde :: VirtuMonde Removal Instructions.

 

Though both try to sell you their products, including dedicated virtumonde un-install kits, you don’t need to buy or run any of their apps to follow the manual instructions.

 

Neither have much of a description, but the removal-instructions.com page suggest that, while a non-damaging adware, not spyware or malware, virtumonde is pretty tenacious, running several deceptively-named processes to reinstall itself after you delete its files and registry keys. If you follow the instructions to end those processes (via Window’s task manager), you should be able to defeat this trick.

 

The Symantec page mentions that it might lock you out of regedit, but I suspect (and hope, for your sake) that’s just Symantec boilerplate text.

 

Good luck, be careful not to kill your system with regedit (if you’ve not used regedit much, you might do well to enlist the on-hand aid of someone who has), and post back if the removal instructions don’t work for you.

Link to comment
Share on other sites

Had the same problem a few weeks ago.

 

Virtumondo infects your Java executable, and only older versions thereof - prior to 2006, when Java was fixed for this particular loophole.

 

The best and quickest way to fix it, is to remove your Java runtime environment (Start - Control Panel - Add Remove Programs), and then to reinstall the most recent version of Java off the net (if you need it).

 

Because it physically infects the Java executable, antivirus programs only pick up the dummy files it creates as viruses - not the source.

 

Kill Java, Virtumondo be gone!

Link to comment
Share on other sites

Had the same problem a few weeks ago.

 

Virtumondo infects your Java executable, and only older versions thereof - prior to 2006, when Java was fixed for this particular loophole.

 

The best and quickest way to fix it, is to remove your Java runtime environment (Start - Control Panel - Add Remove Programs), and then to reinstall the most recent version of Java off the net (if you need it).

 

Because it physically infects the Java executable, antivirus programs only pick up the dummy files it creates as viruses - not the source.

 

Kill Java, Virtumondo be gone!

 

Thanks CraigD and Boerseun,

 

I was curious about the Java aspect of this. I had read something about that. But you would think there were more information about it as simple as updating Java is.

 

I haven't tried that yet. I'll report back what happens.

 

By the way, why would I need Java? I don't believe I actually use it. What would happen if I just removed it completely?

Link to comment
Share on other sites

  • 2 weeks later...
Had the same problem a few weeks ago.

 

Virtumondo infects your Java executable, and only older versions thereof - prior to 2006, when Java was fixed for this particular loophole.

 

The best and quickest way to fix it, is to remove your Java runtime environment (Start - Control Panel - Add Remove Programs), and then to reinstall the most recent version of Java off the net (if you need it).

 

Because it physically infects the Java executable, antivirus programs only pick up the dummy files it creates as viruses - not the source.

 

Kill Java, Virtumondo be gone!

 

I am here to announce that Boerseun is the recipient of the:

 

Great Advice to Get Rid of the Annoying Virtumonde Adware Trojan Virus Award.

 

I decided to wait a while before I sent this to make sure it didn't come back. But I swept the machine, and then removed Java as you suggested on 3/12. Since then I have had no recurrence of the virus. Your rec seems to have worked like a charm. ;)

 

And fortunately, I didn't have to install an entirely new OS. :doh:

 

Thank you, Sir. :hihi:

Link to comment
Share on other sites

Just because you didnt do it, does not mean that it was not a great fix.... it would fix a problem with all of the other viruses out there too....

 

Honorable Mention goes to Alexander for recommending a potential fix for all viruses by installing an operating system that is not currently susceptible to infection.

 

Are you currently running Ubuntu? Is it compatible with most PC software?

Link to comment
Share on other sites

;)

 

I run Ubuntu/OS X 10.5 dual boot on my mac, i have a windows machine at work, and a wip Ubuntu server and a production SUSE box... and a gaming box with weird hardware at home.... working on setting up OpenBSD on my sun box to use that for a router in the near future (quad interface nic in that :P )

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

Loading...
×
×
  • Create New...