Virtumonde - found but not removed

[ethr]

I get a positive on this sig every time the app runs. It
tells me that its removing it but it doesn't go away. Is
there some other step I need to take?

 

[plun]

Hi

- Download CCleaner, www.ccleaner.com and remove all temporarily junk.

- Download/Install Lavasofts Adaware
http://www.download.com/Ad-Aware-SE-Personal-Edition/3000-8022-10399602.html?tag=list

IMPORTANT ! After install upgrade Adaware definitions with "Check for
updates".

- Restart in safe mode, press F8 during reboot just before Windows flag
screen appears.

- Scan with MSAS and Lavasoft Adaware, choose "full scans".

And let us know if it works.............

 

[Stev]

Hi, I doubt AdAware, MSAS, Trend Micro or any other will
remove this. I had it. I have it no longer thanks in very
large part to this forum. Go to the "announcements" page
and look for the virtumondo threads. I had to go into the
registry to fix it. BTW, winfixer and winantispyware2005
kept pooping up or trying to download stuff. Don't click
on these. Good luck, Steve

 

[Engel]

Hello Ethr;

Get HijackThis.exe from
http://tomcoyote.org/hjt/hjt199//HijackThis.exe

Save it to C:\hjt (new folder) then Open it and select
Scan and Save Log. Note where you saved the log then
send it to me as an attachment. Put Hijack in the
subject so I'll know it's not spªm.

Alternatively you can post it on the Dell Forum ªt:

http://forums.us.dell.com/supportforums/board?
board.id=si_hijack

(if it wraps you can go tº:

http://tinyurl.com/ckuzq insteªd.)

Put Ron in the subject so he will see it. You do not
need to have a Dell to post but you will need to register.

Ron Kinner
(e-mail address removed)

..
From: "Andre Da Costa

Also give MSAS cousin a try:
http://www.sunbelt-software.com/

In Microsoft AntiSpyware, from the Tools Menu, send in a
suspected spyware report. If you have an AntiVirus
utility installed, update with latest definitions and do
a full system scan.

Good luck

Engel

 

[Engel]

Here is an other siver bullet, from Plun
http://forums.techguy.org/printthread.php?t=376692