Virtumonde Loop

[Steve]

Same problem as post 19/1 "Anti Spyware Glitch" with scan
looping endlessly on Virtumonde - Removing Registry Entry.
Tried suggested solution booting up in safe mode but even
then would still loop (tried twice).
Very dissappointing as it is finding loads that Spybot and
Noadware are not picking up but there is no way to stop
the scan and remove what has been detected(?)
Any other ideas?

Thanks

 

[Bill Sanderson]

You might see whether Symantec's automated removal tool for Virtumonde would
get you past this problem:

http://securityresponse.symantec.com/avcenter/venc/data/pf/adware.virtumonde.html

 

[Steve]

Tried removing with the Symantec utility as suggested but
it reported that the PC did not have Virtumode installed!
This leads me to think that MAS is reporting incorrectly
and worries me somewhat that if I get it working it may
erroneously remove other software. I intend to try the
manual method, (rather than using the utility),
recommended by Symmantec to see if there is any evidence
of Virtumonde on the PC and will update this post
accordingly.

 

[Bill Sanderson]

I recommend looking at all the details reported of any threat you intend to
remove, in case of false positives. Some have been reported. This is an
issue with all anti-spyware apps, and the definitions are being tuned to
remove these as the beta progresses.

So I'd go at it both ways--look at and maybe post here the details of what
the scan found, and check Symantec's details to see if they exist on your
system.

 

[Steve]

Had a look at the registry etc. and could find no evidence
of Virtumode per the Symantec guidance.
The trouble is that it appears to be immpossible to stop
MAS at any stage before or after it loops at this point so
it is rendered effectively useless as I have not been able
to remove anything. I will keep on updating the
definitions in the hope that the glitch is overcome.

Thanks

 

[Steve]

Upgraded to new Beta version. No improvement.

-----Original Message-----
Had a look at the registry etc. and could find no evidence
of Virtumode per the Symantec guidance.
The trouble is that it appears to be immpossible to stop
MAS at any stage before or after it loops at this point so
it is rendered effectively useless as I have not been able
to remove anything. I will keep on updating the
definitions in the hope that the glitch is overcome.

Thanks
are
being tuned to /
.

 

[Bill Sanderson]

I see another message about a similar issue in a different group that says
this will happen if the registry key is set to read-only.

The fix is to change that.

I could also imagine that permissions such that the effect was read-only
might do the job.