WinFixer 2005 - Virtunomdo

[Guest]

Well sorry folks, after updating to definitions version 5771, 29th October
2005 Microsoft AntiSpyware Beta does not get rid of WinFixer 2005 or
Virtumondo, are these the same ?

After detecting and cleaning, following re-boot the thing is still there and
MS Anti Spyware detects it and cleans it .........endless loop.

Even after detecting and cleaning and running spyware straight after its
detected again.

 

[plun]

Hi

Have you tried in safe mode ?

Winfixer/Virtumundo is tricky because of randomized malware filenames.

Look at these threads from Techguy:

http://forums.techguy.org/t412315.html

and

http://forums.techguy.org/t410048.html

If you are familiar with HijackThis this is no problem otherwise
use Techguy for guided help.

--
plun



IanMB expressed precisely :

 

[Guest]

Microsoft Antispyware Beta1 was hanging up my PC too when it encountered
Virtumundo Trojan. Here is how I got rid of it:

First you should backup your registry before making any changes.

1. Run Microsoft Antispyware until it find Virtumundo the do a screen print
and paste it in where ever you want so you can reference it later.
2. Kill Microsoft Antispyware as best you can. It takes longer to kill the
longer you leave it hung so be patient.
3. Reboot you computer.
4. Start RegEdit and go the offending entry.
5. You will not be able to delete it.
6. Right click the entry on the left side of RegEdit.
7. Click Permissions
8. Click Add
9. Click Advanced
10. Click Find Now
11. Click the Administrator Name (RDN) in the grid at the bottom of the
window. I first choose the Admin account I setup for my PC but that didn’t
work. I next choose the other Administrator account that appeared here that
I didn’t setup.
12. Click OK
13. Click OK
14. Click Full Control under Allow
15. Click OK
16. Now right click the key (on the left side) and Delete the entry

Good Luck