Help! Both of my computers have been infected with Virtumonde (virus)!

Aragoni

A couple of days ago (2 days to be exact) my sister came and told me that our laptop have been infected by a virus. I did a scan with NOD32 and found this pesky virus that it tried to put into quarantine but each time it did the virus mysteriously came back. I then downloaded Spybot - Search & Destroy and Ad-aware and did a scan with those two. Spybot found loads of shit on it (one of them was Virtumonde) and I then deleted everything it found. Afterwards I did a new search, just to be sure, and then there still were a virus left called "Virtumonde".

I then gave up with Spybot and took my chances with Ad-aware but with no success.



After that and doing re-runs with Ad-aware, Spybot, NOD32 and Vundofix (a program which was created for deleting Virtumonde but yet it failed) I sat down with my sister and asked her which homepages she's been visiting. Appearantly she had not been into any strange webpages BUT I also told her about the dangers of using MSN and she then confessed that she had recieved a message from a friend asking her "Hey, is this really you?" and then she went into the webpage sent with that message.

So, I believe this is from where she recieved it.

Also did a run with Ad-aware and Spybot on my computer. Ad-aware found 260 "Privacy" things but it only managed to delete 9 of them and then it crashed mysteriously, afterwards when I did another run it found 4 of all those 200 ().

Spybot also found loads of adwares but it managed to delete all of them (I think).



Anyway, after sitting and trying to delete all the adwares, viruses and stuff from the laptop I decided that it would be a good thing to hand it into the hands of proffessionals (a local computerstore) and let them deal with the problems. I sent the laptop with my mother when she went to work (I will pick it up in a couple of hours and go with it to the store) and thought that everything would be fine. But nay, fate is so cruel so that just 20minutes ago I'm starting to recieve the same pop-ups as Virtumonde gave the laptop, even though I did a run on Spybot before I went to sleep yesterday and it didn't find anything.

The strange about this one is that my sister probably haven't accepted any mysterious files on this computer, it could be my father but meh.. I'll talk to him later. And no, I do NOT visit pornsites.



Anyway, how tha FUCK do I delete Virtumonde? I'm going to Dreamhack in 10 days and I do not wish to send my only computer away to the store so I have to go to DH without a computer



P.S. sorry for my bad grammar and such but English is my second language, so please keep that in mind.



Edit: http://en.wikipedia.org/wiki/Virtumonde <--- to those that dunno what Virtumonde is.

flainus

http://www.lavasoft.com/support/securitycenter/virtumonde_remover.php

Aragoni

Originally posted by flainus


http://www.lavasoft.com/support/securitycenter/virtumonde_remover.php

"The Virtumonde Remover has been integrated into Ad-Aware 2007. Make sure to upgrade to Ad-Aware 2007 in order to use this tool."



And as you can read in my post, I tried Ad-Aware but it didn't work.

 

brostyn

Here's what I would do:

First go to -   housecall.trendmicro.com/ Run the scanner. This may take several hours.

If that doesn't work - restart your computer into safe mode(google it if you don't know how). Then run all those programs you mentioned and restart. The problem with those types of viruses are that they are in your boot memory, which is protected for some reason, so its never truly deleted. Safemode doesn't use boot memory, so there you can truly get rid of it.

n25philly

English is your second language?  You apparently speak it better than 99% of the people who have ever gone on the internet.

 

If it were me I would go through the registry.  The scans you have been doing haven't been effective because they miss something important that keep spawning these things, most likely a downloader. (a malware that just downloads other malware.  Until you get rid of whatever is doing this it won't stop.  Start with Virtumonde and search through the registry and delete anything that refrences it.