As was foretold, we've added advertisements to the forums! If you have questions, or if you encounter any bugs, please visit this thread: https://forums.penny-arcade.com/discussion/240191/forum-advertisement-faq-and-reports-thread/
Options
Virtumonde.dll aka help my compute has a virulat pestilance
Malechai
Registered User regular
Registered User regular
Alright so I seem to have picked up a nasty little Trojan/key logger known as Virtumonde. I running spybot S&D constantly trying to eradicate the little bugger. For now I've stoped it from altering my registy but It just wont go away. Looking for some advice here, thanks.
Note: Ran S&D on start up twice one time it seemed to have iradicated it but has come back for more. Seems to have immbedded it's self in the registry and system 32. Running XP pro.
Note: Ran S&D on start up twice one time it seemed to have iradicated it but has come back for more. Seems to have immbedded it's self in the registry and system 32. Running XP pro.
Malechai on
0
Posts
Then we'll tell you what to delete from where.
---
I've got a spare copy of Portal, if anyone wants it message me.
Removal:
http://technet.microsoft.com/en-us/sysinternals/bb896652.aspx
http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx
Put them on a Flash Drive.
Record the name of the vundo infection (e.g. htthy.dll).
Now, while in Normal Windows mode (not safe mode), open both ProcExp, and RegMon. The next part takes mostly a keen eye to get past. Record some Registry activity, and look for odd patterns of three entries. They should have a wierd entry in the last column (like 0xfff9f). Check those, and look for the name of your virus in the other columns. If you find it, record the name of the process they are in (for me, this is almost always either lsass.exe or winlogon.exe).
Now, navigate to that process with ProcExp. Right click on it, and select "Properties", then the "Threads" tab. If your previous searching was correct, you should find a thread with the name of your virus in there. It shoudl be fairly easy to find because it will have a very high CPU use. Kill the threads with the virus name in them, then close Process Explorer.
Now, open the Registry Editor. This part can be fairly dangerous if you don't know how to play with the registry, so be careful. Search for, and remove keys related to the virus. In some instances, you might need to edit only part of a key relative to the virus, leaving the other parts behind. It's tricky business, but if you're already comfortable mucking about in the registry, it shouldn't be hard.
Finally, reboot, and navigate to c:\windows\system32\, and delete [virusname.dll]. Boom, you're clean.
XBL: LiquidSnake2061