Virtumonde

[Barefootsies]

How in the FUCK do you get rid of this piece of shit?

I have tried everything, all afternoon, trying to get rid of this. Cleaning out registry, safe mode, S&D, cleaners, SmithFraud, HiJackThis, Java update, removing programs.

Fucking driving me nuts.

It is at the point I am almost going to clean out the HD with a format to get rid of it. Fucking madness!

[Sosa]

One of the worst ones out there. It was a bitch to remove most of the time when I was working at a computer repair shop. There is a walk through on some of the tech sites that you have to pay for. Can't remember exactly which one I used back then though.

[Barefootsies]

One of the worst ones out there. It was a bitch to remove most of the time when I was working at a computer repair shop. There is a walk through on some of the tech sites that you have to pay for. Can't remember exactly which one I used back then though.

Yes it is.
Been working on this shit for a few hours now.

S&D scans over and over keep finding it. Claim to remove it. Still there.
Cleaned registry. Deleted this and that.
Updated java.
Tried various guides, and walk throughs. None worked.
Tried Hijack this, and posted in forums. Still nothing.
Nod, and many other programs, and still there.

I've turned off restore, done safe mode, and can't seem to get it.

Fucking insane.

[HorseShit]

http://housecall.trendmicro.com

[Tjeezers]

*

Click Start
*

Click Run
*

Type 'regedit'
*

Click ok to open the registry editor
*

Navigate to the following key:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows
\CurrentVersion
*

In the right hand panel, search and locate the entries with the value “WindowsUpd” or “SysUpd”
*

Delete the entries WindowsUpd” or “SysUpd”
*

Navigate to the following keys:
HKEY_CURRENT_USER\ Software\Microsoft\WindowsUpd
HKEY_CURRENT_USER\ Software\Microsoft\SysUpd
*

Exit the Registry editor
*

Open a Dos command prompt window
For Windows NT/2000?XP: start>run cmd
For Windows 95/98/Me: start>run> command
*

Enter this command: regsvr32/u%WinDir%\system 32\cidrules.dll
*

Reboot your computer
*

Look for, find, and delete all of the following files from the System Directory: windowsupd2.exe and cidrules.dll

---------------

Tip, always ask Google... and you might get the best tips ever
http://www.google.com/search?hl=en&q...earch&aq=f&oq=

Or ask it the geeks

http://www.geekstogo.com/forum/How-t...ib-t91765.html

[Machete_]

http://www.bleepingcomputer.com/malw...ndo-virtumonde

[Barefootsies]

http://www.bleepingcomputer.com/malw...ndo-virtumonde

That one I tried.

Just got done running MS program. It cleaned all but two. Now just need to find those two.

[Barefootsies]

*

Click Start
*

Click Run
*

Type 'regedit'
*

Click ok to open the registry editor
*

Navigate to the following key:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows
\CurrentVersion
*

In the right hand panel, search and locate the entries with the value ?WindowsUpd? or ?SysUpd?
*

Delete the entries WindowsUpd? or ?SysUpd?
*

Navigate to the following keys:
HKEY_CURRENT_USER\ Software\Microsoft\WindowsUpd
HKEY_CURRENT_USER\ Software\Microsoft\SysUpd
*

Exit the Registry editor
*

Open a Dos command prompt window
For Windows NT/2000?XP: start>run cmd
For Windows 95/98/Me: start>run> command
*

Enter this command: regsvr32/u%WinDir%\system 32\cidrules.dll
*

Reboot your computer
*

Look for, find, and delete all of the following files from the System Directory: windowsupd2.exe and cidrules.dll

---------------

Tip, always ask Google... and you might get the best tips ever
http://www.google.com/search?hl=en&q...earch&aq=f&oq=

Or ask it the geeks

http://www.geekstogo.com/forum/How-t...ib-t91765.html

Normally I do not like going into the registry, but it's that, or re-format.

[CuriousToyBoy]

How in the FUCK do you get rid of this piece of shit?

I have tried everything, all afternoon, trying to get rid of this. Cleaning out registry, safe mode, S&D, cleaners, SmithFraud, HiJackThis, Java update, removing programs.

Fucking driving me nuts.

It is at the point I am almost going to clean out the HD with a format to get rid of it. Fucking madness!

Is that the trojan created by MyVirtualCard / PayMonde so they could just keep on fucking people over?

[neonliquid]

http://www.auditmypc.com/virtumonde-remove.asp

[RenegadeCash Mark]

Is that the trojan created by MyVirtualCard / PayMonde so they could just keep on fucking people over?

LMAO, good call.

[The Duck]

Try http://www.superantispyware.com/download.html should be able to remove it.

[grumpy]

drama queen, just clear your registry

[tranza]

I hate these stuffs too...

[Barefootsies]

I had that same thing. It was a few strains of the virtumonde. It was a bitch to get rid of.

I tried all kinds of programs to get rid of it. S&D would find it, but could not seem to get rid of it. I had the restoral turned off. Ran in regular and safe mode. Always found it, but could not get rid of it.

I tried NOD32, S&D, adaware, SmiFraudFix, HiJack This, and countless other programs. It had me busy for an afternoon.

In the end, M$'s removal tool, or whatever it is that you have on your PC now. That removed it first (ran twice). I then ran some program called, registry cleaner, and that worked (ran twice). Lastly ran S&D and that removed it what was left. Ran it a second time to be sure. All gone.

Turned restore back on.

[Darkcrni]

Ok, liesten here, REINSTALL!!!

[Fletch XXX]

In the end, M$'s removal tool, or whatever it is that you have on your PC now. That removed it first (ran twice). I then ran some program called, registry cleaner, and that worked (ran twice). Lastly ran S&D and that removed it what was left. Ran it a second time to be sure. All gone.

what is this magic MS tool you keep referring to?

I am not sure what you mean by it already being on my machine... I downloaded a free microsoft malware tool from their site and it doesnt do anything, it basically opens then closes...

what is the tool you refer to?

[Fletch XXX]

fucking crazy, ive downloaded, and tried to run this multiple times, it just opens then closes...

http://www.microsoft.com/security/ma...e/default.mspx