Coevolving Innovations

… in Business Organizations and Information Technologies

Slaying the virtumonde virus

Brian phoned yesterday, to ask if Adam could take a look at Jasmine’s laptop. Adam wasn’t in, so Diana suggested that he talk to me. Brian initially said that he didn’t want to take my time looking at a PC with a potential virus on it. I told him just to drop the machine off, and I would add it to the other two computers on my desk. I’m second-level support for the eight computers we have in our house, so all of the hard problems come to me.

This laptop took forever to boot, and would come up with a message (as I had seen in the bitdefender forum) of:

Your system could become unstable

A potential problem has been detected and Windows has been shutdown buggy application to prevent damage to your computer.

****WXYZ.SYS – Address F73120AE base at C00000, DateStamp 36b072A3
Kernel Debugger Using: COM2 (Port 0x28f, Baud rate 192000)

Although the panel looks like a Windows error, the wording is pretty suspicious (and grammatically incorrect). It’s the virus talking, not Windows. (There’s no reason for the kernel to be going to a COM2 port, when you have high-speed Internet access!)

Other symptoms included thousands of pot???.tmp files in the root directory, and an inability to start up a command prompt, because the /windows/systems32/ directory was hidden.

First, I downloaded the VundoFix program from atribune.org and ran that. This program was last updated in January 2007. It took a while, but VundoFix confirmed the Virtumonde virus. I followed through to clean up the virus, and it removed and patched a lot of files … except one. VundoFix said that this file would be removed after a reboot. I rebooted, VundoFix came up, and the last file was supposedly fixed. With another reboot, however, the system32 directory was still invisible, and another run of VundoFix disclosed an infected file. I retried the search, fix and reboot three more times, with the same result.

With another web search, I found that Lavasoft had developed a VirtuMonde remover, and it has been incorporated into Ad-Aware 2007 (including the free version). I downloaded Ad-Aware 2007 Free, but when I tried to install it, the installation would fail because some other program was simultaneously being installed.

Looking at Windows Task Manager … Processes … I saw multiple instances of msiexec running. One of these msiexec processes blocks other installation requests. I killed these processes, and Ad-Aware 2007 installed smoothly. Running Ad-Adware then not only found and isolated the files infected by Virtumonde, but also two other viruses … as well as the usual browser malware. I always thought that Ad-Aware was just for browsers … but I guess Lavasoft does much more than that!

When I could bring up a command prompt, it was a simple instruction to delete pot*.tmp, in two directories.

The laptop seems to be working fine, now. I’m 99% certain that I’ve killed the Virtumonde virus. The 1% uncertainty is that there are msiexec processes that come up after a cold boot. These could be normal processes (e.g. one turned out to be the anti-virus profiles from Sympatico Security Services being refreshed) … or they could be the Virtumode virus continuing to lurk.

Brian picked up the machine this morning. I’ve advised him to back up all of the data files on CDROM, in the case that the virus isn’t really dead. He had been advised by a technician in a store to just reinstall Windows XP. For systems engineers from the mainframe generation, reinstalling an operating system is an extraordinary measure that isn’t taken lightly. In my opinion, the problem determination skills of PC-oriented technicians leaves much to be desired. The elapsed time — not working time, because it took so long for the programs to run, and the infected operating system to reboot — to fix the machine was probably 6 to 8 hours.

Most PC technicians are all about action, not thinking. Sticking to a problem for the better part of a working day requires patience. I wish that university and college students could develop the good analytical discipline to figure out the one technical issue that is wrong, and put that right.

14 Comments

  • When you run the Vundofix tool you should always run it in safe mode. That will give you the best chance for removeal. Other paid programs like webroot and spyware doctor will also kill it in it’s tracks. the free solutions are Spybot S and D and ad-aware but those do not keep you protected from getting it in the first place

  • In the computer repair business I run into this bad boy all the time. Their is a site that focuses only on this strain and how to remove it. check out http://www.virtumonde.net . They have plenty of removal guides for this.

  • I read a blog post on vundoremoval.com that said doing a system restore was the simplest way. I tried it and it worked great. After that I used spybot and removed the other traces. All in all it took under an hour and about 5 minutes of actual sit down time. If you just got infected recently then that vundo removal guide is the best.

  • it took me weeks to remove virtumonde.. and only one program fixes everything.. SDFix!!!

    Please run the following:

    1. sdfix

    1. Download SDFix and save it to your Desktop.

    http://downloads.andymanchesta.com/R…ools/SDFix.exe

    2. Double click SDFix.exe and it will extract the files to %systemdrive%
    (Drive that contains the Windows Directory, typically C:\SDFix)

    3. Reboot into Safe Mode`:-

    Reboot into >>>safe mode

    4. Open the extracted SDFix folder and double click RunThis.bat to start the script.
    Type Y to begin the cleanup process.

    It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot.
    Press any Key and it will restart the PC.

    When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.

    Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt

    Goodluck!!!

  • all you need is a program called “superantispyware” , it cleared out all of my vundo, virtumonde,etc, even from my memory, and its free for home use, with a donation if you think fit.

  • Yeah SDFix is rock

    the only one little proggy that helped me to get rid off this crap///

  • I sure wish that there were dates by the entries above. I have tried Superantispyware, AdAware, Spybot S-D, X-raypc, several online House Calls….all to no avail. Safe mode approach, Hiren’s CD and booting to Ram Drive utilizing programs on the disk still did not crack this recent version. Oh..by the way…the today is July 12, 2008. Going to try the SDfix mentioned above. Thanks for the ray of hope by your post michelle.

    michael in kansas

  • I second michael in kansas (Oldphart)–it’s Sept 1, 2008 and I’ve contracted the virus. I’ll try SDFix and see what happens….

  • I think Virtumonde virus showed how actually vulnerable and imperfect popular antivirus suites are. People bundle
    their computers with loads of security programs only to find out that virtumonde feels just great in their protected systems. Self-proclaimed techies recommend to install half a dozen additional applications without giving any reasons except “this might help”. Somehow this makes me think that it’s much better to have protection AGAINST infection, rather than tools to cure virtumonde. Not specaking about registry changes it can make; sometimes it just doesn’t make sense to remove the trojan because the system is already a mess.

  • Not one person has mentioned stopping system restore. I can assure that if you have had this virus more than a day, it is imbedded in your system restore. I don’t believe anyone will have long term success without first shutting off system restore.

  • SDFix was the ONLY app that took the Virtumonde virus off. The date is Jan 12, 2009 and it worked great!

  • I have tryed all the above all week long…..I backed up pics,music,a few programs,and will re-instal xp with a complete wipeout….I say uncle to the virus

  • i wanted to try sdfix…. it isn’t there anymore. :(

    any new solutions?

  • Just got ensnared with this bugger. Going to give a go with SDFix, per the recommendations above (Spybot S&D didn’t take it out, running avast boot-time scan at the moment). SDFix download and readme can be found here:
    http://downloads.andymanchesta.com/RemovalTools/SDFix_ReadMe.htm


Leave a Reply

Your email address will not be published. Required fields are marked *

  • RSS qoto.org/@daviding (Mastodon)

    • daviding: “Reporting on research-in-progress on Sciencing and Philosoph…” August 18, 2023
      Reporting on research-in-progress on Sciencing and Philosophizing on Threads in #SystemsThinking tracing history of #pragmatism of #EricTrist + #FredEEmery & #WestChurchman + #RussellAckoff. Web video with #GarySMetcalf after #InternationalSocietyForTheSystemsSciences meetinghttps://coevolving.com/blogs/index.php/archive/sciencing-philosophizing-st-on-2023-07-10/
    • daviding: “Philosophical criticism of RfPs by #CWestChurchman (one of t…” August 6, 2023
      Philosophical criticism of RfPs by #CWestChurchman (one of the luminaries of #SystemsThinking). > All planning begins with a problem; however, it should not be confined to the problem statement. Also, the beginning should not be a clear problem formulation, but rather should be an utterance of moral outrage. John Dewey once said that problems arise […]
    • daviding: “How does #SystemsThinking relate to #Pragmatism? Within #Ph…” July 9, 2023
      How does #SystemsThinking relate to #Pragmatism? Within #PhilosophyOfScience, #CWestChurchman and #RussellLAckoff continued the #experimentalism of #EdgarASinger to put nonrelativistic pragmatism at the core of systems thinking in an entanglement of facts and values. https://coevolving.com/blogs/index.php/archive/nonrelativistic-pragmatism-and-systems-thinking/
    • daviding: “For those who think that open standards can be easily added …” July 7, 2023
      For those who think that open standards can be easily added on after code had already shipped, there's an extensive case study on Microsoft Office and OOXML. Here's a fun question: how long did it take Microsoft to meet the specification that they themselves wrote?http://openinnovationlearning.com/online/
    • daviding: “Threads doesn't initially support ActivityPub open standard,…” July 7, 2023
      Threads doesn't initially support ActivityPub open standard, and is not open source. Adding ActivityPub support doesn't preclude withdrawal later.> Will Meta embrace-extend-extinguish the ActivityPub protocol?> There are comparisons to be made between Meta adopting ActivityPub for its new social media platform and Meta adopting XMPP for its Messenger service a decade ago. There was a […]
  • RSS on IngBrief

    • Introduction, “Systems Thinking: Selected Readings, volume 2”, edited by F. E. Emery (1981)
      The selection of readings in the “Introduction” to Systems Thinking: Selected Readings, volume 2, Penguin (1981), edited by Fred E. Emery, reflects a turn from 1969 when a general systems theory was more fully entertained, towards an urgency towards changes in the world that were present in 1981. Systems thinking was again emphasized in contrast […]
    • Introduction, “Systems Thinking: Selected Readings”, edited by F. E. Emery (1969)
      In reviewing the original introduction for Systems Thinking: Selected Readings in the 1969 Penguin paperback, there’s a few threads that I only recognize, many years later. The tables of contents (disambiguating various editions) were previously listed as 1969, 1981 Emery, System Thinking: Selected Readings. — begin paste — Introduction In the selection of papers for this […]
    • Concerns with the way systems thinking is used in evaluation | Michael C. Jackson, OBE | 2023-02-27
      In a recording of the debate between Michael Quinn Patton and Michael C. Jackson on “Systems Concepts in Evaluation”, Patton referenced four concepts published in the “Principles for effective use of systems thinking in evaluation” (2018) by the Systems in Evaluation Topical Interest Group (SETIG) of the American Evaluation Society. The four concepts are: (i) […]
    • Quality Criteria for Action Research | Herr, Anderson (2015)
      How might the quality of an action research initiative be evaluated? — begin paste — We have linked our five validity criteria (outcome, process, democratic, catalytic, and dialogic) to the goals of action research. Most traditions of action research agree on the following goals: (a) the generation of new knowledge, (b) the achievement of action-oriented […]
    • Western Union and the canton of Ticino, Switzerland
      After 90 minutes on phone and online chat with WesternUnion, the existence of the canton of Ticino in Switzerland is denied, so I can’t send money from Canada. TicinoTurismo should be unhappy. The IT developers at Western Union should be dissatisfied that customer support agents aren’t sending them legitimate bug reports I initially tried the […]
    • Aesthetics | Encyclopaedia Britannica | 15 edition
      Stephen C. Pepper was a contributor to the Encyclopaedia Britannica, 15th edition, on the entry for Aesthetics.
  • Recent Posts

  • Archives

  • RSS on daviding.com

    • 2023/08 Moments August 2023
      Catching up with family and friends, locally in Toronto, west to Iowa, and east to Nova Scotia
    • 2023/07 Moments July 2023
      Busy with family visits and celebrations in first half of month. Return to quiet time in second half of month.
    • 2023/06 Moments June 2023
      Enjoyed early summer in Toronto with multiple festivals, and made a quick trip to Vancouver to visit family
    • 2023/05 Moments May 2023
      Spring full of cultural and family activities.
    • 2023/04 Moments April 2023
      Sightseeing one day in Vilnius, then variable weather in spring in Toronto.
    • 2023/03 Moments March 2023
      Right ring finger in splint discouraged activities, yet last week of month saw flying through Vienna to an intensive research visit to Kaunas University of Technology in Lithuania.
  • RSS on Media Queue

    • 2021/06/17 Keekok Lee | Philosophy of Chinese Medicine 2
      Following the first day lecture on Philosophy of Chinese Medicine 1 for the Global University for Sustainability, Keekok Lee continued on a second day on some topics: * Anatomy as structure; physiology as function (and process); * Process ontology, and thing ontology; * Qi ju as qi-in-concentrating mode, and qi san as qi-in-dissipsating mode; and […]
    • 2021/06/16 Keekok Lee | Philosophy of Chinese Medicine 1
      The philosophy of science underlying Classical Chinese Medicine, in this lecture by Keekok Lee, provides insights into ways in which systems change may be approached, in a process ontology in contrast to the thing ontology underlying Western BioMedicine. Read more ›
    • 2021/02/02 To Understand This Era, You Need to Think in Systems | Zeynep Tufekci with Ezra Klein | New York Times
      In conversation, @zeynep with @ezraklein reveal authentic #SystemsThinking in (i) appreciating that “science” is constructed by human collectives, (ii) the west orients towards individual outcomes rather than population levels; and (iii) there’s an over-emphasis on problems of the moment, and…Read more ›
    • 2019/04/09 Art as a discipline of inquiry | Tim Ingold (web video)
      In the question-answer period after the lecture, #TimIngold proposes art as a discipline of inquiry, rather than ethnography. This refers to his thinking On Human Correspondence. — begin paste — [75m26s question] I am curious to know what art, or…Read more ›
    • 2019/10/16 | “Bubbles, Golden Ages, and Tech Revolutions” | Carlota Perez
      How might our society show value for the long term, over the short term? Could we think about taxation over time, asks @carlotaprzperez in an interview: 92% for 1 day; 80% within 1 month; 50%-60% tax for 1 year; zero tax for 10 years.Read more ›
    • 2020/07/13 “Making Growing Thinking” |Tim Ingold (web video)
      For the @ArchFoundation, #TimIngold distinguishes outcome-oriented making from process-oriented growing, revisiting #MartinHeidegger “Building Dwelling Thinking”. Organisms are made; artefacts grow. The distinction seems obvious, until you stop to ask what assumptions it contains, about the inside and outside of things…Read more ›
  • Meta

  • Creative Commons License
    This work is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License
    Theme modified from DevDmBootstrap4 by Danny Machal