Coevolving Innovations

… in Business Organizations and Information Technologies

Slaying the virtumonde virus

Brian phoned yesterday, to ask if Adam could take a look at Jasmine’s laptop. Adam wasn’t in, so Diana suggested that he talk to me. Brian initially said that he didn’t want to take my time looking at a PC with a potential virus on it. I told him just to drop the machine off, and I would add it to the other two computers on my desk. I’m second-level support for the eight computers we have in our house, so all of the hard problems come to me.

This laptop took forever to boot, and would come up with a message (as I had seen in the bitdefender forum) of:

Your system could become unstable

A potential problem has been detected and Windows has been shutdown buggy application to prevent damage to your computer.

****WXYZ.SYS – Address F73120AE base at C00000, DateStamp 36b072A3
Kernel Debugger Using: COM2 (Port 0x28f, Baud rate 192000)

Although the panel looks like a Windows error, the wording is pretty suspicious (and grammatically incorrect). It’s the virus talking, not Windows. (There’s no reason for the kernel to be going to a COM2 port, when you have high-speed Internet access!)

Other symptoms included thousands of pot???.tmp files in the root directory, and an inability to start up a command prompt, because the /windows/systems32/ directory was hidden.

First, I downloaded the VundoFix program from atribune.org and ran that. This program was last updated in January 2007. It took a while, but VundoFix confirmed the Virtumonde virus. I followed through to clean up the virus, and it removed and patched a lot of files … except one. VundoFix said that this file would be removed after a reboot. I rebooted, VundoFix came up, and the last file was supposedly fixed. With another reboot, however, the system32 directory was still invisible, and another run of VundoFix disclosed an infected file. I retried the search, fix and reboot three more times, with the same result.

With another web search, I found that Lavasoft had developed a VirtuMonde remover, and it has been incorporated into Ad-Aware 2007 (including the free version). I downloaded Ad-Aware 2007 Free, but when I tried to install it, the installation would fail because some other program was simultaneously being installed.

Looking at Windows Task Manager … Processes … I saw multiple instances of msiexec running. One of these msiexec processes blocks other installation requests. I killed these processes, and Ad-Aware 2007 installed smoothly. Running Ad-Adware then not only found and isolated the files infected by Virtumonde, but also two other viruses … as well as the usual browser malware. I always thought that Ad-Aware was just for browsers … but I guess Lavasoft does much more than that!

When I could bring up a command prompt, it was a simple instruction to delete pot*.tmp, in two directories.

The laptop seems to be working fine, now. I’m 99% certain that I’ve killed the Virtumonde virus. The 1% uncertainty is that there are msiexec processes that come up after a cold boot. These could be normal processes (e.g. one turned out to be the anti-virus profiles from Sympatico Security Services being refreshed) … or they could be the Virtumode virus continuing to lurk.

Brian picked up the machine this morning. I’ve advised him to back up all of the data files on CDROM, in the case that the virus isn’t really dead. He had been advised by a technician in a store to just reinstall Windows XP. For systems engineers from the mainframe generation, reinstalling an operating system is an extraordinary measure that isn’t taken lightly. In my opinion, the problem determination skills of PC-oriented technicians leaves much to be desired. The elapsed time — not working time, because it took so long for the programs to run, and the infected operating system to reboot — to fix the machine was probably 6 to 8 hours.

Most PC technicians are all about action, not thinking. Sticking to a problem for the better part of a working day requires patience. I wish that university and college students could develop the good analytical discipline to figure out the one technical issue that is wrong, and put that right.

14 Comments

  • When you run the Vundofix tool you should always run it in safe mode. That will give you the best chance for removeal. Other paid programs like webroot and spyware doctor will also kill it in it’s tracks. the free solutions are Spybot S and D and ad-aware but those do not keep you protected from getting it in the first place

  • In the computer repair business I run into this bad boy all the time. Their is a site that focuses only on this strain and how to remove it. check out http://www.virtumonde.net . They have plenty of removal guides for this.

  • I read a blog post on vundoremoval.com that said doing a system restore was the simplest way. I tried it and it worked great. After that I used spybot and removed the other traces. All in all it took under an hour and about 5 minutes of actual sit down time. If you just got infected recently then that vundo removal guide is the best.

  • it took me weeks to remove virtumonde.. and only one program fixes everything.. SDFix!!!

    Please run the following:

    1. sdfix

    1. Download SDFix and save it to your Desktop.

    http://downloads.andymanchesta.com/R…ools/SDFix.exe

    2. Double click SDFix.exe and it will extract the files to %systemdrive%
    (Drive that contains the Windows Directory, typically C:\SDFix)

    3. Reboot into Safe Mode`:-

    Reboot into >>>safe mode

    4. Open the extracted SDFix folder and double click RunThis.bat to start the script.
    Type Y to begin the cleanup process.

    It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot.
    Press any Key and it will restart the PC.

    When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.

    Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt

    Goodluck!!!

  • all you need is a program called “superantispyware” , it cleared out all of my vundo, virtumonde,etc, even from my memory, and its free for home use, with a donation if you think fit.

  • Yeah SDFix is rock

    the only one little proggy that helped me to get rid off this crap///

  • I sure wish that there were dates by the entries above. I have tried Superantispyware, AdAware, Spybot S-D, X-raypc, several online House Calls….all to no avail. Safe mode approach, Hiren’s CD and booting to Ram Drive utilizing programs on the disk still did not crack this recent version. Oh..by the way…the today is July 12, 2008. Going to try the SDfix mentioned above. Thanks for the ray of hope by your post michelle.

    michael in kansas

  • I second michael in kansas (Oldphart)–it’s Sept 1, 2008 and I’ve contracted the virus. I’ll try SDFix and see what happens….

  • I think Virtumonde virus showed how actually vulnerable and imperfect popular antivirus suites are. People bundle
    their computers with loads of security programs only to find out that virtumonde feels just great in their protected systems. Self-proclaimed techies recommend to install half a dozen additional applications without giving any reasons except “this might help”. Somehow this makes me think that it’s much better to have protection AGAINST infection, rather than tools to cure virtumonde. Not specaking about registry changes it can make; sometimes it just doesn’t make sense to remove the trojan because the system is already a mess.

  • Not one person has mentioned stopping system restore. I can assure that if you have had this virus more than a day, it is imbedded in your system restore. I don’t believe anyone will have long term success without first shutting off system restore.

  • SDFix was the ONLY app that took the Virtumonde virus off. The date is Jan 12, 2009 and it worked great!

  • I have tryed all the above all week long…..I backed up pics,music,a few programs,and will re-instal xp with a complete wipeout….I say uncle to the virus

  • i wanted to try sdfix…. it isn’t there anymore. :(

    any new solutions?

  • Just got ensnared with this bugger. Going to give a go with SDFix, per the recommendations above (Spybot S&D didn’t take it out, running avast boot-time scan at the moment). SDFix download and readme can be found here:
    http://downloads.andymanchesta.com/RemovalTools/SDFix_ReadMe.htm


Leave a Reply

Your email address will not be published. Required fields are marked *

  • RSS qoto.org/@daviding (Mastodon)

    • daviding: “Is it only deep systems scientists we would recognize that t…” June 1, 2024
      Is it only deep systems scientists we would recognize that the finale episode of Star Trek Discovery, titled "Life Itself", is the also the name of the 2005 book by Robert Rosen?Life Itself: A Comprehensive Inquiry Into the Nature, Origin, and Fabrication of Life, Robert Rosen, Columbia University Press at https://cup.columbia.edu/book/life-itself/9780231075657 #JudithRosen knows! https://memory-alpha.fandom.com/wiki/Life,_Itself_(episode)
    • daviding: “Pre-announcing April 30 Dialogic Drinks session I'm leading …” April 23, 2024
      Pre-announcing April 30 Dialogic Drinks session I'm leading on "#Yinyang and Daojia into #SystemsThinking through Changes", online 18:30 Singapore, 11:30 London, 6:30am Toronto. Repeating May 2, 8:00pm ET. Official #EQLab notifications https://www.eqlab.co/newsletter-signup
    • daviding: “Diachrony (or diachronic shifts) resurrects a word from 1857…” April 10, 2024
      Diachrony (or diachronic shifts) resurrects a word from 1857, better expressing *changes through time*. A social practice publication in 1998 contrasts synchronic with diachronic. https://ingbrief.wordpress.com/2024/04/10/diachronic-diachrony/
    • daviding: “Web video introduction of 15 minutes for 1-hour Lunch and Le…” March 22, 2024
      Web video introduction of 15 minutes for 1-hour Lunch and Learn #CentreForSocialInnovationToronto on "Systems Changes Dialogues for Social Innovation" invites practitioners for upcoming monthly meetings. Evocative animated images, details deferred to conversations with mentors. https://coevolving.com/blogs/index.php/archive/systems-changes-dialogues-csi/#SystemsThinking
    • daviding: “Web video of slides from "From Unfreezing-Refreezing, to Sys…” March 21, 2024
      Web video of slides from "From Unfreezing-Refreezing, to Systems Changes Learning" for Dialogic Drinks of #EQLab represents only 1/5 of the time compared to peer-led discussions. Concise hosting called for brevity, and richer presentations. https://coevolving.com/blogs/index.php/archive/from-unfreezing-refreezing-eq-lab/ #SystemsThinking
  • RSS on IngBrief

    • The Nature and Application of the Daodejing | Ames and Hall (2003)
      Ames and Hall (2003) provide some tips for those studyng the DaoDeJing.
    • Diachronic, diachrony
      Finding proper words to express system(s) change(s) can be a challenge. One alternative could be diachrony. The Oxford English dictionary provides two definitions for diachronic, the first one most generally related to time. (The second is linguistic method) diachronic ADJECTIVE Oxford English Dictionary, s.v. “diachronic (adj.), sense 1,” July 2023, https://doi.org/10.1093/OED/3691792233. For completeness, prochronic relates “to […]
    • Introduction, “Systems Thinking: Selected Readings, volume 2”, edited by F. E. Emery (1981)
      The selection of readings in the “Introduction” to Systems Thinking: Selected Readings, volume 2, Penguin (1981), edited by Fred E. Emery, reflects a turn from 1969 when a general systems theory was more fully entertained, towards an urgency towards changes in the world that were present in 1981. Systems thinking was again emphasized in contrast […]
    • Introduction, “Systems Thinking: Selected Readings”, edited by F. E. Emery (1969)
      In reviewing the original introduction for Systems Thinking: Selected Readings in the 1969 Penguin paperback, there’s a few threads that I only recognize, many years later. The tables of contents (disambiguating various editions) were previously listed as 1969, 1981 Emery, System Thinking: Selected Readings. — begin paste — Introduction In the selection of papers for this […]
    • Concerns with the way systems thinking is used in evaluation | Michael C. Jackson, OBE | 2023-02-27
      In a recording of the debate between Michael Quinn Patton and Michael C. Jackson on “Systems Concepts in Evaluation”, Patton referenced four concepts published in the “Principles for effective use of systems thinking in evaluation” (2018) by the Systems in Evaluation Topical Interest Group (SETIG) of the American Evaluation Society. The four concepts are: (i) […]
    • Quality Criteria for Action Research | Herr, Anderson (2015)
      How might the quality of an action research initiative be evaluated? — begin paste — We have linked our five validity criteria (outcome, process, democratic, catalytic, and dialogic) to the goals of action research. Most traditions of action research agree on the following goals: (a) the generation of new knowledge, (b) the achievement of action-oriented […]
  • Recent Posts

  • Archives

  • RSS on daviding.com

    • 2024/05 Moments May 2024
      Busy May with art university graduate exhibition, travel to UK seeing Edinburgh, Hull, Manchester, London, returning home for wedding in Lefroy, annual cemetery visits with family, and spending time with extended family in from Chicago.
    • 2024/04 Moments April 2024
      Return from visiting family in Vancouver BC, clan events and eldercare appointments
    • 2024/03 Moments March 2024
      More work than play for first part of month, in anticipation of trip to Vancouver to visit family.
    • 2024/02 Moments February 2024
      Chinese New Year celebrations, both public and family, extended over two weekends, due to busy social schedules.
    • 2024/01 Moments January 2024
      Hibernated with work for most of January, with more activity towards the end of month with warmer termperatures.
    • 2023/12 Moments December 2023
      A month of birthdays and family holiday events, with seasonal events at attractuions around town.
  • RSS on Media Queue

    • What to Do When It’s Too Late | David L. Hawk | 2024
      David L. Hawk (American management theorist, architect, and systems scientist) has been hosting a weekly television show broadcast on Bold Brave Tv from the New York area on Wednesdays 6pm ET, remotely from his home in Iowa. Live, callers can join…Read more ›
    • 2021/06/17 Keekok Lee | Philosophy of Chinese Medicine 2
      Following the first day lecture on Philosophy of Chinese Medicine 1 for the Global University for Sustainability, Keekok Lee continued on a second day on some topics: * Anatomy as structure; physiology as function (and process); * Process ontology, and thing ontology; * Qi ju as qi-in-concentrating mode, and qi san as qi-in-dissipsating mode; and […]
    • 2021/06/16 Keekok Lee | Philosophy of Chinese Medicine 1
      The philosophy of science underlying Classical Chinese Medicine, in this lecture by Keekok Lee, provides insights into ways in which systems change may be approached, in a process ontology in contrast to the thing ontology underlying Western BioMedicine. Read more ›
    • 2021/02/02 To Understand This Era, You Need to Think in Systems | Zeynep Tufekci with Ezra Klein | New York Times
      In conversation, @zeynep with @ezraklein reveal authentic #SystemsThinking in (i) appreciating that “science” is constructed by human collectives, (ii) the west orients towards individual outcomes rather than population levels; and (iii) there’s an over-emphasis on problems of the moment, and…Read more ›
    • 2019/04/09 Art as a discipline of inquiry | Tim Ingold (web video)
      In the question-answer period after the lecture, #TimIngold proposes art as a discipline of inquiry, rather than ethnography. This refers to his thinking On Human Correspondence. — begin paste — [75m26s question] I am curious to know what art, or…Read more ›
    • 2019/10/16 | “Bubbles, Golden Ages, and Tech Revolutions” | Carlota Perez
      How might our society show value for the long term, over the short term? Could we think about taxation over time, asks @carlotaprzperez in an interview: 92% for 1 day; 80% within 1 month; 50%-60% tax for 1 year; zero tax for 10 years.Read more ›
  • Meta

  • Creative Commons License
    This work is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License
    Theme modified from DevDmBootstrap4 by Danny Machal