Coevolving Innovations

… in Business Organizations and Information Technologies

Slaying the virtumonde virus

Brian phoned yesterday, to ask if Adam could take a look at Jasmine’s laptop. Adam wasn’t in, so Diana suggested that he talk to me. Brian initially said that he didn’t want to take my time looking at a PC with a potential virus on it. I told him just to drop the machine off, and I would add it to the other two computers on my desk. I’m second-level support for the eight computers we have in our house, so all of the hard problems come to me.

This laptop took forever to boot, and would come up with a message (as I had seen in the bitdefender forum) of:

Your system could become unstable

A potential problem has been detected and Windows has been shutdown buggy application to prevent damage to your computer.

****WXYZ.SYS – Address F73120AE base at C00000, DateStamp 36b072A3
Kernel Debugger Using: COM2 (Port 0x28f, Baud rate 192000)

Although the panel looks like a Windows error, the wording is pretty suspicious (and grammatically incorrect). It’s the virus talking, not Windows. (There’s no reason for the kernel to be going to a COM2 port, when you have high-speed Internet access!)

Other symptoms included thousands of pot???.tmp files in the root directory, and an inability to start up a command prompt, because the /windows/systems32/ directory was hidden.

First, I downloaded the VundoFix program from atribune.org and ran that. This program was last updated in January 2007. It took a while, but VundoFix confirmed the Virtumonde virus. I followed through to clean up the virus, and it removed and patched a lot of files … except one. VundoFix said that this file would be removed after a reboot. I rebooted, VundoFix came up, and the last file was supposedly fixed. With another reboot, however, the system32 directory was still invisible, and another run of VundoFix disclosed an infected file. I retried the search, fix and reboot three more times, with the same result.

With another web search, I found that Lavasoft had developed a VirtuMonde remover, and it has been incorporated into Ad-Aware 2007 (including the free version). I downloaded Ad-Aware 2007 Free, but when I tried to install it, the installation would fail because some other program was simultaneously being installed.

Looking at Windows Task Manager … Processes … I saw multiple instances of msiexec running. One of these msiexec processes blocks other installation requests. I killed these processes, and Ad-Aware 2007 installed smoothly. Running Ad-Adware then not only found and isolated the files infected by Virtumonde, but also two other viruses … as well as the usual browser malware. I always thought that Ad-Aware was just for browsers … but I guess Lavasoft does much more than that!

When I could bring up a command prompt, it was a simple instruction to delete pot*.tmp, in two directories.

The laptop seems to be working fine, now. I’m 99% certain that I’ve killed the Virtumonde virus. The 1% uncertainty is that there are msiexec processes that come up after a cold boot. These could be normal processes (e.g. one turned out to be the anti-virus profiles from Sympatico Security Services being refreshed) … or they could be the Virtumode virus continuing to lurk.

Brian picked up the machine this morning. I’ve advised him to back up all of the data files on CDROM, in the case that the virus isn’t really dead. He had been advised by a technician in a store to just reinstall Windows XP. For systems engineers from the mainframe generation, reinstalling an operating system is an extraordinary measure that isn’t taken lightly. In my opinion, the problem determination skills of PC-oriented technicians leaves much to be desired. The elapsed time — not working time, because it took so long for the programs to run, and the infected operating system to reboot — to fix the machine was probably 6 to 8 hours.

Most PC technicians are all about action, not thinking. Sticking to a problem for the better part of a working day requires patience. I wish that university and college students could develop the good analytical discipline to figure out the one technical issue that is wrong, and put that right.

14 Comments

  • When you run the Vundofix tool you should always run it in safe mode. That will give you the best chance for removeal. Other paid programs like webroot and spyware doctor will also kill it in it’s tracks. the free solutions are Spybot S and D and ad-aware but those do not keep you protected from getting it in the first place

  • In the computer repair business I run into this bad boy all the time. Their is a site that focuses only on this strain and how to remove it. check out http://www.virtumonde.net . They have plenty of removal guides for this.

  • I read a blog post on vundoremoval.com that said doing a system restore was the simplest way. I tried it and it worked great. After that I used spybot and removed the other traces. All in all it took under an hour and about 5 minutes of actual sit down time. If you just got infected recently then that vundo removal guide is the best.

  • it took me weeks to remove virtumonde.. and only one program fixes everything.. SDFix!!!

    Please run the following:

    1. sdfix

    1. Download SDFix and save it to your Desktop.

    http://downloads.andymanchesta.com/R…ools/SDFix.exe

    2. Double click SDFix.exe and it will extract the files to %systemdrive%
    (Drive that contains the Windows Directory, typically C:\SDFix)

    3. Reboot into Safe Mode`:-

    Reboot into >>>safe mode

    4. Open the extracted SDFix folder and double click RunThis.bat to start the script.
    Type Y to begin the cleanup process.

    It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot.
    Press any Key and it will restart the PC.

    When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.

    Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt

    Goodluck!!!

  • all you need is a program called “superantispyware” , it cleared out all of my vundo, virtumonde,etc, even from my memory, and its free for home use, with a donation if you think fit.

  • Yeah SDFix is rock

    the only one little proggy that helped me to get rid off this crap///

  • I sure wish that there were dates by the entries above. I have tried Superantispyware, AdAware, Spybot S-D, X-raypc, several online House Calls….all to no avail. Safe mode approach, Hiren’s CD and booting to Ram Drive utilizing programs on the disk still did not crack this recent version. Oh..by the way…the today is July 12, 2008. Going to try the SDfix mentioned above. Thanks for the ray of hope by your post michelle.

    michael in kansas

  • I second michael in kansas (Oldphart)–it’s Sept 1, 2008 and I’ve contracted the virus. I’ll try SDFix and see what happens….

  • I think Virtumonde virus showed how actually vulnerable and imperfect popular antivirus suites are. People bundle
    their computers with loads of security programs only to find out that virtumonde feels just great in their protected systems. Self-proclaimed techies recommend to install half a dozen additional applications without giving any reasons except “this might help”. Somehow this makes me think that it’s much better to have protection AGAINST infection, rather than tools to cure virtumonde. Not specaking about registry changes it can make; sometimes it just doesn’t make sense to remove the trojan because the system is already a mess.

  • Not one person has mentioned stopping system restore. I can assure that if you have had this virus more than a day, it is imbedded in your system restore. I don’t believe anyone will have long term success without first shutting off system restore.

  • SDFix was the ONLY app that took the Virtumonde virus off. The date is Jan 12, 2009 and it worked great!

  • I have tryed all the above all week long…..I backed up pics,music,a few programs,and will re-instal xp with a complete wipeout….I say uncle to the virus

  • i wanted to try sdfix…. it isn’t there anymore. :(

    any new solutions?

  • Just got ensnared with this bugger. Going to give a go with SDFix, per the recommendations above (Spybot S&D didn’t take it out, running avast boot-time scan at the moment). SDFix download and readme can be found here:
    http://downloads.andymanchesta.com/RemovalTools/SDFix_ReadMe.htm


Leave a Reply

Your email address will not be published. Required fields are marked *

  • RSS qoto.org/@daviding (Mastodon)

  • RSS on IngBrief

    • Goal, objective, ideal, pursuits (Ackoff & Emery, 1972)
      While Ackoff’s definitions of goals, objectives and ideals have been republished (and rewritten) multiple times, the 1972 definitions were derived from his original dissertation work.  Accordingly, in addition to the human-readable definitions, some mathematical notation is introduced. — begin paste — OUTCOMES 2.30. End (an immediate intended outcome) of a subject A in a particular […]
    • Pure Inquiring Systems: Antiteleology | The Design of Inquiring Systems | C. West Churchman | 1971
      The fifth way of knowing, as described by West Churchman, is a Singerian inquiring system. (This fifth way of knowing is more colloquially called Unbounded Systems Thinking in Mitroff and Linstone (1993)). The book On Purposeful Systems (Ackoff and Emery, 1972) was derived by Ackoff’s dissertation that was controversially coauthored with West Churchman. Purpose can […]
    • Process-Function Ecology, Wicked Problems, Ecological Evolution | Vasishth | Spanda J | 2015
      Understanding Process-Function Ecology by Ashwani Vasishth leads to luminaries in the systems sciences, including C. West Churchman, Eugene P. Odum and Timothy F.H. Allen.
    • The Innovation Delusion | Lee Vinsel, Andrew L. Russell | 2020
      As an irony, the 2020 book, The Innovation Delusion by #LeeVinsel @STS_News + #AndrewLRussell @RussellProf shouldn’t be seen as an innovation, but an encouragement to join @The_Maintainers where an ongoing thought network can continue. The subtitle “How Our Obsession with the New has Disrupted the Work That Matters Most” recognizes actual innovation, as distinct from […]
    • Republishing on Facebook as “good for the world” or “bad for the world” (NY Times, 2020/11/24)
      An online social network reproduces content partially based on algorithms, and partially based on the judgements made by human beings. Either may be viewed as positive or negative. > The trade-offs came into focus this month [November 2020], when Facebook engineers and data scientists posted the results of a series of experiments called “P(Bad for […]
    • 1969, 1981 Emery, System Thinking: Selected Readings
      Social Systems Science graduate students in 1970s-1980s with #RussellAckoff, #EricTrist + #HasanOzbehkhan at U. Pennsylvania Wharton School were assigned the Penguin paperback #SystemsThinking reader edited by #FredEEmery, with updated editions evolving contents.
  • Recent Posts

  • Archives

  • RSS on daviding.com

    • 2021/08 Moments August 2021
      Easing into a more regular schedule, enjoying seasonable summer afternoons, with extra couples time on the weekends.
    • 2021/07 Moments July 2021
      Summer in the city with temperate weather, without the usual crowd scenes for summer festivals.
    • 2021/06 Moments June 2021
      Early summer weather, with a city gradually emerging from pandemic shutdown orders given by the Province of Ontario.
    • 2021/05 Moments May 2012
      Brighter days of spring, with slight dips in temperature to remind us our four-seasons climate.
    • 2021/04 Moments April 2021
      Short bike rides around town, in variable spring weather under pandemic stay-at-home orders,
    • 2021/03 Moments March 2021
      Days brightening and temperatures above freezing, optimism with vaccinations against the pandemic.
  • RSS on Media Queue

  • Meta

  • Creative Commons License
    This work is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License
    Theme modified from DevDmBootstrap4 by Danny Machal