# Arrgh. Virtumonde virus

**URL:** https://boards.straightdope.com/t/arrgh-virtumonde-virus/476816
**Category:** Factual Questions
**Created:** [December 12, 2008, 2:06am UTC](https://boards.straightdope.com/t/arrgh-virtumonde-virus/476816 "2008-12-12T02:06:34Z")
**Posts on this page:** 15
**Page:** 1

<div class="post-metadata">

### Author: ![Stan\_Shmenge](https://avatars.discourse-cdn.com/v4/letter/s/94ad74/32.png) [@Stan\_Shmenge](https://boards.straightdope.com/u/Stan_Shmenge)
#### Post date: [December 12, 2008, 2:06am UTC](https://boards.straightdope.com/t/arrgh-virtumonde-virus/476816/1 "2008-12-12T02:06:34Z")

</div>

It seems impossible to get rid of. Any ideas?

---

<div class="post-metadata">

### Author: ![RealityChuck](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/realitychuck/32/195_2.png) [@RealityChuck](https://boards.straightdope.com/u/RealityChuck)
#### Post date: [December 12, 2008, 3:06am UTC](https://boards.straightdope.com/t/arrgh-virtumonde-virus/476816/2 "2008-12-12T03:06:03Z")

</div>

> **[Cyber Security Software & Anti-Malware | Malwarebytes](https://www.malwarebytes.com/)**
>
> Protect your home and business PCs, Macs, iOS and Android devices from the latest cyber threats and malware, including ransomware.

Best tool for the job.

---

<div class="post-metadata">

### Author: ![G0sp3l](https://avatars.discourse-cdn.com/v4/letter/g/c68b51/32.png) [@G0sp3l](https://boards.straightdope.com/u/G0sp3l)
#### Post date: [December 12, 2008, 4:11am UTC](https://boards.straightdope.com/t/arrgh-virtumonde-virus/476816/3 "2008-12-12T04:11:35Z")

</div>

One of our machines got this one, after three days of fighting it I gave up and reinstalled Windows. I tried [virtumonde.net](http://virtumonde.net), spybot, mcafee, trend micro, hijack this and some others nothing was a permanent fix. Maybe you’ll have better luck than I did.

Whoever created this should be fed to fire ants.

---

<div class="post-metadata">

### Author: ![Joey\_P](https://avatars.discourse-cdn.com/v4/letter/j/919ad9/32.png) [@Joey\_P](https://boards.straightdope.com/u/Joey_P)
#### Post date: [December 12, 2008, 4:52am UTC](https://boards.straightdope.com/t/arrgh-virtumonde-virus/476816/4 "2008-12-12T04:52:24Z")

</div>

malwarebytes cleaned my parents system of virtumonde in one try just last week. At least AFAICT (that is, Adaware stopped picking it up).

---

<div class="post-metadata">

### Author: ![Stan\_Shmenge](https://avatars.discourse-cdn.com/v4/letter/s/94ad74/32.png) [@Stan\_Shmenge](https://boards.straightdope.com/u/Stan_Shmenge)
#### Post date: [December 12, 2008, 5:01am UTC](https://boards.straightdope.com/t/arrgh-virtumonde-virus/476816/5 "2008-12-12T05:01:06Z")

</div>

> [@G0sp3l](#):
>
> One of our machines got this one, after three days of fighting it I gave up and reinstalled Windows. I tried [virtumonde.net](http://virtumonde.net), spybot, mcafee, trend micro, hijack this and some others nothing was a permanent fix. Maybe you’ll have better luck than I did.
> 
> Whoever created this should be fed to fire ants.

Seriously. I could get behind the death penalty for guys like these.

Wiki says they are from South America. So their chances of facing justice are about as great as if they were from Romania. Yay third world!

---

<div class="post-metadata">

### Author: ![Stan\_Shmenge](https://avatars.discourse-cdn.com/v4/letter/s/94ad74/32.png) [@Stan\_Shmenge](https://boards.straightdope.com/u/Stan_Shmenge)
#### Post date: [December 12, 2008, 5:02am UTC](https://boards.straightdope.com/t/arrgh-virtumonde-virus/476816/6 "2008-12-12T05:02:08Z")

</div>

> [@Joey\_P](#):
>
> malwarebytes cleaned my parents system of virtumonde in one try just last week. At least AFAICT (that is, Adaware stopped picking it up).

Trying it now.

---

<div class="post-metadata">

### Author: ![clairobscur](https://avatars.discourse-cdn.com/v4/letter/c/839c29/32.png) [@clairobscur](https://boards.straightdope.com/u/clairobscur)
#### Post date: [December 12, 2008, 5:31am UTC](https://boards.straightdope.com/t/arrgh-virtumonde-virus/476816/7 "2008-12-12T05:31:10Z")

</div>

I managed to get rid of it once, but I tried so many tools that unfortunately I can’t tell which one eventually worked. But there is hope.

You should probably try to post on one of these boards who specialize in helping people getting rid of viruses, like [http://www.bleepingcomputer.com/](http://www.bleepingcomputer.com/) They seem to be very good at it.

---

<div class="post-metadata">

### Author: ![Una\_Persson](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/una_persson/32/346_2.png) [@Una\_Persson](https://boards.straightdope.com/u/Una_Persson)
#### Post date: [December 12, 2008, 5:34am UTC](https://boards.straightdope.com/t/arrgh-virtumonde-virus/476816/8 "2008-12-12T05:34:14Z")

</div>

I wish you all the luck in the world. I tried umpteen “sure fixes” for it over weeks of trying, and none of them worked. Me, Fierra, and two other people, one of them an honest IT expert could not clean 2 PCs, and finally the only thing left was a reformat.

I cannot for the life of me understand how Microsoft themselves cannot make a fix for it. Did they or did they not write the fucking OS?

---

<div class="post-metadata">

### Author: ![Stan\_Shmenge](https://avatars.discourse-cdn.com/v4/letter/s/94ad74/32.png) [@Stan\_Shmenge](https://boards.straightdope.com/u/Stan_Shmenge)
#### Post date: [December 12, 2008, 5:40am UTC](https://boards.straightdope.com/t/arrgh-virtumonde-virus/476816/9 "2008-12-12T05:40:59Z")

</div>

> [@clairobscur](#):
>
> I managed to get rid of it once, but I tried so many tools that unfortunately I can’t tell which one eventually worked. But there is hope.
> 
> You should probably try to post on one of these boards who specialize in helping people getting rid of viruses, like [http://www.bleepingcomputer.com/](http://www.bleepingcomputer.com/) They seem to be very good at it.

The problem is, half of the places that are promising to help are crooks themselves that just want to pile on. Seriously. Death Penalty.

---

<div class="post-metadata">

### Author: ![Stan\_Shmenge](https://avatars.discourse-cdn.com/v4/letter/s/94ad74/32.png) [@Stan\_Shmenge](https://boards.straightdope.com/u/Stan_Shmenge)
#### Post date: [December 12, 2008, 11:11am UTC](https://boards.straightdope.com/t/arrgh-virtumonde-virus/476816/10 "2008-12-12T11:11:46Z")

</div>

Seems that Malwarebytes did the trick. Like clairobscur, I have been throwing everything at it though. Got rid of a few other things too. System even seems speedier! Thanks.

---

<div class="post-metadata">

### Author: ![samclem](https://avatars.discourse-cdn.com/v4/letter/s/a9a28c/32.png) [@samclem](https://boards.straightdope.com/u/samclem)
#### Post date: [December 12, 2008, 12:40pm UTC](https://boards.straightdope.com/t/arrgh-virtumonde-virus/476816/11 "2008-12-12T12:40:44Z")

</div>

Another malwarebytes satisfied user here.

---

<div class="post-metadata">

### Author: ![Stan\_Shmenge](https://avatars.discourse-cdn.com/v4/letter/s/94ad74/32.png) [@Stan\_Shmenge](https://boards.straightdope.com/u/Stan_Shmenge)
#### Post date: [December 12, 2008, 1:28pm UTC](https://boards.straightdope.com/t/arrgh-virtumonde-virus/476816/12 "2008-12-12T13:28:11Z")

</div>

> [@samclem](#):
>
> Another malwarebytes satisfied user here.

Still wrestling with it though. malwarebytes got rid of MOST of it, but AVG is still flagging something as I run Windows Defender, so it is not all gone. Will fire another salvo!

I am writing a diary if the battle. If you see it here, it means I won, somehow, and you will know how. Wish me luck. I think I am close to quashing this roach.

---

<div class="post-metadata">

### Author: ![Stan\_Shmenge](https://avatars.discourse-cdn.com/v4/letter/s/94ad74/32.png) [@Stan\_Shmenge](https://boards.straightdope.com/u/Stan_Shmenge)
#### Post date: [December 12, 2008, 1:32pm UTC](https://boards.straightdope.com/t/arrgh-virtumonde-virus/476816/13 "2008-12-12T13:32:42Z")

</div>

And go to my new thread, [here](http://boards.straightdope.com/sdmb/showthread.php?p=10562877#post10562877), where I propose, in this age of terabyte hard drives, a scheme.

.

---

<div class="post-metadata">

### Author: ![CandidGamera](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/candidgamera/32/2878_2.png) [@CandidGamera](https://boards.straightdope.com/u/CandidGamera)
#### Post date: [December 12, 2008, 2:03pm UTC](https://boards.straightdope.com/t/arrgh-virtumonde-virus/476816/14 "2008-12-12T14:03:50Z")

</div>

There is a variant of Vundo/Virtumonde floating around that MalWareBytes will not remove completely. I had that version recently, but was able to take care of it.

> **[Trojan Horse?](https://boards.straightdope.com/sdmb/showthread.php?t=495693)**
>
> My Avast antivirus started throwing fits this evening as I browsed the Dope - lots of malicious temporary internet files showing up, and the installation without consent of some toolbar called ‘Mirar’. Anybody else having trouble?

---

<div class="post-metadata">

### Author: ![casdave](https://avatars.discourse-cdn.com/v4/letter/c/c6cbf5/32.png) [@casdave](https://boards.straightdope.com/u/casdave)
#### Post date: [December 12, 2008, 6:13pm UTC](https://boards.straightdope.com/t/arrgh-virtumonde-virus/476816/15 "2008-12-12T18:13:55Z")

</div>

Some of these virus hide inside system restore files, or volume information files.
