Malware Removal Forums

Virtumonde.dll is bothering me.

kovantchine · 2008-05-17T12:37:03+00:00

Spybot detects VIRTUMONDE.DLL and cannot get rid of it. SmitFraudFix did not work. I would greatly appreciate help to get rid of it. Thanks. Hijackthis has been renamed Pierre before running it : Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 14:31:05, on 17/05/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16640) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe c:\PROGRA~1\FICHIE~1\mcafee\mna\mcnasvc.exe c:\PROGRA~1\FICHIE~1\mcafee\mcproxy\mcproxy.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe C:\Program Files\McAfee\MPF\MPFSrv.exe C:\Program Files\SiteAdvisor\625

14 min read

✨ The volunteers who helped with this thread aren't active anymore, but you can still get a personalized answer — click Ask AI below.

Rodav MRU Master Emeritus

May 24, 2008, 9:35 PM UTC

Hi,

Thank you for your kind words.

Combofix /u indicated Combofix is uninstalled. What about the polluted restore files?
Can I use restore points without restoring the virus ?

Well spotted, uninstalling ComboFix will create a new restore point and flush the old ones. This is not something to do regularly, having a bad restore point is better than having none. You can safely use restore points now as the infections we dealt with have gone.

Does unloading-loading the system increases its activity ?

I'm sorry I don't fully understand your question. There are many different kinds of malware that will perform different tasks, some will lie idle on a machine until called to perform a certain task, while others will attempt to cause havoc at the moment they access a machine.

Do you have a knowledge of the virus behaviour ?

Everything I learned about malware removal has been done at the University here and I continue to learn everyday. It is a very close and extremely knowledgeable community, so if I need assistance there are others who are willing and able to help me out.

If you are interested in learning how malware behaves, how to remove it and about computers in general you may like to consider joining the University here:
http://www.malwareremoval.com/university.php

kovantchine

May 25, 2008, 8:34 AM UTC

Thank you for your explanations.
I have applied to MRU because, as an ex system designer/programmer, I'm fed up dealing with the black box Windows. I also want to try and counteract the irresponsability of the virus designers & propagators.
All the best,
Pierre.

Rodav MRU Master Emeritus

May 25, 2008, 11:43 AM UTC

You're very welcome Pierre, I'll see you inside the university.

Gary R Administrator

May 27, 2008, 8:00 AM UTC

This topic is now closed.

If you are the originator of this topic, and you need it re-opened please send an email to 'admin at malwareremoval.com', including a link to this topic.

If you have been helped and wish to donate to help with the costs of this volunteer site, please read Donations For Malware Removal

Please do not contact us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.

Gary R

✨ Ask AI about this thread

No ads, no affiliate links — generated on request from this thread's own archived content, not written by forum staff. Never run a scan/removal tool as a self-service step if the original thread describes it being done under a helper's direct supervision, and don't include your name, email, or other personal details in a follow-up question. See our privacy page for details on how this works.