Virtumonde Keeps Coming Back After Spybot

Virtumonde Computer Virus

Virtumonde is a computer virus that infects computers running Windows operating systems. It is a sophisticated program that masks its signature from antivirus programs such as Spybot Search & Destroy.

Identification

A computer infected by Virtumonde will experience frequent pop-ups advertising fake antivirus programs such as AntiSpywareMaster, WinFixer and AntiVirus 2010. Secondary symptoms include the inability to start real antivirus software, Internet links being automatically redirected and firewalls being disabled.

Warning

Virtumonde automatically disables or deletes popular antivirus programs such as Spybot Search & Destroy. Users must first ensure that Spybot is not deleted by Virtumonde before the virus scanner can start. If Spybot is no longer present on your computer, download a fresh copy directly from the Spybot publisher website. After installation, change the name of the file "SDMain.exe" to a different name of your choice. Once the Spybot file is renamed, you will be able to run Spybot and remove Virtumonde.

Removal

To remove the virus, reboot windows into safe mode. Next, manually disconnect your Internet cable and turn off your wireless Internet connection. Start Spybot Search & Destroy while in safe mode and run a full system scan; Spybot will then remove Virtumonde.

References

• NCJRS: Examining the Creation, Distribution and Function of Malware Online
• Virginia Tech: Trojan.Vundo
• Spybot Search & Destroy: Virtumonde
• University of Wisconsin: Vundo.B Trojan Removal