How to Get Rid of the Trojan Vitrumundo

The Virtumonde trojan, which is also known as the Vundo or Virmo trojan, is a type of spyware program that installs itself on your computer when you download an infected file or surf infected web pages. The Virtumonde program keeps logs of the sites you visit so that it can launch targeted advertisements on your screen whenever you connect to the Internet. You can remove the Virtumonde trojan by disconnecting your computer from its Internet connection and then running a removal program.

Difficulty: Moderate

Instructions

Things You'll Need:

• Virtumonde removal tool

1. Open up a web browser. Navigate to a website that has a program capable of deleting the Virtumonde trojan such as the Symantec Virtumonde removal tool, which can be found at http://www.symantec.com/business/security_response/writeup.jsp?docid=2004-112210-3747-99. Download the removal tool and then close down the web browser.

2. Shut down any other programs that are currently running. Disconnect your computer from its internet connection, either by physically removing its Ethernet cable if its a wired connection or completely shutting off the router if you use a wireless internet connection.

3. 
    
   The Processes Tab

   Bring up the computer's Task Manager menu screen by simultaneously pressing the "Ctrl," "Alt," and "Delete" buttons. Navigate over to the "Processes" tab and then click on the "Image Name" button. Scroll through the list of files that are currently open on your computer.

4. 
    
   The "End Process" Button

   Check to see if there are any files currently open named "Virtumonde," "Vundo," or "Virmo." Click on the name of the file if it is present and then shut the file down by clicking on the "End Process" button. Repeat the process with any of the other file names if they are listed.

5. Close the Task Manager and then find the removal tool you downloaded earlier. Double-click on the file name and then click on the "Start" button. Wait for the removal tool to finish scanning your computer's hard drive. Restart the computer once the tool has finished running to completely remove the Virtumonde Trojan from your computer. Reconnect your computer to your internet connection by attaching the Ethernet cable or powering on the wireless router.

Tips & Warnings

• You will only be able to open the Virtumonde removal tool if you are currently logged into the computer under an administrative account.
• If you don't disconnect your computer from its Internet connection the Virtumonde Trojan will just immediately re-install itself as soon as the removal tool starts running.

References

• Removing virtumonde
• Getting rid of virtumonde

Resources

• Download Virtumonde removal tool