Friday, April 11, 2008

When Virus Attacks - Virtumonde

A while back I had this bad infection by, what I found out later to be an AdWare called, Virtumonde. There were 2 infected .dll files in my system32 folder what I believe 2 different strains of Virtumonde. ZoneAlarm successfully detected both the infected files but it could neither rename, delete, quarantine or do anything with it despite repeated attempts over many days. I tried scanning the system with AVG and Avast antivirus but neither detected the virus. Now, since it was an AdWare as it proclaimed itself as, I tried using AdWare and SpyBot to no avail. Then somewhere in the www I found its a Trojan! And I started downloading Trojan/Malware removers. Tried a lot of them but none seemed to even detect it. I tried to unhook the .dll from its process using Unlocker but the moment I unhook it the system used to restart. After some a dozen odd softwares failed to fix it, something just struck and I scheduled a boot-time scan on my Avast antivirus and THAT finally got rid of the virus and I haven't had any problems with it after that.

Now, there is a lot of stuff on many forums on how to remove it but none of those methods worked either for me nor for the people who had posted for help. It is such a damned persistent virus that it keeps coming back and infecting the system sometimes by even residing and hiding in memory. Besides, all those process were too long. It is an old virus so I am surprised why I couldn't find any credible cures on the net. Anyway, thats one lesson learnt for me.

No comments: