I don’t have any form of real-time virus, spyware or firewall protection on my main computers at home, other than the basic firewall capabilities of my Dlink router, which serves up wireless connectivity to my laptops, PocketPC and Wii. In all these years I’ve never had a virus or spyware problem. When my wife’s laptop decided to bite the dust, my main laptop, which is in the living room, became something of a communal laptop, used by my wife, daughter and me. Over the course of a month or so, the laptop was getting slower and slower, which was driving my wife crackers. Finally I decided to do some spring cleaning to try to get the laptop to it’s former speed demon status. The laptop in question is only 8 months old, which means it’s main OS is Vista. I’ve already written before on my Vista experiences, so won’t bore you here, but having Vista seemed to be a particular problem in vanquishing the evil peril that lurked beneath.

My first attempt at making the laptop faster, had me pruning files, defragmenting the hard disk and trying various other odds and sods, but something told me, there was a greater problem at hand. In the past Lavasoft’s Ad-Aware, has been a tool I’ve turned to, to determine if there was something untoward installed on my machines. I downloaded the latest version, 2007 and sure enough once the software had done it’s snooping, it determined that I was infected by the Virtumonde spyware virus. I let Ad-Aware try to remove the virus and although it reported the virus was gone, upon rebooting, I knew it was still infesting my machine. This virus is a bugger to get rid of as it infects the explorer process and reinfects the host. Once I found out I had the Virtumonde virus, I tried many of the freely available spam busting programs, but to no avail. Ad-Aware now even refused to admit that the virus was still present, after telling me, it had been vanquished. I was now beginning to get really annoyed and a little frustrated,

After doing a bit of research on the Internet, I was able to manually confirm that I was indeed still being plagued by Virtumonde. I brought up MSConfig and looked at the programs in my startup list. Sure enough there were two programs on the startup list that I did not recognise. These two programs are just two of the pseudonyms used by the virus to hide it’s identity. Some of the popular program names are “MS Juan”, “cmds”, and “MSSERVER”. To further confirm these programs roots, they were all set to run from a temporary directory on my laptop, a directory that is linked to the primary user account on the laptop, in this case “colboy”. So the command line for the virus looks something like this ‘rundll32 “c:\Users\colboy\AppData\local\temp\mrkocaef.dll”,run’, the DLL being some random kind of file name. Now using MSConfig, I can just de-select these pesky programs and life is good again, er not quite so fast. I did this, rebooted and found that the files had been added once again to the startup program list. In fact it’s worse than that. I could deselect the programs, exit MSConfig, go back into MSConfig and the programs had again risen from the ashes. The reason for this, as mention previously, is because the main Virtumonde virus, attaches itself to the Explorer process, the one that it an integral part of Windows. As soon as the virus sees the settings in the registry being removed, it regenerates them. Unable to find a software tool to remove the virus and unable to remove it manually, I decided to grin my teeth and bare it for a little while. I even toyed with the idea of just re-formatting everything and at the same time downgrading to Windows XP, but decided I really only wanted to do that as a last resort.

Anyway a few days passed and I finally had a splash of inspiration. Would I have a better chance of removing the virus, if I was in Safe Mode. Safe Mode is a way of running Vista, and indeed former versions of Windows, whereby a limited amount of functionality is enabled. With Windows 95 and 98, Safe Mode was usually enforced after Windows crashed or blue screened for whatever reason. You usually had to reboot into Safe mode, to allow Windows a chance to fix itself. I decided to go one stage more primitive by going into Safe Mode with Command Line, thinking this would give me a a pure console/DOS screen.

You get into Safe Mode, by pressing the [F8] key usually just after you switch your machine on, after the machine reports it’s BIOS settings and tells you the keys required to enter the BIOS setup. I usually press [F8] every second or so, until I get the screen asking me what form of Windows I want to boot. Here I select Safe Mode with Command Line. Once boot up has completed, you get a basic background and a console window, although this looked slightly different to the command line safe mode I’d used before in prior versions of Windows. The first thing I wanted to do, was remove everything in the temporary directory associated with my user login. This is the same directory in which those DLL files were being run from when I checked using MSConfig. I did this by typing:

cd \users\colboy\appdata\local\temp
del *.* /s/f/q

This deletes all files in the currently selected directory, and all sub directories, including read only files, without asking for confirmation. Please bare in mind this directory name will differ depending on the path reported in MSConfig. I ran the delete command a couple of times, just to make sure nothing was missed, as I will still asked confirmation on some files. Now all the files were vanquished, I was about to reboot, but thought I’d see if MSConfig would run in this primitive safe mode. As luck would have it, it did, so I ensured the commands flagged to run at startup, were no longer checked, not that it would have made much difference, seeing as the DLL’s were no longer there, but liked to do this just for completeness.

I rebooted my machine and lo and behold, Virtumonde was but a distant memory. I am a little perturbed that Windows Vista’s Defender didn’t prevent the infection, but now at least I know how to get rid of Virtumonde if it returns, as now do you. Any questions on this process, don’t hesitate to post a comment or email me. Please also remember all these steps are repeated at your own risk. It worked for me, and should work for you just fine, but you never know how these things mutant and change over time.

convert this post to pdf.

Filed under: Unpublished Article