Virtumonde 15/dec/2008 SOLVED

So yeah. In less than 30 minutes of writing the previous post, it was solved.

my linux AVG detected 3 infected files. 2 were expected, they were in the trash bin and those files I previously deleted manually.
the third one was kind of a surprise, as it was in the windows system restore folder... WTF!!! I always have windows restore OFF because it's a nest of viruses (easy to get in, hard to delete once in there -for a normal user at least-)

I deleted all 3 of them, also deleted the whole restore folder and rebooted into windows.

Aha, nice, AVG doesn't complain anymore (every 5 seconds) that he found virtumonde without being able to clean it.
1-0 for me.

Fast check with spyware doctor detects the same 6 "fakealert" infections he had detected previously. but this time he was able to remove them and a second scan came out totally clean.

Oh! and I found that nice nifty tool I mentioned before, which turns out to be a nice antimalware program: "Malwarebytes' Anti-Malware"


So, to recap it all in short, this is how i removed this latest version of virtumonde. The method might not be the best one, but worked for me. And it's a method were you don't really have to waste much time manually fixing stuff.

DISCLAIMER: everything that follows now is for ADVANCED USERS. I really CBA to teach you how to delete a file or how to boot into a livecd. If you don't know such things, you should bring your computer to a real tech ASAP!

TOOLS USES (totally free):
- AVG antivirus (http://free.grisoft.com) also download and safe the linux version and virus definitions.
- SPYWARE DOCTOR (the free version that comes with google pack: http://pack.google.com)
- MALWAREBYTES' Anti-Malware (www.malwarebytes.org/mbam.php)
and specially:
- UBUNTU 8.10 LIVECD (www.ubuntu.com)

every1 should have that CD and those tools on a usb stick.

PROCEDURE:
- in windows install those programs and update them. make sure system restore is disabled.
- chances are the tools detect the trojan but aren't able to fix it, due the hooked nature of the damn thing. but we want to have the tools installed and updated before we boot again into windows.
- reboot into the ubuntu live CD, plug in your USB stick and install the linux version of AVG. once installed go into it's options and update from a folder (the folder on your USB stick where you saved the definitions)
- let linux AVG make a full scan and once done, you'll have to manually delete the found files (make sure to empty trashbin afterwards)
- reboot again into windows. let all your windows tools make a full scan and delete any possible rest of the infection (like traces in the registry, etc)

Virtumonde, spyware protectors, LIARS!

So, long story short: one of my work testing machines got infected with the fabulous latest version of virtumonde on thursday or friday...

No big problem usually, just do my thing and it will be fixed... NOT!

This version is a bit more stubborn than previous version, it hooks itself so much into the system that even booting into safe mode is useless. As soon as your windows (xp sp3) is on, the trojan is loaded.

I detected some infected DLLs pretty easy tho it was totally useless to delete them (from ms-dos) or to block them from being created again... the trojan just created different files.

Now the funny thing is... I usually work with either symantec corporate (not the crappy home version) and/or AVG which is more than enough for any of our simple office-user customers. But ofc none of those knew anything about this new virtumonde on friday. A query to "daddy google" with the name of the DLLs (I actually didn't knew it was virtumonde yet) gave me NOTHING.
Ahhh, the fun... to be the amongst the first ones to get a new virus :S

Anyways. I came back to work today monday morning, and asked "daddy google" again. wohooo we have some info now. A few lame antispyware homepages (lame but real. not some fake stuff) wrote about the DLLs also without knowing yet what exact trojan it was.

AND NOW THE KICKER! they fucking claimed that their software was able to detect and delete this trojan since mid november.
L.M.F.A.O. what a bunch of lying CUNTS.
HELLLOOOOO???? YOUR SOFTWARE DIDN'T EVEN EXIST YET 2 DAYS AGO!!!! at least no one fucking knew about you.
Well, in fact they ofc did exist before that. their software exist since 2006... but I had never heard about them and they aren't even available on softonic.com or download.com (not that this was important, but so u get an idea)

Anyways, back to mister virtumonde... I might aswell write down some tips, in case some1 is in desperate need of help to remove it... tho I warn u that it won't be easy.

As antivirus softwares and antispywares apparently FAIL at removing this (even in windows safemode) I am gonna tell you what you can do.
Following softwares have FAILED at removing this new version (+- 12/dec/2008) of virtumonde (all latest versions at this date):
- symantec corporate antivirus
- kaspersky
- AVG
- panda antivirus
- mcafee
- spyware doctor
- ad-aware
- hijackthis
- spybot
due the fact that this virtumonde trojan is also a rootkit and hooks itself to the system even in safe mode.
Above mentioned softwares don't even aknowledge (per mail or on their webpages) the problem. As in: no info about this version whatsoever.

In a few days we'll se the fantastic LIE that they allways KNEW about this virus, that they were the WORLD FIRST in detecting it and that their software protects you from this virus SINCE 1997!!! Oh and: ofc their software will suddenly be updated with the proper definitions against this trojan virus to backup their argument.

Anyways. at this precise moment, my test machine is booted into a ubuntu 8.10 (linux for those who don't know) liveCD and running a scan with a linux version of AVG updated today monday 15th december 2008. Found a couple of virtumonde infections so far (didn't detect anything on friday) so I'll see if that works.
As I am writing this, I am browsing different webs like the symantec one (which has usually good instructions on manually removal of viruses) but there is nothing helpful yet.

A few weeks ago I downloaded some sort of small antimalware to remove a older version of virtumonde which a old symantec didn't catch... dammit that tool looked nice and worked great, but I can't freaking remember the name of it :S

Well, linux AVG finished. As it's only a scanner I'll have to delete the files manually. The scan has probably not been too in-depth as it didn't last too long.
The virus name is "trojan horse vundo.cj", aka: virtumonde or fakealert.

If you search that up on google, you'll find plenty of helpful forums. No sense for me to write my ass off on it now.

I'll try some stuff now and update a bit later.

My left hand hurts. I am right handed and shouldn't worry? WRONG!!!

For a few days already, my left hand hurts. I don't know what it is and I will wait a few days before going to a doctor because it seems to hurt a bit less every day.

But the thing is that you would say "bah, doesn't matter. it's your left hand but you're righthanded"...

And I am starting to realize how of a big BULLSHIT that actually is. Yes I unable to write with the left hand. I am unable to wear a sword properly with the left...

but... that actually doesn't make me right handed. It's just the way I was teached to write in school and the way I practiced wielding a sword...

I am righthanded? most ppl. is right handed? BULLSHIT. Same might be said about religion. Most are catholic? BULLSHIT, it's just what they were FORCED to when kids...

Look... I am supposed to be right handed... yet...

- I wank with the left (right on the mouse to clic on porn) xDDDDD nah, j/k this is actually situational... sometimes left, sometimes right. so what's the deal here with being right handed, hum?
- I play PC games with the right on the mouse and left on the keyboard. imo keyboard needs more "concentration" to use than a mouse. should be considered harder to use than a mouse, right? This being said, i am actually kinda good using a mouse with the left too and keyboard with the right... so where is being righthanded important in this equation? nowhere.
- I also notice now that my left hand hurts, that most doors are opened with the left hand
- Or how I take a drink (can, bottle, glass) with the left hand...

all in all, I've never noticed it before but I do now that my left hand hurts: I am doing many many things on a daily basis with the left hand... is the whole lefthanded/righthanded just one of those things you get teached when a kid and then you stick with it?

Fucking music

9am ... Daydreaming/sleeping in the underground. Suddenly some fucking retard turns on music on his mobile at top volume. I wait a bit to see if it's just an incoming call, but no.
But today I won't stay quiet.
- Would you mind turning off the music or using earplugs?
He and his friend turn around, send me menacing look and seeing how I'm not impressed he turns the music off. Then he asks:
- Are u sleepy?
- Yes, i guess.
- Then go sleep at your home.
- And you go listen to your music at home.
- Fair enough.
was his reply with an angry tone.

You'd think this was it, but no. 5 seconds later he turned the music on again at a low volume, but I guess all the ppl. looking at him made him turn it off again.

Then, shortly before he left the wagon, and seeing how I seemed to be sleeping, the fucking cunt started to make noises with his keys against the crystal.

Geez, why is ppl. So fucking retarded. Assholes.
I only know 3 kinds of retards acting like this around here..
- Kids/teens who don't know shit about manners yet... In fact they don't know shit about life either.
- Brainless wannabe skinheads... Who only have balls when surrounded by their 10 friends (real skinheads can "solo against the world", if you chose to be a skinhead, at least do it right)
- Latino hiphop macho motherfuckers , who think the world is theirs. This was the case of the guy this morning in the underground.

Anyways... travel time is over. let's get to work.