Virtumonde 15/dec/2008 SOLVED

So yeah. In less than 30 minutes of writing the previous post, it was solved.

my linux AVG detected 3 infected files. 2 were expected, they were in the trash bin and those files I previously deleted manually.
the third one was kind of a surprise, as it was in the windows system restore folder... WTF!!! I always have windows restore OFF because it's a nest of viruses (easy to get in, hard to delete once in there -for a normal user at least-)

I deleted all 3 of them, also deleted the whole restore folder and rebooted into windows.

Aha, nice, AVG doesn't complain anymore (every 5 seconds) that he found virtumonde without being able to clean it.
1-0 for me.

Fast check with spyware doctor detects the same 6 "fakealert" infections he had detected previously. but this time he was able to remove them and a second scan came out totally clean.

Oh! and I found that nice nifty tool I mentioned before, which turns out to be a nice antimalware program: "Malwarebytes' Anti-Malware"


So, to recap it all in short, this is how i removed this latest version of virtumonde. The method might not be the best one, but worked for me. And it's a method were you don't really have to waste much time manually fixing stuff.

DISCLAIMER: everything that follows now is for ADVANCED USERS. I really CBA to teach you how to delete a file or how to boot into a livecd. If you don't know such things, you should bring your computer to a real tech ASAP!

TOOLS USES (totally free):
- AVG antivirus (http://free.grisoft.com) also download and safe the linux version and virus definitions.
- SPYWARE DOCTOR (the free version that comes with google pack: http://pack.google.com)
- MALWAREBYTES' Anti-Malware (www.malwarebytes.org/mbam.php)
and specially:
- UBUNTU 8.10 LIVECD (www.ubuntu.com)

every1 should have that CD and those tools on a usb stick.

PROCEDURE:
- in windows install those programs and update them. make sure system restore is disabled.
- chances are the tools detect the trojan but aren't able to fix it, due the hooked nature of the damn thing. but we want to have the tools installed and updated before we boot again into windows.
- reboot into the ubuntu live CD, plug in your USB stick and install the linux version of AVG. once installed go into it's options and update from a folder (the folder on your USB stick where you saved the definitions)
- let linux AVG make a full scan and once done, you'll have to manually delete the found files (make sure to empty trashbin afterwards)
- reboot again into windows. let all your windows tools make a full scan and delete any possible rest of the infection (like traces in the registry, etc)