Vundo Removal Guide Comments
Feb.25, 2008 in
Virtumonde
Please post your comments about our Basic Vundo removal guide in here. We want to know if it worked for you and if the directions were easy to follow and understand. Are we missing anything in the guide? Things like that.
by you taking the time to do this you will be helping thousands of others!!! 
Lets kill vundo together all.
February 26th, 2008 at 5:14 am
Thanks!!!! I tried several other methods to remove vundo but yours actually worked. I hate vundo. I was infected for a whole week. I bought Mcaffee right after I was infected but it would not remove vundo.
March 1st, 2008 at 5:01 am
Spyware Doctor took care of it, thanks …. spysweeper, norton they all failed. You guys put me in the right direction. And I can recommend a scan in safe mode with a paid version of spyware doctor
March 2nd, 2008 at 6:47 pm
Worked great. Thanks for the help. I ran the scans in safe mode like sugested in the guide and was vundo free by the end.
I did go ahead and purchased spyware doctor after the fact becuase when I ran the scan it did NOt pick up any vundo items but did pick up several other programs that I knew I had.
March 13th, 2008 at 4:52 pm
Many thanks guys. It’s you guys who give us faith that there are good people out in the web community. I had Spybot blocking Vundo processes but just couldn’t get rid of the .dll files it keeps creating. Your method though, worked like a charm after a system restore. If only Vista worked so well!
March 24th, 2008 at 10:55 am
Thanks so much for your help. I was loosing the will to live with Virtumonde, but I followed your “Easy Removal” guide to the letter and it worked. I am pretty sure the key thing though is the system restore at the start – without that your process doesn’t seem to work. I had to try 3 or 4 different restore points before I finally found one that worked. Spyware Doctor didn’t seem to remove Virtumonde though, but did find a whole host of other nasty trojans that Spybot didn’t. Between the 2 of them, they sorted it.
So happy to have my system rid of this crap though. Thanks!!
March 24th, 2008 at 2:51 pm
loosing the will to live!!! Glad you found the guide before the dark forces took over. You mentioned that Spyware Doctor did not work for you? Did you run the scan in safe mode? Did you happen to try the vundofix tool? I know Spyware Doctor does work but sometimes a few scans are needed. Anyways glad you are all cleaned now.
P.S. I use that system restore feature for almost any virus/spyware program I come across. I do that first before installing any other anti-spyware program.
April 25th, 2008 at 11:18 am
I went through process and it still doesn’t seem to be working. Part of it could be I have no restore points from before the infection occured. I was also unable to get spyware doctor to work. I have the program running but I am unable to click anything in the program. Just shows as “Checking”. I followed each step though but with no luck. Spybot turned up the Virtumonde files… as usual.. but it still appears to be on as I am getting the popups yet. Not sure what to do :/. I will try this again when I have time to see if I can have any luck with it.
May 3rd, 2008 at 11:27 pm
I’m at my wits end. I’ve tried ALL the methods & am in the middle of trying them all over again. I have not been able to remove VUNDO. I also have to say that the rant aside (from the main vundo removal guide) I HAVE a firewall. I used to work in programming a decade ago & while I’m rusty, I’m not so forgetful as to NOT have a proper firewall & virus protection. Perhaps I don’t have the right choice. I’ve got McAfee– and to be honest, it’s been great. I’ve had it for 4 years & have never had a problem before. I’m curious– it detects Vundo & tells me it removed it– but the file’s still sitting on my harddrive. It’s resisting all attempts to remove.
Any advice would be most appreciated.
Thanks for the resource.
May 4th, 2008 at 3:18 am
I like Mcafee but not because of it’s protection. It’s the lack of it that I like. I make most my money repairing computers that are infected and Mcafee sucks at blocking spyware. You mentioned you have Virus protection and a firewall. What about spyware protection? Virus protection is not Spyware protection.
As far as the guides go they do work as I use the methods myself. I take it you are running the needed scans in safe mode. you can also all of the following free programs to help out
Ad-aware
Spybot S&D
Vundofix
Symantic Virtumonde removal tool
Highjackthis
I always use Spyware Doctor as I own a licence to use it. That would be the simpilar way but does cost money. Other then that the service at http://www.onlinecomputerrepair.org can remove it for you for 89 bucks. Small price to pay for the time it takes to remove the threat.
Hope this helps.
May 6th, 2008 at 4:38 pm
I’m using nod 32 anti virus which detected this difficult to remove virus. The program said it would delete it after a reboot since it was running in virtual memory or something along those lines. Since this was not my computer and Linux was not installed as is normally i used an Ubuntu Live CD and simply deleted the problematic windows\system32\cbxQjjJy.dll that was shown in the nod32 virus alert in the command line. You can also delete it with the gnome browser. I rebooted and the virus alert no longer appeared.
May 7th, 2008 at 6:48 am
Worked like a charm. Thanks for the removal guide. I tied several other methods but your worked great.
May 8th, 2008 at 5:57 pm
Talk about hard to remove. I already bought some internet security software and did not want to by another program. I ended up using the computer repair shop this site recommended. By far the best 89 bucks I ever spent. They also did a tuneup on my Vista system. I saw how much time it would take me to remove this and just gave up. Props to all you DIY selfers out there. You guys have more patients then me.
June 16th, 2008 at 7:47 pm
I have gone through all of your steps and I am still infected. Unfortunately, I did not have a restore point to go back to before I started. As a means of removing the virus, the system restore was turned off, once turned back on all points were deleted. Is there anything I can try without paying for support. I see that some of these services require payment but have not always resolved the problem. So, any other suggestions?? This is frustrating since I just rebuilt my laptop 2 weeks ago!
Thanks!!
June 16th, 2008 at 8:00 pm
Hi Lisa
What current anti-virus and anti-spyware software do you have? If it’s free then that is why you got infected in the first place.
One thing I do not normally reccomend to use because it is not a fully stable program is Combofix.exe. This is a free based program that can work but in about 3 percent of cases it can cause big issues.
Also if you have not already try smitfraudfix and vundofix. Lastely you can use highjack this to help stop any items from starting up and it also works to remove files on but.
you really should consider having active protection so you do not get infected again. NO free client offers active protection.
Hope the above free programs help.
June 27th, 2008 at 2:36 pm
Purchased Spyware Doctor. Followed procedure, however, Vundo comes back on re-boot everytime. Please help.
June 27th, 2008 at 4:10 pm
Tony,
Can you outline the steps you used?
Did you ensure Spyware Doctor was updated? Did you run it in safe mode? What traces keep coming back? Just post the answers in the forum.
Feel free and start a thread in our forum. There we can give more help. You may need to use highjack this to help delete the infected file. Also you can use Combofix as well.
July 25th, 2008 at 7:06 am
Hello, thank you for this site! Eventually, I succeeded in removing vundo but it took me a whole day.
Comments to your instruction: I was confused at the safe mode step. It would be good if you mentioned why it must be just SAFE MODE and not SAFE MODE WITH NETWORKING. Another thing is that if Vundofix or Spybot wants to reboot, you HAVE TO reboot into NORMAL MODE, otherwise the program does not start. Yes, it is logical but it didn’t come to my mind at that time.
I had to use two more programs to definitely remove vundo:
1) http://secured2k.home.comcast.net/tools/VirtumundoBeGone.exe – I used this after Vundofix and Spybot. I’m not sure whether it was necessary.
2) Finally, I had to use the program Autoruns to remove some items in registry – see this website: http://www.bleepingcomputer.com/tutorials/tutorial101.html.
July 29th, 2008 at 9:41 pm
Thanks! I have spent far too many hours trying to remove this. your guide worked very well.
By the way I see you also run windowvistarepair.com
I was there a few months ago about an issue with Vista and netowrking a printer. Your guide on the blog worked perfect.
Keep up the good work
July 30th, 2008 at 1:17 am
i cant even do the first step, something else isnt letting me use system restore:(
July 30th, 2008 at 5:20 am
Just skip the first step then and go to the next. It’s not a need to do just helps out big time.
August 21st, 2008 at 2:08 am
I purchased spyware doctor and did the scan in both normal and safe mode… it can find the virtumonde but when I press the FIX button after the scan is done, before it can remove the threat, my computer reboots… what could be the problem? is it the Trojan that reboots my computer?
THANX
August 21st, 2008 at 2:19 am
NO your system should not be rebooting when you hit the fix button. Did you get Spyware doctor with anti-virus or just the Spyware doctor portion?
Regardless here is what I would do.
Uninstall Spyware doctor, Re-boot and re-install spyware doctor. We are doing this just in case the install did not go right.
Update the program. Then reboot into safe mode with Networking. Then go out and download the free Spybot Search and Destroy and the free smitfraud fix tool. Install both. Run the Smitfraud fix tool first. Then run Spybot S and D. Remove whatever those programs find. Reboot normal. Spybot will most likely run at startup. Go ahead and let it. Once you log in run Spyware doctor to remove any left over traces that those other two programs could not remove.
Worst case senario you can pay 89 bucks and have http://www.onlinecomputerepair.org remove this for you. If you go this route mention this site and tell them you were told you can get a free computer tune-up with the removal of Virtumonde.
August 21st, 2008 at 7:25 am
I must thank you for the great tip. I think my computer is completely disinfected now.
I appreciate your help and I will surely recommend yor website to anyone who might have the same problem.
October 12th, 2008 at 6:20 pm
It’s amazing that people are still getting infected with vundo. That little bugger still drive quite a few visitors to my website to help them remove vundo. With all the hidden processes, it is not easy for the average user to get rid of it. Keep up the good work
October 20th, 2008 at 11:05 am
Thanks!!!! I tried several other methods to remove vundo but yours actually worked. I hate vundo. I was infected for a whole week. I bought Mcaffee right after I was infected but it would not remove vundo.
November 4th, 2008 at 1:15 am
I got the Vitrumonde.dll I scanned my computer with spybot and also HiJack, after I noticed how my system was acting really goofy online.. Tho the instructions are always a work in progress, and I thank those that post them and do the work to help out.
But it really does not help out, I have to download a suggested 4 or 5 other programs, and maybe have to pay for 1 or 2 out, of the 4 or 5. So i am just going to jam up my hard drive with nothing but spyware programs. LOL
I do update and immunize with spybot, I also do not use Internet explorer for this very reason how ever some of the Poker Software I use requires Internet Explorer. I use Firefox all the time and get your typical low to, none threat, spyware.
The one suggestion on System Restore is very interesting, I know I am being an idiot here and it was probably posted, but is there a way to find out what time or date I got this into my system or do I have to keep doing a restore and Spybot scan till Spybot no longer finds this Trojan in the system..
If so this is brutal, I have had to mess with this before, and it takes what seems hours LOL was hoping to cut the time short and hit it on the first shot…
December 30th, 2008 at 8:36 pm
Spyware doctor finds two threats and 24 infections and removes them, but after reboot this happens again, every time.
So after the last cleanup I rebooted to safe mode (no networking)
First ran VundoFix (version 7.0.0.6): Found nothing
Spybot (spybotsd160, version 1.6.0.0): Found several infections and removed them.
Spyware Doctor found the same threats it found after every startup and fixed them.
Now I reran SpybotSD and it found three infected registry entries which it removed again, and again
Same for Spyware Doctor and SpybotSD over and over.
I will now try the advanced guide method.