I'm trying to help a relative with a trojan/spyware problem. They keep getting spyware called Virtumonde and a trojan called Vundo. I've already taken care of the problem once and yet the darn thing is back. I'd like to know where this thing is coming from. If it's from something already on the computer, a website, a windows exploit, an open port, etc. Does anyone know where Virtumonde and Vundo come from or how you get them?

This must be the how/why? Potential Vulnerability with Sun Java auto update

Hi, Mikey To get rid of the parasites do the following: 1. Download and install a reliable anti-spyware program. I suggest Microsoft AntiSpyware Beta. 2. Update your spyware emover. (3. Optional) Boot your computer into Safe Mode. 4. Scan the system and remove all the objects related to Vundo, VirtuMonde and other parasites. You also can manually remove both Vundo and VirtuMonde threats. Follow these manual removal instructions: for Vundo, for Vundo.b, for VirtuMonde (aka VirtuMundo). Please note that manual removal requires some knowledge.

Alternate manual solution: I tried all the steps in the earlier Vundo discussion (see http://www.computing.net/security/wwwboard/forum/15697.html ) and was unable to remove the Vundo virus. The symantec fixvundo.exe program never picked it up and using normal anti-virus scans would remove it from the registry but was unable to delete the .dll file because it was in use by a system program. My solution: 1. Used Symantec Anti-virus to determine the name of the vundo .DLL file and to clean it from the registry. 2. Used HijackThis.exe to determine the location of the .DLL file. 3. Wrote down the file name and location. 4. Restarted my computer and booted up using my Windows XP installation CD to provide the operating system. This allowed me command prompt access without running the Vundo .DLL file. I was able to delete the .DLL file since it wasn't being used by WINLOGON.exe or EXPLORER.exe. The virus is gone. If you need a copy of the Windows XP CD you can download it online for $50 and then burn it onto a CD. Neil