Hi. New here. But I just had a brush with Virtumonde. Still trying to figure out if I have removed it all at present. However I think I caught it today from a dodgey warez file (I deserve what I get I guess).

It's on a public torrent site and comments reported it to have passed many AV scans (But you cannot trust people who make comments like that anyhow).

I was wondering about posting the link to the torrent so someone could take a look at it. Or would that be a rule violation?

If you do , do it one of these ways :

http://www.virustotal.com/

http://www.virustotal.com/

hxxp://www.virustotal.com/

Anything like this will make it so it cant be directly clicked .

I'm thinking that vundo was in the setup.exe file which is autoexecuted via the rar self executing file. If you rename the file to rar or zip and open it it shows the setup.exe file and the file that installs the application. You can install the application without setup.exe so that is why I believe that is the culprit. To prevent spreading 'warez' I am going to upload the setup.exe only to rapidshare renamed as vundo.vir and leave it to whomever wishes to look at it to rename it if they need to.

I'd be interested to know if this really is where I caught the trojan or not. Otherwise it is in the warezed application itself which I would prefer not to infringe further by distributing (Suddenly I have an attack of morals).

hxxp://rapidshare.de/files/39721981/vundo.vir.html

The file you uploaded is malware. I've added it to the malware listserv.

/p1098585-MD5_ede8de02b67e988a7a7218a210645664.html

It can become disguised in practically any warez. I just got it embedded in ACAD 08.

Pesky little critter, although norton "cough" it, browser still fires up random pages -the notoriously fake security pages- so at least it's half there.

Oh btw, MS updates are fried too, can't get the Service to run but it could be unrelated to Vundo.

You could try removing the rest of the malware with this http://www.microsoft.com/downloads/details.aspx?FamilyId=AD724AE0-E72D-4F54-9AB3-75B8EB148356&displaylang=en

Have you had any luck getting Windows Update to work? If not it's worth spending some time trying to fix it.