Virtumonde

J

Jim_in_Germany

New member
Hi,
I updated Spybot Search and Destroy today and ran a scan. Unfortunately Spybot is finding an instance of the Trojan "Virtumonde" in my Firefox and Opera default bookmarks!

Virtumonde: [SBI $61F39AC8] Lesezeichen (Firefox: default)

Therefore I decided to use one of the backups of my C: partition I had made with Acronis TrueImage.
However, when I had restored my Windows to an earlier state (and updated Spybot), the trojan was still there!
I then took the first image I had made of my C partition (ca. 1 week after installing the computer). Spybot still finds Virtumonde!!

I tried downloading the Virtumonde fix from the Major Geeks website but it didn't find the Virtumonde trojan on my machine.
Do I have this trojan? Have I had this trojan all along? I haven't noticed a drop in performance or any other indication and am normally very security conscious.

Could somebody please give me some advice as to what to do. Many thanks in advance.
 
P.s.

P.S. Suffice to say, I tried to get Spybot to fix the problem, which it did. When I scanned again, it found nothing. After that I was surfing with Firefox for 20 minutes, scanned again and the same entry was there (the one from Opera had disappeared, but I presume it will return if i open Opera).
 
Thanks

Hi tashi,
Thanks for your reply.
I had hoped for a little more constructive help and not just a series of links to follow. I also found the "Read before posting link" a little confusing.
Anyway, I did everything advised in the link and found no traces of Virtumonde. It is most likely a false positive.
However, call me paranoid, but to be on the safe side I have decided to format my harddrive reinstall everything anyway (yipee).
All the best.
Jim
 
Hello.
Jim_in_Germany said:
I had hoped for a little more constructive help and not just a series of links to follow.
Click to expand...
Each forum has a different purpose and the malware forum volunteer helpers only work this particular forum. Therefore as you posted here, I gave you the procedure link in order for you to produce a log and receive assistance.

Ditto links to the other forums, in case upon reflection, you decided you had posted in the wrong one.

Jim_in_Germany said:
Anyway, I did everything advised in the link and found no traces of Virtumonde. It is most likely a false positive.
However, call me paranoid, but to be on the safe side I have decided to format my harddrive reinstall everything anyway (yipee).
All the best.
Jim
Click to expand...

Seems rather drastic for what could prove to be a false positive but it's your machine.

Best wishes. :)
 
You must log in or register to reply here.
Back
Top