Hi, I too am having the restart issue. :-[ This happened shortly after avast successfully intercepted two trojans that came from a website. I deleted them on the spot when I got the warning message but then I decided to run a full virus and spybot scan to be safe. Avast detected nothing but spybot detected the virtumonde thing. I believe I deleted it, but the system seems to boot up slowly now and I get the restart system error every time from avast.
I saw another person mention virtumonde and I think that is the problem and not what the other person was saying about adobe acrobat. I don’t even have adobe update on my system and I am having this problem.
Here is a bit more info, the website thinks the attack came from a third party ad source and not from their site, but regardless I was bombarded by:
Two trojans that avast successfully intercepted.
Virtumonde which made it through and installed, but was soon thereafter successfully removed by spybot.
Internet Speed Monitor which caused a bunch of pop ups & IE to start on its own.
I removed the Internet speed monitor through add / remove which has happened before, and the two trojans never installed.
The only thing that made it through was Virtumonde, which although apparently now removed from my system, has left avast seemingly messed up with the restart error. Also I have tried full avast uninstall and reinstall and it does not solve this issue. :-\
What browser were you using? Is everything on your computer up to date? These drive-by downloads usually require out of date, un-patched and vulnerable software to be present.
I tried everything you mentioned and nothing helped. I even tried system restore but for whatever reason, even though system restore had been on and the system volume information folder had a bunch of restore points, after the vermonde infection it was empty. I use firefox and all software was up to date. I am a pretty knowledgeable user and this has me completely lost. It would seem the Virtumonde was successfully removed by Spybot, but it left a lot of damage in its wake. My hunch is the registry hotkeys and some other things were altered during the infection that cause the current issue with avast restart needed and the now seemingly slow Windows boots. Haven’t ahad an issue like this in years, usually spybot and avast do the trick immediately. :-[
Thanks, though I tried that one before and it didn’t work. I did find something else that seems to work, here is more of an update:
It seems the infection can be caused in a number of ways including having Sun java 1.5 or earlier.
I tried a program by a company named atribune called Vundofix. Vundofix detected and removed a ton of Virtumonde files on my system that neither spybot nor avast could detect at all. It seemed to remove all but one .dll file, but I am still getting the avast start error and the boot is still slow but definitely better then before.
Whatever this problem is it is definitely related to a new more potent virtumonde infection. Looks like avast has some work to do to fix whatever virtumonde messed up. I still think the issue is probably related to damage in the windows / avast registry. I am rescanning now to see if Vundofix redetects the files, if I don’t post in a few minutes it means the second scan was clean and the best first step to solving this issue is to get Vundofix to at least get rid of the virus and then go from there with resolving the other issues.
Nope, the VundoFix scan seems to redetect the files. I am going to try another method, where VundoFix detects and shows exact location of infected Virtumonde files, then I will try to find this dos boot deletion program I used to have that can delete files before windows boot. That may get rid of this.
I think they are all crap files, it seems the list of bad files is about 40% less then the original scan so the first time fixed some of them and improved it a little. If these files look good to delete I will try the boot delete next.
Alright here is the update, this is a MAJOR problem
Vundofix deletes the files, then on restart it says it cannot start the virus as specifies in the windows registry (Anyone know how I can turn it off in the registry? where it is?)
then on next reboot all the Vundo / Virtumonde files are back. In addition to the ones listed hkcmd.exe and igfxpers.exe are also back.
What’s most incredible is that even my boot-delete tool, which until now has deleted everything, cannot seem to remove these Vundo files?
Any ides? Anyone? This is definitely the cause of the slow boot and avast problems.
I am going to try the symantec vundo removal tool next…
Edit: Update As expected symantec didn’t even detect anything. The only thing that can even detect it is Vundofix by atribune, but that tool isn’t able to delete it. Any ideas on how to deactivate it from registry? Where the system 32 start up keys are?
Great info thanks, I am trying something called trojanhunter 5.0 by mischele or something software which according to wiki, is the only program that can handle the latest version of this vundo thing. If that doesn’t work I will try one of these rootkit detectors next. Will any of this stuff be incorporated into avast eventually? I will try to find out how to deactivate the virus in the registry too if it’s possible and nothing above works.
Edit: Trojanhunter did not work, this must be a very new and very bad version of vundu / virtumonde. I tried that other file by the forum user and nothing seemed to happen.
Trojanhunter did not work, this must be a very new and very bad version of vundu / virtumonde. I tried that other file by the forum user and nothing seemed to happen. Will try the rootkit stuff next but I think this may be something entirely new that the avast and other experts need to get working on. :-\
They have been for the last few weeks. One of the problems being encountered is vundos ability to update and infect program executables. Some programs may seem fine in one use and infected the next. Programs such as av’s, antispyware as well as window components like msconfig have been infected. Each use of these programs result in more infected files.
The person seemed to have the same problem, could detect but not delete with vundofix. I downloaded combofix mentioned in the middle of the thread and it seems to have kicked Vundo / Virtumonde’s @$$ into next Tuesday! 8)
There are no longer any Vundo files on my system, at least right now, even after reboot.
Combofix also deleted a bunch of other stuff, including some stuff in the avast and Adobe acrobat (another user mentioned) folder, as well as a n=bunch of quicktime stuff.
Avast is still working, I did get the start error but the thing that caused all of this appears to be gone and boot is completely back to normal. Here is a log of what combofix deleted: