Vundo Shmundo

{ May 14th, 2008 }

The Vundo Trojan (aka Virtumonde or Virtumondo) as been the focus of my detestation for a little while now. Whenever I am researching symptoms there is always someone out there who says, ‘Could be Vundo. Run Vundo removal programs.’ In the worst cases I have found that this trojan or at least one of the strains of this trojan will cause a PC to run extremely slow. I am talking get coffee and drink it all during startup. Its purpose is also to download other baddies to spatter ads in your face and some of them can be quite a nuisance to remove. Norton has made a removal tool/scanner for vundo and there is at least one private source for another scanner/cleaner. Depending on what variation of the trojan and how long it has been burrowing in your system feeding off your bandwidth these scanners may not completely remove it all.

Anyway, the real reason I wanted to write this post is while I have been researching this problem and its removal I found a cause. The good folks over at atribune.org say on their instructions that one of the main ways vundo can get into your machine is through exploits in older versions of java and java runtime environment. This makes sense to me because when you are redirected to the java web site to download a updated version it will download and install the latest version, but it will not remove the past version during the installation. So if you go into your Control Panel -> Add/Remove Programs you should see all the different versions of this program that you have had on your machine. You should remove these leaving only the latest versions.This shot is from my own machine when I first found this information.

The latest as of this post is ‘Java 6 Update 5′ and ‘Java SE Runtime Environment 6 Update 1′. When in doubt just remove them all and go to Java.com to download the latest.

Well thats all for now. Keep safe. If you need protection check out rsltech.com/ads.php

Categories: Virus Removal ~ ~ Trackback

2 Responses to “Vundo Shmundo”

  1. 1
    VundoFixer

    I needed to get a real vundo infection for testing purposes. It took me less than fifteen minutes of googling, downloading and installing a piece of software that contained embedded code of Trojan Vundo. It’s no surprise McAfee VirusScan showed no signs of infection - yet errors started popping up, one of them being a software.php file which Windows was unable to open (that’s natural - a don’t have a Win32 PHP parser installed). Just curious what Vundo can make if it executes a php code?.. Also, the parasite quickly created a folder in Program files, settled in restore point, places autorun entries in the registry, etc. No wonder this is a hard to remove trojan.

  2. 2
    Rich

    Now that some time has passed the major protection programs are finding vundo, but what I see in Symantec software is that it shows partially removed next to the findings and it does not claim to completely remove the infection. After this partial removal however the little vundo removal apps do not find any infection.
    Interesting

Leave a Reply