My Anti Spyware

How to remove Trojan Vundo (VirtuMonde, WindowsUpd, Adware.VirtuMonde, TrojanDownloader.Win32.Agent.e, ADW_TARGETSOFT.A)

For last week Vundo at second place in the top 10 spyware by Sunbelt.

DesktopScam 1,646 3%
Virtumonde 1,194 2%
Vcodec 915 2%
Hotbar 872 2%
SpyAxe 833 2%
WhenU.SaveNow 832 2%
Looking-For.Home Search Assist… 810 2%
EliteMedia 749 1%
NewDotNet 746 1%
CmdService 728 1%

Vundo (VirtuMonde, WindowsUpd, Adware.VirtuMonde, TrojanDownloader.Win32.Agent.e, ADW_TARGETSOFT.A) is an adware program that downloads and displays popup advertisements. It also offers to install other potentially unwanted software.

Standart symptoms:

computer work slow
pop ups from Adult Friend Finder
you have found rogue anti-spyware

If you found Vundo (VirtuMonde, WindowsUpd, Adware.VirtuMonde, TrojanDownloader.Win32.Agent.e, ADW_TARGETSOFT.A) on your computer, read these steps. If you have problems with your computer and don`t know WHY, read also

Also you can use CounterSpy for automatic removal Vundo.

Download VundoFix and save the file to your desktop.

Download HijackThis and save the file to your desktop.
Double click on the file to extract it to it’s own folder on the desktop.

Double-click VundoFix.exe to run it.

Put a check next to Run VundoFix as a task.
You will receive a message saying vundofix will close and re-open in a minute or less. Click OK
When VundoFix re-opens, click the Scan for Vundo button.
Once it’s done scanning, click the Remove Vundo button.
You will receive a prompt asking if you want to remove the files, click YES
Once you click yes, your desktop will go blank as it starts removing Vundo.
When completed, it will prompt that it will shutdown your computer, click OK.
Turn your computer back on.

Now you need to run HijackThis and click “Do a system scan only.” Place a check next to the following entries (if they are still there):

O2 - BHO: WTLHelper Object - {75DC57F8-D831-4AB8-86B7-4F826F4A0873} - C:\WINDOWS\system32\*****.dll
O20 - Winlogon Notify: ***** - C:\WINDOWS\system32\*****.dll

Where ***** is a random name, BUT all names are identical.

Now close all browser and other windows except for HijackThis, and click “Fix Checked” to have HijackThis fix the entries you checked.

If you are still having problems with spyware after completing these instructions, then please follow the steps outlined in the topic linked below: Spyware removal - Read Before Posting