win32/adware.virtumonde

[lt31]

Hi guys, this could be a difficult one, so all help and patience would be very gratefully recieved.

I am asking for help for my brothers laptop, he has the win32/adware.virtumonde virus.

I have searched this forum and many others before asking for help. He canot access his computor at all! before the desktop loads up the fake warning screen comes on, then nothing else. All solutions I have read say to download the removal tool and free scanners etc to the desktop then start in safe mode and run them. but, as I have said he cant get to the desktop to use the internet, nor can he get the laptop to start in safe mode.

Second problem is, I have a little knowledge of computers, he has none and I can only contact him over the phone as he is 100 miles away from me!

Any suggestions would be great!

[jholland1964]

Hi lt31 and welcome to daniweb.
As long as you have access to another computer, and of course you do, you can download the necessary tools to YOUR computer and then put them on a disk and take them to his.
Now I have to ask, how do you know for sure that this is the infection that is on the computer? Did he learn this by doing a scan or are you just going by symptoms showing?
You say he cannot load even in Safe Mode. How is he trying to do this?
You would download the tool below, save it to a disk and then run it on the affected computer but if it doesn't boot at all I am not certain that can be accomplished either.
The tool to remove this is VundoFix
# double-click VundoFix.exe to run it.

# Click the Scan for Vundo button.

# Once it's done scanning, click the Remove Vundo button.

# You will now receive a prompt asking if you want to remove the files, click the YES button. Once you click yes, your desktop will go blank as it starts removing Vundo.

# When completed, it will prompt that it will shutdown your computer, click the OK button.

# When the computer has shutdown, turn your computer back on.

[lt31]

Thanks for the reply, I will answer your questions the best I can
I know this is the infection he has, as the screen that is over his desktop says win32/adware.virtumonde.

After searching google I found an image of what the screen looks like and it is exactly what he described to me.

He tried booting into safe mode by pressing f8 on startup, it starts boot up procedure, but then a screen pops up saying it can no longer procede as windows did not shut down properly!

I take it vundofix must be run from windows, if this is the case will I be able to access the disc in safe mode (pressuming I can get it to boot into safe mode)?

[jholland1964]

I take it vundofix must be run from windows, if this is the case will I be able to access the disc in safe mode (pressuming I can get it to boot into safe mode)?

The only answer I can give you is maybe.
Try disconnecting the compute from the internet first and see if you can boot to safe mode and use the cd