Troj/Virtum-Gen

Issue

How to remove Troj/Virtum-Gen (also known as Virtumundo) from your computers.

Sophos Anti-Virus for Windows 2000+

Windows 2000, Windows XP, Windows 2003

What to do

IMPORTANT: Do not attempt to use SAV32CLI to remove Troj/Virtum-Gen (Virtumundo).

If a Sophos on-access, or on-demand, scan detects Troj/Virtum-Gen, the 'Clean Up' and 'Delete' options become unavailable. You must run a full system scan to remove it. You can run the scan either from Enterprise Console or locally on the infected computer.

1. Run a full system scan:
   • From Enterprise Console,
     1. In the console, right-click the infected computer.
     2. From the menu, select 'Full system scan'. 
   •  On the infected computer(s)
     1. Right-click the Sophos shield and select 'Open Sophos Anti-Virus'.
     2. Click 'Set up a new scan'.
     3. Select all drives.
     4. Click 'Configure this scan'.
     5. In the dialog box, ensure that 'Scan all files' is selected, click OK.
     6. Click 'Save and start'.
2. Once the scan completes, the 'Clean Up' option should be available. Select that option.
3. When prompted, reboot the computer(s).
4. Run a second scan to verify that Troj/Virtum-Gen has been removed.

If this procedure fails to remove Troj/Virtum-Gen, contact Sophos Technical Support.

If you need more information or guidance, then please contact technical support.

These instructions are also available in the knowledge base article: Troj/Virtum-Gen (Virtumundo) clean up procedure.

Troj/Virtum-Gen, also known as Virtumundo, is a family of malware which is used as a distribution network for other malicious software. Troj/Virtum-Gen is most commonly encountered as a dll file which is injected into web browsers. The Trojan then modifies search results, displays popups and downloads other malware.

Troj/Virtum-Gen is a large family, with new versions of the Trojan released frequently, somtimes more than once per day. It also uses server side polymorphism in an attempt to conceal new versions from anti-virus scanners.

Troj/Virtum-Gen is usually installed into the system folder as a dll with a randomly generated name, usually 8 characters long, such as qonfxmme.dll or pwygsrbl.dll

Several examples of the behavior of Troj/Virtum-Gen are described in the SophosLabs blog:
Virtumundo - a malware distribution service
A Virtual World of Mal-Intent
Send malware the easy way...