Ok guys, here is the deal. I am at my friend's house and he has been having some major issues with internet exploer as well as Firefox. The thing is, whenever he is surfing the net, randomly a "Microsoft Small Office" program keepings trying to install, as well as some bizzare site that is called fubar something, the virus is what appears to be viturmonde or something. I have tried myself to get rid of it, but it seems hijack this and spybot D&D are not as efficent with me under it's wing.

I use to be somewhat computer savy with these things, but I have been away for 16 months and my knowledge has went down a ton since then, so I am asking for help on this matter. Now, some of the behavior patterns is that as soon as you open internet exploer it tries to open and install the Microsoft Office thing, then it follows up with a site that will not close until you minimize it and close the installation process.  It is becoming a problem that I wonder if anyone else has had this issue? Or any type of advice on this situation. I have ran this in safe mode and tried eleting it but  must be missing something.


Also, he has been having an issue with installing new updates, it will give him a message and saying that it was unable to install the programs and that he should find another method for doing so.  ​

If anyone can figure this out, it will be appreciated. I will continue to investigate this futher but have limited time since being confined in KY.

Congratulations! Virtumonde (also known as Vundo) is pretty much the most annoying malware that has ever been created! I have had to fight this thing several times at work (I am a tech support dude) and I'm not sure I've ever managed to totally obliterate it from a computer.

First things first: Spybot, Ad-Aware, and HijackThis alone aren't going to solve the problem for you. They WILL cut down the size of the infection, but if it's not removed completely, Vundo just keeps reinstalling other parts of itself. What makes it particularly annoying is that it almost always has a DLL component that's always in use, so it can't be deleted. I usually have to remove it using the Windows recovery console -- you know, the one that comes on the Windows installation disc. Even booting into the most bare-minimum safe mode doesn't allow you to remove that piece. Unfortunately I don't remember many more details about this thing.

If he's had this thing awhile, it might be worth it to just nuke the OS from orbit and start fresh.

tl;dr

All I read was vundo and no link to vundofix, so here you go: http://www.softpedia.com/get/Antivirus/VundoFix.shtml

Thank you so much guys. I have just got back to my own computer and will tell him to check tis out when he wakes up today. I figured it was reviving itself somehow after running hijack this and deleting it with it, but wasn't sure what was going on, this certainly was a huge help and I appreciate the input from you guys, I will look at the link once I am over at his house and try to see where to go from there. Again, thanks for the help!