print version

VirtuMonde

For Information and Removal of VirtuMonde

VirtuMonde - Dangerous Adware And A Keylogger In One

VirtuMonde (a.k.a Virtumonde.C, Virtumondo, Vundo) is a widespread adware program. In addition to the usual adware properties (displaying pop-up ads), VirtuMonde shows also two other dangerous features: keylogging and cookie overwriting capabilities.

This adware is often installed manually by unwary users, however VirtuMonde is also reported to install stealthily as an unreported part of other programs.  These infected programs are usually freeware downloaded from certain low-security websites or as a part of P2P files' exchange.  It is very important that you be careful what applications you are downloading - as a general rule simply DO NOT download anything from a website that you don't know or trust!

Unlike most other adware, Virtumonde poses a significant threat to your system and personal security. In addition to displaying annoying pop-up ads, it is also able to log your typed-in keystrokes. These logged sequences are then transmitted to the hacker, potentially compromising your security by allowing third parties to read your logins, passwords and credit card numbers. VirtuMonde is also able to change existing cookies into those of Virtumonde affiliate websites, thus allowing them to earn money in place of original website owners.

How to remove VirtuMonde

The safest and fastest method of VirtuMonde removal is to use one of the automated spyware removal tools such as ParetoLogic Anti-Spyware. We recommend it also for another reason: such automated spyware scanners will detect and remove all malware programs existing on your PC in addition to getting rid of VirtuMonde.  These are sure to be lurking in your system alongside VirtuMonde, so it is best to search out and remove each of them.

If for any reason you can't remove VirtuMonde using a spyware remover, you may also try removing VirtuMonde manually (although this is not recommended). The step-by-step removal instruction is below.

Disclaimer: the manual removal procedure assumes that you are an experienced user. Use this method at your own risk! We strongly recommend using automated tools such as PC Tools' Spyware Doctor and Malwarebytes Anti-Malware (Malwarebytes has free malware removal) . Remember to create a registry backup before you start removing any adware/spyware programs manually. In case of making any mistakes, you may expect serious system malfunctions or frequent system crashes.

1. Kill the processes: nwonknu.exe, svci.exe, rasrun.exe, psdrv.exe, svci.exe, unknown.exe and windowsupd2.exe,

2. remove the following registry keys and entries:

HKEY_CLASSES_ROOTatlevents.atlevents
HKEY_CLASSES_ROOTclsid{13589181-4f0d-4553-b9f8-b4b72172c139}
HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionrunonce*winlogon
HKEY_CURRENT_USERsoftwaremicrosoftwindowsupd
HKEY_LOCAL_MACHINEsoftwaremicrosoftwindows ntcurrentversionwinlogonnotifycatw
HKEY_LOCAL_MACHINEsoftwaremicrosoftwindows ntcurrentversionwinlogonnotifypsdrv
HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionrunwindowsupd
HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionrunonce*catw
HKEY_LOCAL_MACHINEsoftwaretargetsoft,

3. delete the files: nursar.dat, nwonknu.exe, rasrun.exe, unknown.exe, vrdsp.bak1, vrdsp.bak2, vrdsp.dat, vrdsp.tmp, windowsupd2.exe.
svci.exe, psdrv.exe, vrdsp.ini, cidrules.dll, svci.exe. They are located in Windowssystem32, Documents and SettingsUserNamelocal settingstemp, Windowsinf and in Windowssystem32,

4. delete the following directories along with the files inside:

Documents and SettingsUserNamelocal settingstempbs5657.tmp,
Documents and SettingsUserNamelocal settingstempvupd,
Program Filesearn,
Windowstempbs5e310.tmp,

5. reboot the computer.

Remember to install and frequently use a reputable anti-spyware program such as ParetoLogic XoftSpySE in order to keep all malware security threats at bay.  Even the most discriminatory downloader finds him or herself in the presence of a computer virus, so know the risks and keep on top of them.

Removing VirtuMonde Automatically/Safely

For free automatic removal we recommend using Malwarebytes Anti-Malware. This program is widely recommended by reputable third-party sites, so you can be reasonably confident of its ability to safely get rid of VirtuMonde and any hidden Trojans. As a precaution we recommend double checking your system with Spyware Doctor. This program requires paid registration to enable deletions, however it has a money back guaranteed and is the top of the line in malware removal. It should catch malware that evades Malwarebytes and block anything that tries to reinstal itself.

Remove VirtuMonde Now:

1. Download and install Malwarebytes Anti-Malware and Spyware Doctor  
2. Run a scan with Malwarebytes Anti-Malware.
3. Remove all the detected infections (free).
4. Run a scan with Spyware Doctor
5. Remove any remaining infections
6. Reboot and rescan with Spyware Doctor. Your computer should now be clean.

Important note: If Malwarebytes is blocked by malware then run Chameleon (Start Menu → All Programs → MalwareBytes' Anti-Malware → Tools → Malwarebytes' Anti-Malware Chameleon). If you need further help removing VirtuMonde please email us at info@removeadware.com.au or call for personal assistance on toll-free number 888-655-3453, within the USA and Canada.

 to top