print version

VirtuMonde

Virtumonde aka Virtumondo and Vundo

VirtuMonde - Dangerous Adware And A Keylogger In One

VirtuMonde (a.k.a Virtumonde.C, Virtumondo, Vundo) is a widespread adware program. In addition to the usual adware properties (displaying pop-up ads), VirtuMonde shows also two other dangerous features: keylogging and cookie overwriting capabilities.

This adware is often installed manually by unwary users, however VirtuMonde is also reported to install stealthily as an unreported part of other programs.  These infected programs are usually freeware downloaded from certain low-security websites or as a part of P2P files' exchange.  It is very important that you be careful what applications you are downloading - as a general rule simply DO NOT download anything from a website that you don't know or trust!

Unlike most other adware, Virtumonde poses a significant threat to your system and personal security. In addition to displaying annoying pop-up ads, it is also able to log your typed-in keystrokes. These logged sequences are then transmitted to the hacker, potentially compromising your security by allowing third parties to read your logins, passwords and credit card numbers. VirtuMonde is also able to change existing cookies into those of Virtumonde affiliate websites, thus allowing them to earn money in place of original website owners.

How to remove VirtuMonde

The safest and fastest method of VirtuMonde removal is to use one of the automated spyware removal tools such as ParetoLogic Anti-Spyware. We recommend it also for another reason: such automated spyware scanners will detect and remove all malware programs existing on your PC in addition to getting rid of VirtuMonde.  These are sure to be lurking in your system alongside VirtuMonde, so it is best to search out and remove each of them.

If for any reason you can't remove VirtuMonde using a spyware remover, you may also try removing VirtuMonde manually (although this is not recommended). The step-by-step removal instruction is below.

Disclaimer: the manual removal procedure assumes that you are an experienced user. Use this method at your own risk! We strongly recommend using automated tools such as ParetoLogic XoftSpySE Anti-Spyware. Remember to create a registry backup before you start removing any adware/spyware programs manually. In case of making any mistakes, you may expect serious system malfunctions or frequent system crashes.

1. Kill the processes: nwonknu.exe, svci.exe, rasrun.exe, psdrv.exe, svci.exe, unknown.exe and windowsupd2.exe,

2. remove the following registry keys and entries:

HKEY_CLASSES_ROOTatlevents.atlevents
HKEY_CLASSES_ROOTclsid{13589181-4f0d-4553-b9f8-b4b72172c139}
HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionrunonce*winlogon
HKEY_CURRENT_USERsoftwaremicrosoftwindowsupd
HKEY_LOCAL_MACHINEsoftwaremicrosoftwindows ntcurrentversionwinlogonnotifycatw
HKEY_LOCAL_MACHINEsoftwaremicrosoftwindows ntcurrentversionwinlogonnotifypsdrv
HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionrunwindowsupd
HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionrunonce*catw
HKEY_LOCAL_MACHINEsoftwaretargetsoft,

3. delete the files: nursar.dat, nwonknu.exe, rasrun.exe, unknown.exe, vrdsp.bak1, vrdsp.bak2, vrdsp.dat, vrdsp.tmp, windowsupd2.exe.
svci.exe, psdrv.exe, vrdsp.ini, cidrules.dll, svci.exe. They are located in Windowssystem32, Documents and SettingsUserNamelocal settingstemp, Windowsinf and in Windowssystem32,

4. delete the following directories along with the files inside:

Documents and SettingsUserNamelocal settingstempbs5657.tmp,
Documents and SettingsUserNamelocal settingstempvupd,
Program Filesearn,
Windowstempbs5e310.tmp,

5. reboot the computer.

Remember to install and frequently use a reputable anti-spyware program such as ParetoLogic XoftSpySE in order to keep all malware security threats at bay.  Even the most discriminatory downloader finds him or herself in the presence of a computer virus, so know the risks and keep on top of them.

 to top