VirtuMonde

VirtuMonde Description

Virtumonde (also known under a variety of aliases as Virtu Monde, Virtu-Monde, VirtuMonde Adware, Adware.VirtuMonde, VirtuMonde Spyware, VirtuMonde Virus) is a software application that monitors your browser and keeps track of your browsing habits. VirtuMonde uses this specific information to send targeted advertisements based upon your web-surfing activities directly to your computer. Usually installed as a component of another program, VirtuMonde infects the following systems: Windows 95, Windows 98, Windows 2000, Windows Me, Windows NT, Windows XP and Windows Server 2003. VirtuMonde begins running as soon as your computer starts up, and since it operates in the background, it may often go unnoticed. Assisting this play of stealth is VirtuMonde's capability of renaming itself during execution.

Aliases: Generic27.WQD [AVG], W32/Agent.SFM [Fortinet], TrojanDropper.Cidox.shx, TR/Offend.KD.543552 [AntiVir], Trojan.Win32.Generic.pak!cobra, Heur.Suspicious [Comodo], Trojan.Generic.KD.543552 [BitDefender], Trojan.Win32.Lampa.qst [Kaspersky], Win32:Cidox-AM [Trj] [Avast], TROJ_GEN.R49C7BR, W32/Troj_Generic.AFJEF, Win32/Agent.SFM [NOD32], Artemis!CCFA5FA2D6F2 [McAfee], Trojan/W32.Agent.86528.QA and Trj/Genetic.gen [Panda].

Technical Information

File System Details

VirtuMonde creates the following file(s):
# File Name Size MD5 Detection Count
1 %USERPROFILE%\?????????????? ????????\microsoft_dumpflop_.exe 86,528 ccfa5fa2d6f21f9f722cc198acc11f97 11
2 C:\GINO\Antivirus\ElistarA 19.65\EliStarA 1965.exe 629,771 e4a1080cef208be3122e08ca56365e02 8
3 C:\GINO\Antivirus\ElistarA 19.65\EliStarA 20 dic 2009.exe 639,499 084eeafec5e366eb4e7b7d9acf35e57e 8
4 C:\GINO\Antivirus\EliStarA 20.20.exe 679,947 66b5f0d0a9af1c9b39dbf14ffa378f16 8
5 %APPDATA%elro.exe 99,840 a1bb59cb15f3adf9353dddc18be1ac18 5
6 C:\EMB\ResPenAg09\Antivirus\Elistar\EliStarA.exe 645,131 6ddcb20704d7be4fa40e50a3e5625244 1
7 %TEMP%ljiijj.dll 90,112 71a371a6c8e9f3cca00da9f0cc41830f 1
8 ssqrp.dll 307,808 0f90394deda6937ac102fecb79745a7b 0
9 iifdcdb.dll 35,328 56f180294d5d47128936f9a34318a83b 0
10 hggfged.dll 34,304 60a1e02a5ec8707405bd07d0f244de83 0
11 drvkuk.dll 103,936 32bea5969a6e057042aa40a849478ded 0
12 pmnnm.dll 298,080 1a622cba5a89518cf4a511492db9d4f7 0
13 cbkllosv.dll 70,208 75f86a0ccd4845cfa74b3ea9183278b5 0
14 ivrrwfps.dll 70,208 2fb9509f1b9134ae56fd535d4c4634f8 0
15 sstrs.dll 266,336 0c053e21700e83a163b50c18108268e1 0
16 awtqqnl.dll 26,694 a235f52ad905ec89f9c9632f9a94dbe8 0
17 opnnljj.dll 33,302 29a0dbb047ea5167b5c0897902045718 0
18 nnnmmlk.dll 31,254 cbe9e81aa9d4ff26dde8c35839c55fd0 0
19 ssqrs.dll 266,336 2f73da71f31c691081a8b08ccad4e81c 0
20 cbxxywx.dll 29,206 274007e7c2fef02eafd67c49f5f6bb56 0
21 pmnno.dll 262,708 fe192ced601812e3f46825b3a094e729 0
22 ddcbabx.dll 26,678 19fb333000f260fd534c63945483994d 0
23 castlecops[1].exe 151,174 5b8577deb819495ffa0c1e03501eab77 0
24 vturspo.dll 26,694 f5236876d4cd7c1f430b8de50b250701 0
25 iifddby.dll, yaywttq.dll 26,694 2f287e9392c950158148779c9364e6a0 0
26 SbCIe02b.dll 208,896 908388713dc2e96068e2591ac67c54b7 0
More files

Registry Details

VirtuMonde creates the following registry entry or registry entries:
CLSID
{60EDCEE2-B6AF-4F2E-BB15-14F101364B47}
{837B45D6-BF85-457D-AABF-6D2E7815F791}
{AD72687B-CF83-4463-8E95-2CB3198CA5F6}
{D7336D32-62F7-43B5-8B8C-3963C72CA498}
{E180F496-8A4B-44E2-9FE0-0364E345DB7F}
{EEC73EA5-1367-49D1-93F4-CA1D8C22E9F9}

Related Posts

Site Disclaimer

Enigmasoftware.com is not associated, affiliated, sponsored or owned by the malware creators or distributors mentioned on this article. This article should NOT be mistaken or confused in being associated in any way with the promotion or endorsement of malware. Our intent is to provide information that will educate computer users on how to detect, and ultimately remove, malware from their computer with the help of SpyHunter and/or manual removal instructions provided on this article.

This article is provided "as is" and to be used for educational information purposes only. By following any instructions on this article, you agree to be bound by the disclaimer. We make no guarantees that this article will help you completely remove the malware threats on your computer. Spyware changes regularly; therefore, it is difficult to fully clean an infected machine through manual means.

Leave a Reply

Please DO NOT use this comment system for support or billing questions. For SpyHunter technical support requests, please contact our technical support team directly by opening a customer support ticket via your SpyHunter. For billing issues, please refer to our "Billing Questions or Problems?" page. For general inquiries (complaints, legal, press, marketing, copyright), visit our "Inquiries and Feedback" page.