Remove VirtuMonde

VirtuMonde Removal Tools

Wed, 29 Aug 2007 05:11:45 +0000

VirtuMonde, or VirtuMondo virus can be removed by several anti spyware programs, but we strongly recommend using Spyware Doctor. It is a very powerful and very user friendly program. It is easy to use and does not require deep computer knowledge. It is created by PC Tools, which is one of the best anti virus on the market. Spyware Doctor provides effective and easy to manage protection. It checks Windows Registry, running process, web browser cookies, history, plug ins and etc. Scan reports are very informative and are can be easily understood. Real-time protection is also implemented. Well enough of talking. Spyware Doctor is one of the best anti - spyware programs and most important is that SPYWARE DOCTOR REALLY REMOVES VIRTUMONDE!

Manual VirtuMonde/VirtuMondo removal

Sat, 25 Aug 2007 13:17:05 +0000

Kill processes:

sysupd.exe, windowsupd1.exe

Delete registry values:

HKEY_CURRENT_USER\Software\Microsoft\SysUpd
HKEY_CURRENT_USER\Software\Microsoft\WindowsUpd
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\SysUpd
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpd
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysUpd
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsUpd

Delete files*:

sysupd.exe, windowsupd1.exe

*VirtuMundo files usually can be found in main system directory C:\Windows or C:\Winnt.

How to remove Virtumonde / FAQ

Sat, 25 Aug 2007 13:11:04 +0000

What is VirtuMonde?
VirtuMonde is an adware that downloads and popups advertisements without users permission.

VirtuMonde and VirtuMondo. Is it the same?
Yes it is the same adware.

What does it do?
VirtuMonde starts together with Windows and connects to the Internet. It hides from the user and pops up various advertisements. It regularly contacts predetermined web sites to receive advertisments. VirtuMundo works hand to hand with some parasites as well as advertising-supported programs.

Is VirtuMonde dangerous?
Yes. As every adware it not online slows down your computers work, but also pops up user with nasty advertisements. It is also tracking the websites your browse.

What systems does it effect?
VirtuMonde may effect: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP, Windows Vista

What is VirtuMondo risk impact?
Low, but still dangerous.

What are the VirtuMondo file names?
It has been detected as WindowsUpd1.exe or sysupd.exe, but as many adwares it may rename.

What values does it add?

“WindowsUpd” = “[ADWARE FILENAME]”
“SysUpd” = “[ADWARE FILENAME]”

to the registry subkeys:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

What registry keys does it create?

HKEY_CURRENT_USER\Software\Microsoft\WindowsUpd
HKEY_CURRENT_USER\Software\Microsoft\SysUpd
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CA21E6FA-41D9-4F05-9650-8B3FBE72124D}scan
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IEpl.IEpl
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IEpl.IEPl.1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CA21E6FA-41D9-4F05-9650-8B3FBE72124D}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\tdev
HKEY_USERS\S-1-5-21-1887652994-1477516851-2064603551-500\Software\Microsoft
\Windows\CurrentVersion\Ext\Stats\{CA21E6FA-41D9-4F05-9650-8B3FBE72124D}
HKEY_LOCAL_MACHINE\SOFTWARE\TargetSoft
HKEY_CLASSES_ROOT\CLSID\{FDA4DFFB-2C3D-4730-8D7E-28523C7F2F67}
HKEY_CLASSES_ROOT\DosSpecFolder.DosSpecFolder
HKEY_CLASSES_ROOT\DosSpecFolder.DosSpecFolder.1
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats
\{FDA4DFFB-2C3D-4730-8D7E-28523C7F2F67}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FDA4DFFB-2C3D-4730-8D7E-28523C7F2F67}

What files does it create?

# %System%\cidrules.dll
# %System%\wincore.dll
# %System%\winhost32.exe
# %System%\winupd.dll
# %UserProfile%\Local Settings\Temp\cidrules.dll
# %UserProfile%\Local Settings\Temp\wincore.dll

Note:

* %System% is a variable that refers to the System folder. By default this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP, Windows Vista).
* %UserProfile% is a variable that refers to the current user’s profile folder. By default, this is C:\Documents and Settings\[CURRENT USER] (Windows NT/2000/XP).

What connections VirtuMonde does?
HTTP connection to virtumonde.com from time to time, usually on port 80 or 8081.

Free AVG Antivirus Download

Sat, 25 Aug 2007 12:51:32 +0000

AVG Free Edition is the best working antivirus program. AVG Free is available free of charge to home users. Simply download and use it for as long as you wish. Virus database is updated frequently, you may choose automatic updates or update the database manually. With these update the highest level of safe pc is guaranteed. AVG Free is easy to use and navigate, it is very user friendly and does not require deep computer knowledge. Furthermore, AVG Antivirus will not slow your system down as most of the other antivirus programs (it is uses very little system resources). It features and automatic update functionality, the AVG Resident Shield, which provides real-time protection as files are opened, free Virus Database Updates are available, and AVG Virus Vault for safe handling of infected files.