We use cookies to ensure that we give you the best experience on our website. By continuing to browse, we are assuming that you have no objection in accepting cookies. You can change your cookie settings at any time.

BullGuard Ondersteuning

We zijn hier om u te helpen 24/7

E-mail ons ondersteuning team en we komen binnen 24 uur bij u terug



How to remove Adware.Virtumonde.WY






1. Go to Start > Run type regedit and press OK.

2. Go to Edit > Find type:

{85DED05D-2EC2-4E04-9406-AB25F577F706} and press OK.

3. You should encounter a key like this:


Go to InProcServer32\Default and copy the value. It should be something like this:


4. Open Notepad and write:

del C:\Windows\System32\nnnoopp.dll


(replace this with the name of the file that you have written down earlier)


Go to File > Save, and for File type select All files. Save it in the root of the C:\ drive with the name remove.bat.

5. Open regedit, navigate to the key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\


Double-click on System and write the value C:\remove.bat.

6. Now restart the computer.

When Windows starts, open Windows Explorer and see if the file was deleted.

If it was, open regedit, go to EditFind and run a search for the key:



Delete any entry that is found.

7. Delete the file:

C:\Documents and Settings\User\Local settings\Temp\removalfile.bat


Note: User stands for your Windows account username.


8. Run a full system scan with BullGuard.


1. Presence of the file removalfile.bat in the current user temporary folder:

C:\Documents and Settings\User\Local settings\Temp\

2. Increased network activity.

3. Unknown processes may appear in the Task Manager.


1. Drops a .dll file with a random name in the system folder (e.q: C:\Windows\System32\nnnoopp.dll).

2. It "injects" itself in explorer.exe and winlogon.exe.

3. Creates a .bat file with a hidden attribute set, in the current user's temp folder in order to delete itself:

C:\Documents and Settings\User\Local settings\Temp\removalfile.bat

4. Adds several registry keys that are pointing to the registry key below, in order to ensure that the malware will run at startup:



5. It tries to establish a connection to download and execute a file from and

The BullGuard Team