We use cookies to ensure that we give you the best experience on our website. By continuing to browse, we are assuming that you have no objection in accepting cookies. You can change your cookie settings at any time.

Close

Le Support de BullGuard

Nous sommes ici 24/7 pour vous aider


Envoyez un e-mail à notre équipe d'assistance et nous reviendrons vers vous dans les 24 heures qui suivent.


 

 

How to remove Adware.Virtumonde.WY



THREAT NAME

Adware.Virtumonde.WY

 

 

CLEAN INSTRUCTIONS

1. Go to Start > Run type regedit and press OK.


2. Go to Edit > Find type:


{85DED05D-2EC2-4E04-9406-AB25F577F706} and press OK.


3. You should encounter a key like this:


HKEY_CLASSES_ROOT\CLSID\{85DED05D-2EC2-4E04-9406-AB25F577F706}


Go to InProcServer32\Default and copy the value. It should be something like this:

C:\Windows\System32\nnnooopp.dll


4. Open Notepad and write:


del C:\Windows\System32\nnnoopp.dll

 

(replace this with the name of the file that you have written down earlier)

 

Go to File > Save, and for File type select All files. Save it in the root of the C:\ drive with the name remove.bat.


5. Open regedit, navigate to the key:


HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\

 

Double-click on System and write the value C:\remove.bat.


6. Now restart the computer.


When Windows starts, open Windows Explorer and see if the file was deleted.


If it was, open regedit, go to EditFind and run a search for the key:


{85DED05D-2EC2-4E04-9406-AB25F577F706}

 

Delete any entry that is found.


7. Delete the file:


C:\Documents and Settings\User\Local settings\Temp\removalfile.bat

 

Note: User stands for your Windows account username.

 

8. Run a full system scan with BullGuard.



SYMPTOMS

1. Presence of the file removalfile.bat in the current user temporary folder:


C:\Documents and Settings\User\Local settings\Temp\


2. Increased network activity.


3. Unknown processes may appear in the Task Manager.



DESCRIPTION

1. Drops a .dll file with a random name in the system folder (e.q: C:\Windows\System32\nnnoopp.dll).


2. It "injects" itself in explorer.exe and winlogon.exe.


3. Creates a .bat file with a hidden attribute set, in the current user's temp folder in order to delete itself:


C:\Documents and Settings\User\Local settings\Temp\removalfile.bat


4. Adds several registry keys that are pointing to the registry key below, in order to ensure that the malware will run at startup:

 

HKEY_CLASSES_ROOT\CLSID\{85DED05D-2EC2-4E04-9406-AB25F577F706}


5. It tries to establish a connection to download and execute a file from 82.98.235.70 and 65.243.103.80.

Author:
The BullGuard Team



00: 00: 00: 00
Jours Heures Minutes Secondes
Close