Troj/Virtum-Gen, also known as Virtumundo, is a family of malware which is used as a distribution network for other malicious software. Troj/Virtum-Gen is most commonly encountered as a dll file which is injected into web browsers. The Trojan then modifies search results, displays popups and downloads other malware.
Troj/Virtum-Gen is a large family, with new versions of the Trojan released frequently, somtimes more than once per day. It also uses server side polymorphism in an attempt to conceal new versions from anti-virus scanners.
Troj/Virtum-Gen is usually installed into the system folder as a dll with a randomly generated name, usually 8 characters long, such as qonfxmme.dll or pwygsrbl.dll
Several examples of the behavior of Troj/Virtum-Gen are described in the SophosLabs blog:
Virtumundo - a malware distribution serviceA Virtual World of Mal-IntentSend malware the easy way...