Sophos

Troj/Virtumod-K

Aliases
  • Trojan.Win32.Crypt.o
  • Trojan.Agent-68
  • Adware-Virtumundo
Category
Type
What to do
Prevalence low high

Summary

 
Affected operating systems Windows
Characteristics
  • Installs itself in the registry
Protection available since 12 November 2005 16:55:49 (GMT)
Detected by All Sophos products
  • Free virus, spyware, and adware scan
  • Test your existing anti-virus protection
  • Find threats your anti-virus missed

Action

More Information

Troj/Virtumod-K is a Trojan which will download, install and run new software without notification that it is doing so.

Troj/Virtumod-K attempts to download configuration files from a remote website and to display pop-ups periodically. It may also upload statistics related to users' web browsing habits to the server.

The Troj/Virtumod-K DLL is registered as a COM object and Browser Helper Object (BHO) for Microsoft Internet Explorer, creating registry entries under:

HKCR\CLSID\(827DC836-DD9F-4A68-A602-5812EB50A834)
HKCR\MSEvents.MSEvents\
HKCR\MSEvents.MSEvents.1\
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\(827DC836-DD9F-4A68-A602-5812EB50A834)

RSS|Atom
Get reports about the latest virus and spyware threats delivered to your computer