is webmoney spyware?

[Roger Knobbe]

I visited wmtransfer.com, didn't install anything (intentionally,
anyway) and now suddenly I have this "WebMoney" entry in my Tools menu
(Internet Explorer 6.0, Windows XP SP1). Looking in
"c:\Windows\Downloaded Program Files" shows that I have a "Toolbar
WMButton Download" object, status is "Unknown". I deleted the
wmbutton.* files from that directory, but now the object just shows up
as "Damaged". The entry is still in my IE tools menu.

The machine I'm running this has a "locked down" group policy, so in
theory this app shouldn't have been able to install itself into the
registry -- yeah, right. How do I uninstall this object?

rog.

[flan]

Roger Knobbe wrote:
> I visited wmtransfer.com, didn't install anything (intentionally,
> anyway) and now suddenly I have this "WebMoney" entry in my Tools menu
> (Internet Explorer 6.0, Windows XP SP1). Looking in
> "c:\Windows\Downloaded Program Files" shows that I have a "Toolbar
> WMButton Download" object, status is "Unknown". I deleted the
> wmbutton.* files from that directory, but now the object just shows up
> as "Damaged". The entry is still in my IE tools menu.
>
> The machine I'm running this has a "locked down" group policy, so in
> theory this app shouldn't have been able to install itself into the
> registry -- yeah, right. How do I uninstall this object?
>
> rog.

You might look at this page, WebMoney trojan.
http://www.europe.f-secure.com/v-descs/wmpatch.shtml