Upon first read it's easy to get excited and imagine this card says:

,: The Runner loses 5 or an Imp Counter

But in reality it's not so simple to make this card work. The runner must have 5 or a virus counter on Imp when they access Mumbad Virtual Tour. If the runner is too poor or doesn't have a loaded Imp then this is effectively a blank card. What's more, it is quite unlikely the corp will be able to land its effect once the runner knows what it is.

Now it's clear that Cyberdex Virus Suite is superior if the goal is to eliminate virus counters, so that only leaves draining credits from the runner. That's not easy to land either well. Since Virtual Tour only activates when it is installed there's the question of where to put it.

• HQ: Doesn't stop Account Siphon, likely to be the last card accessed as well.
• R&D: Doesn't stop multi-access and is likely to the last card accessed as well. Does not even activate in the case of Indexing or Keyhole.
• Archives: Again it's likely to be the last card accessed, but unless there's a NAPD Contract, Fetal AI or The Future Perfect then the runner won't be spending any credits during their access phase. However there are a number of reasons why this won't get triggered off a successful Archives run too (Sneakdoor Beta, Retrieval Run, Hades Shard, Security Testing or Patron being the most common ones).
• Naked Remote: The likelihood of getting checked is quite high, unless the corp is playing a ambush shell game. It will only be effective if the runner has 5 at the time of access, or likely the runner will budget so they never fall victim to its effect.
• Protected Remote: It's likely that the runner has spent a few s just to get into the server. If it doesn't fire the first time the runner will try to have 4 or less left over the next time they access.

How to make Mumbad Virtual Tour work:

• Hostile Infrastructure is a nice combo to magnify the hurt
• Self-destruct along with a Melange Mining Corp. - if the runner has 6 let them in. If the runner has less than 6 then the corp can win the trace for 3 net damage. This combo actually works better AFTER the runner knows there is a Virtual Tour in the remote.
• An Offer You Can't Refuse
• Susanoo-no-Mikoto (Virtual Tour in uniced Archives only)
• NAPD Contract it doesn't work if the runner has exactly 4 but it does make things more challenging - keep in mind that Jeeves Model Bioroids or Efficiency Committee+Shipment from SanSan both enable NAPD as a never-advance play. Also Tennin and PAD Factory allow the corp to 'advance' any card.
• Spark Agency benefits from a nice way to bring the runner's credit pool back down to earth if they ever get out of control
• Fake Crisium Grid in a horizontal deck - often the runner tries to get rid of those first if they are playing Keyhole or Siphon. That will guarantee the runner has 5 on hand when they access.

Note: It can be used in Gagarin too - just put it on a central server.

Overall Rating: Not enough raw power to justify the deckslots without a good strategy.

The timing depends entirely on the runner and there are ways to play around it by accessing last and/or having 4 or less on hand. CVS is better against Imp and additional econ cards are better in general. The best possible result might be draining multiple Ghost Runners but that's unlikely to happen often.

One use of this card I haven't seen in other reviews or decks yet is combing it with Enhanced Login Protocol, Oaktown Grid or Industrial Genomics: Growing Solutions and Product Recall. The Virtual Tour turns Recall into a super Restructure but without needing an up-front investment of ten credits. This allows you to quickly bounce back from getting Account Siphoned, although it is a two card combo. This is especially useful after the runner has encountered the Tour, can't pay to trash it, and is now able to avoid ever paying its trash cost again. Other 0 rez 5 trash cards include Disposable HQ, Cybernetics Court, Marked Accounts. Sealed Vault is your best target for the Recall of course. Mumbad City Hall will fetch both your Tours and your Recalls to help enable the combo.

This card is very good, which is pretty obvious. When it is installed and then accessed in a server, this either eats 5 credits or an Imp token, and has no rez cost (although that is kind of irrelevant). 5 credits is a huge swing, and can easily open up scoring windows. Unlike lots of upgrades and assets, this is also fine in your hand, or in your deck. If they pay to trash it there, it's done its job, and if not, you will eventually be able to install it.

Its influence-condition, like Mumba Temple's, is easy to satisfy. Many decks do not have to make any changes at all in order to accommodate it.

This card is also pants-on-head stupid in Industrial Genomics. If the runner has sufficient credits, and you have any unrevealed cards in your heap, they are going to pay a fortune to trash it AND it is tutorable with MCH. It also should find a home in Spark Agency, because it fits the gameplan and Spark naturally has the assets to make it influence free. In fact, I expect to see this basically everywhere, and it is going to suck to run into it as a runner. I suggest either being Whizzard, or jamming 3 Imps/Scrubbers in every deck you play.

It's worth noting that running when you don't have enough credits to trash it is the right play a lot of the time, so it is possible to play around it that way.