Threat Descriptions

Trojan:W32/Vundo

Classification

Category :

Malware

Type :

Trojan

Platform :

W32

Aliases :

Trojan:W32/Vundo

Summary

Trojan:W32/Vundo is a large family of trojans closely associated with adware program that downloads and displays pop-up advertisements.

Removal

Based on the settings of your F-Secure security product, it will either move the file to the quarantine where it cannot spread or cause harm, or remove it.

A False Positive is when a file is incorrectly detected as harmful, usually because its code or behavior resembles known harmful programs. A False Positive will usually be fixed in a subsequent database update without any action needed on your part. If you wish, you may also:

  • Check for the latest database updates

    First check if your F-Secure security program is using the latest updates, then try scanning the file again.

  • Submit a sample

    After checking, if you still believe the file is incorrectly detected, you can submit a sample of it for re-analysis.

    Note: If the file was moved to quarantine, you need to collect the file from quarantine before you can submit it.

  • Exclude a file from further scanning

    If you are certain that the file is safe and want to continue using it, you can exclude it from further scanning by the F-Secure security product.

    Note: You need administrative rights to change the settings.

Technical Details

The adware is normally downloaded by users from the websites; these malicious sites are normally promoted by spam emails. The Vundo family is often distributed as DLL files. It is known to be bundled with adware and/or spyware programs.

For representative examples of Vundo variants and associated programs:

Installation

Malware in the Vundo family are installed without the user's consent as a Browser Helper Objects (BHOs). During installation, the DLL file is dropped in Windows system directory. The file name is randomly generated using 8 alphabetic characters:

  • C:\WINDOWS\system32\{8_random_alpha_char}.dll

Upon execution, the DLL is injected into 2 running processes:

  • Explorer.exe
  • Winlogon.exe

In some variants, several data files are created in the same location as the DLL file's execution. The data files' attributes are set as system file and hidden. The files use random names and the following extensions:

  • ini
  • ini2

Activity

Once installed, the trojan modifies Microsoft Internet Explorer's security setting to trust cookie content created by the trojan:

  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {unique_CLSID}]
  • [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] {unique_CLSID}="malware_hex_value"

Some variants may also attempt to download and execute arbitrary files from remote websites such as:

  • https://childhe.com/[..]/apstpldr.dll.html

The program runs hidden from the user.

Registry

During installation, malware in the Vundo family create a registry launch point with a unique Class ID. This launch point automatically starts the DLL when system is restarted.

To find this launch point, navigate to the following registry and look for the malicious file pointed by "InprocServer32" registry key:

  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{unique_CLSID}\InprocServer32] @="C:\WINDOWS\system32\{8_random_alpha_char}.dll"

The program will also make further modifications to load itself at startup:

  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] {unique_CLSID}

For some variants, the following registry keys are also created to load the program whenever the user logs on or off. The keys will use the same DLL file name as its key:

  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{DLL_file_name}] Asynchronous=dword:00000001 DllName="{DLL_file_name}" Impersonate=dword:00000000 Logon="o" Logoff="f"