Vundo - Infection

Infection

A Vundo infection is typically caused either by opening an e-mail attachment carrying the trojan, or through a variety of browser exploits, including vulnerabilities in popular browser plug-ins, such as Java. Many of the popups advertise fraudulent programs such as AntiSpywareMaster, WinFixer, AntiVirus 2009.

There are two main components to Virtumonde.dll which are Browser Helper Objects and Class ID. Each of these components is in the Windows Registry under HKEY LOCAL MACHINE, and the file names are dynamic. It attaches to the system using bogus Browser Helper Objects and DLL files attached to winlogon.exe and explorer.exe and more recently lsass.exe.

Vundo inserts registry entries to suppress Windows warnings about the disabling of firewall, antivirus, and the Automatic Updates service, disables the Automatic Updates service and quickly re-disables it if manually re-enabled, and attacks Malwarebytes' Anti-Malware, Spybot Search & Destroy, Lavasoft Ad-Aware, HijackThis, and several other malware removal tools. It frequently hides itself from Vundofix & Combofix. Rather than pushing fake antivirus products, the new "ad" popups for the drive-by download attacks are copies of ads by major corporations, faked so that simply closing them allows the drive-by download exploit to insert the payload into the user's computer. (Fortunately, this is hindered, if not prevented altogether by Vista's User Account Control feature.) Its filenames are categorized by having the "hidden" flag set and being .dll files with 8-character randomly arranged names alternating consonants and vowels.