The Vundo Trojan (commonly known as Vundo, Virtumonde or Virtumondo, and sometimes referred to as MS Juan) is either a

Trojan horse The Trojan Horse was a wooden horse said to have been used by the Greeks during the Trojan War to enter the city of Troy and win the war. The Trojan Horse is not mentioned in Homer's ''Iliad'', with the poem ending before the war is concluded, ...

or a

computer worm A computer worm is a standalone malware computer program that replicates itself in order to spread to other computers. It often uses a computer network to spread itself, relying on security failures on the target computer to access it. It wil ...

that is known to cause popups and advertising for rogue antispyware programs, and sporadically other misbehavior including performance degradation and

denial of service In computing, a denial-of-service attack (DoS attack) is a cyber-attack in which the perpetrator seeks to make a machine or network resource unavailable to its intended users by temporarily or indefinitely disrupting services of a host conne ...

with some websites including

Google Google LLC () is an American Multinational corporation, multinational technology company focusing on Search Engine, search engine technology, online advertising, cloud computing, software, computer software, quantum computing, e-commerce, ar ...

and

Facebook Facebook is an online social media and social networking service owned by American company Meta Platforms. Founded in 2004 by Mark Zuckerberg with fellow Harvard College students and roommates Eduardo Saverin, Andrew McCollum, Dust ...

. It also is used to deliver other malware to its host computers. Later versions include

rootkit A rootkit is a collection of computer software, typically malicious, designed to enable access to a computer or an area of its software that is not otherwise allowed (for example, to an unauthorized user) and often masks its existence or the exis ...

s and

ransomware Ransomware is a type of malware from cryptovirology that threatens to publish the victim's personal data or permanently block access to it unless a ransom is paid off. While some simple ransomware may lock the system without damaging any files, ...

Infection

A Vundo infection is typically caused either by opening an e-mail attachment carrying the trojan, or through a variety of

browser exploit A browser exploit is a form of malicious code that takes advantage of a flaw or vulnerability in an operating system or piece of software with the intent to breach browser security to alter a user's browser settings without their knowledge. Malici ...

s, including vulnerabilities in popular browser plug-ins, such as

Java Java (; id, Jawa, ; jv, ꦗꦮ; su, ) is one of the Greater Sunda Islands in Indonesia. It is bordered by the Indian Ocean to the south and the Java Sea to the north. With a population of 151.6 million people, Java is the world's mo ...

. Many of the popups advertise fraudulent programs such as AntiSpywareMaster,

WinFixer WinFixer was a family of scareware rogue security programs developed by Winsoftware which claimed to repair computer system problems on Microsoft Windows computers if a user purchased the full version of the software. The software was mainly ins ...

, and AntiVirus 2009. Virtumonde.dll consists of two main components, Browser Helper Objects and Class ID. Each of these components is in the

Windows Registry The Windows Registry is a hierarchical database that stores low-level settings for the Microsoft Windows operating system and for applications that opt to use the registry. The kernel, device drivers, services, Security Accounts Manager, and ...

under

HKEY LOCAL MACHINE The Windows Registry is a hierarchical database that stores low-level settings for the Microsoft Windows operating system and for applications that opt to use the registry. The kernel, device drivers, services, Security Accounts Manager, and ...

, and the file names are dynamic. It attaches to the system using bogus Browser Helper Objects and DLL files attached to winlogon.exe, explorer.exe and more recently, lsass.exe. Vundo inserts registry entries to suppress Windows warnings about the disabling of firewall, antivirus, and the

Automatic Updates Automatic may refer to: Music Bands * Automatic (band), Australian rock band * Automatic (American band), American rock band * The Automatic, a Welsh alternative rock band Albums * ''Automatic'' (Jack Bruce album), a 1983 electronic rock ...

service, disables the Automatic Updates service and quickly re-disables it if manually re-enabled, and attacks

Malwarebytes' Anti-Malware Malwarebytes (formerly Malwarebytes Anti-Malware, abbreviated as MBAM) is an anti-malware software for Microsoft Windows, macOS, ChromeOS, Android, and iOS that finds and removes malware. Made by Malwarebytes Corporation, it was first relea ...

Spybot Search & Destroy Spybot may refer to: * Spybot – Search & Destroy Spybot – Search & Destroy (S&D) is a spyware and adware removal computer program compatible with Microsoft Windows. Dating back to the first Adwares in 2000, Spybot scans the computer hard ...

, Lavasoft Ad-Aware,

HijackThis HijackThis (also HiJackThis or HJT) is a free and open-source tool to detect malware and adware on Microsoft Windows. It was originally created by Merijn Bellekom, and later sold to Trend Micro. The program is notable for quickly scanning a user's ...

, and several other malware removal tools. It frequently hides itself from Vundofix and Combofix. Rather than pushing fake antivirus products, the new " ad" popups for the drive by download attacks are copies of ads by major corporations, faked so that simply closing them allows the drive-by download exploit to insert the payload into the user's computer.

Symptoms

Since there are many different varieties of Vundo trojans, symptoms of Vundo vary widely, ranging from the relatively benign to the severe. Almost all varieties of Vundo feature some sort of pop-up advertising as well as rooting themselves to make them difficult to delete. Computers infected exhibit some or all of the following symptoms: * Vundo will cause the infected web browser to pop up advertisements, many of which claim a need for software to fix system "deterioration". * The desktop background may be changed to the image of an installation window saying there is

adware Adware, often called advertising-supported software by its developers, is software that generates revenue for its developer by automatically generating online advertisements in the user interface of the software or on a screen presented to the ...

on the computer. * The screensaver may be changed to the Blue Screen of Death. * In the Display Properties Control Panel, the background and screensaver tabs are missing because their "Hide" values in the Registry were changed to 1. * Both the background and screensaver are in the System32 folder, however the screensaver cannot be deleted. * Windows Automatic Updates (and other web-based services) may also be disabled and it is not possible to turn them back on. * Infected DLLs or DAT files (with randomized names such as "__c00369AB.dat" and "slmnvnk.dll") will be present in the Windows/System32 folder and references to the DLLs will be found in the user's start up (viewable in MSConfig), registry, and as browser add-ons in

Internet Explorer Internet Explorer (formerly Microsoft Internet Explorer and Windows Internet Explorer, commonly abbreviated IE or MSIE) is a series of graphical web browsers developed by Microsoft which was used in the Windows line of operating systems (in ...

. * Vundo may attempt to prevent the user from removing it or otherwise impede its operation, such as by disabling the task manager, registry editor, and msconfig, thereby preventing the system from booting into safe mode. * Some firewalls or antivirus software may also be disabled by Vundo leaving the system even more vulnerable. Especially, it disables

Norton AntiVirus Norton AntiVirus is an anti-virus or anti-malware software product founded by Peter Norton, developed and distributed by Gen Digital since 1990 as part of its Norton family of computer security products. It uses signatures and heuristics to i ...

and in turn uses it to spread the infection. Norton will show prompts to enable phishing filter, all by itself. Upon pressing OK, it will try to connect to real-av.org and download more malware. * Popular anti-malware programs such as

Spybot – Search & Destroy Spybot – Search & Destroy (S&D) is a spyware and adware removal computer program compatible with Microsoft Windows. Dating back to the first Adwares in 2000, Spybot scans the computer hard disk and/or RAM for malicious software. Spybot-S& ...

Malwarebytes Malwarebytes Inc. is an American Internet security company that specializes in protecting home computers, smartphones, and companies from malware and other threats. It has offices in Santa Clara, California; Clearwater, Florida; Tallinn, Estonia ...

may be deleted or immediately closed upon loading. Renaming the program executable can work around this. Malwarebytes's executable may be deleted as soon as it is installed (depending on the system's infection). Installing the program on another computer and copying the executable into the infected computer's Malwarebytes directory usually works too. * Web access may also be negatively affected. Vundo may cause many websites to be inaccessible. * Search engine links may be redirected to

rogue security software Rogue security software is a form of malicious software and internet fraud that misleads users into believing there is a virus on their computer and aims to convince them to pay for a fake malware removal tool that actually installs malware on ...

sites, which can be avoided by copy and pasting addresses. * MS Juan may cause webpages to fail to load after sessions of browsing and present a blank page in the browser instead of the webpage. When this happens any programs may also fail to start and it may become impossible to use windows shutdown. * The hard drive may start to be constantly accessed by the winlogon.exe process, thus periodic freezes may be experienced. * Display pop-ups and also is additionally efficient in injecting promotions into search results. * Warnings about SuperMWindow not shutting down may occur.SuperMWindow - A New Vundo.
/ref> * Explorer.exe may constantly crash resulting in an endless loop of crashing then restarting. * Creates a virus critical driver in C:\Windows\system32\drivers (ati0dgxx.sys). * The virus can "eat" away at available hard drive space; hard drive space can fluctuate as much as +3 to -3 Gb of space, evident of Vundo's attempt at "hiding" when being antagonized. * Vundo can impede download progress. * Entering safe mode after attempting to use

results in a true Blue Screen of Death, which cannot be recovered from without either restoring the deleted safe mode registry keys, or a reinstalled version of Windows. * The virus sometimes gives a "Run a DLL as an APP" error when some of the randomly named DLLs have been deleted. * The virus will rewrite randomly named DLLs while any of them reside on machine. * The virus changes \HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run and RunOnce entries to start itself when Windows starts. * The virus installs adware that is sometimes pornographic. * The virus installs

such as Desktop Defender 2010 and Security Center with a .wav file telling the user that their system is infected. * The virus will cause the network driver to be corrupt which even after going into

Registry Editor The Windows Registry is a hierarchical database that stores low-level settings for the Microsoft Windows operating system and for applications that opt to use the registry. The kernel, device drivers, services, Security Accounts Manager, and ...

(regedit.exe) to delete Winsock 1 and 2 and trying to reinstall the driver is virtually impossible. * The virus deletes the network connection under My Network Places.

References

{{Reflist Computer worms Trojan horses Rootkits Rogue software 2004 in computing Hacking in the 2000s