Trojan:Win32/Vundo.RW

Trojan:Win32/Vundo.RW is a member of Win32/Vundo - a multiple component family of programs that deliver 'out of context' pop-up advertisements. They may also download and execute arbitrary files. Vundo is often distributed as a DLL file and installed on an affected computer as a Browser Helper Object (BHO) without a user's consent. This family uses advanced defensive and stealth techniques to escape detection and to hinder removal.

Trojan:Win32/Vundo.RW copies itself to c:\documents and settings\administrator\my documents\commondata\winhlp31.exe.

 

The malware creates the following files on your PC:

 

The malware uses code injection to make it harder to detect and remove. It can inject code into running processes, including the following:

• explorer.exe

Trojan:Win32/Vundo.RW might contact a remote host at goog1gods.com using port 80. Commonly, malware does this to:

• Report a new infection to its author
• Receive configuration or other data
• Download and run files, including updates or other malware
• Receive instructions from a remote hacker
• Upload data taken from your PC

This malware description was produced and published using automated analysis of file SHA1 2644f2f9b59a0783837f01376acdec3bf425543f.