Vundo infects victims' computers by exploiting a vulnerability in Sun Java 1.5.0.7 (aka Version 5.0 release 7) and earlier versions. An update to Java is a necessary step in the removal of Vundo. Many of the popups advertise fraudulent programs including (but not limited to) Sysprotect, Storage Protector, AntiSpywareMaster, WinFixer, and AntiVirus 2009. There are two main components to the Virtumonde.dll file: Browser Helper Objects and Class ID. Each of these components are in the Windows Registry under Local Machine, and the file names are dynamic. It attaches to the system using bogus Browser Helper Objects and DLL files attached to Winlogon and Explorer.exe. Some recent variants have begun attaching to lsass.exe instead of winlogon.exe. According to Spybot - Search & Destroy scans, the
| Attributes | Values |
|---|
| rdf:type
| |
| rdfs:label
| |
| rdfs:comment
| - Vundo infects victims' computers by exploiting a vulnerability in Sun Java 1.5.0.7 (aka Version 5.0 release 7) and earlier versions. An update to Java is a necessary step in the removal of Vundo. Many of the popups advertise fraudulent programs including (but not limited to) Sysprotect, Storage Protector, AntiSpywareMaster, WinFixer, and AntiVirus 2009. There are two main components to the Virtumonde.dll file: Browser Helper Objects and Class ID. Each of these components are in the Windows Registry under Local Machine, and the file names are dynamic. It attaches to the system using bogus Browser Helper Objects and DLL files attached to Winlogon and Explorer.exe. Some recent variants have begun attaching to lsass.exe instead of winlogon.exe. According to Spybot - Search & Destroy scans, the
|
| sameAs
| |
| dcterms:subject
| |
| dbkwik:malware/pro...iPageUsesTemplate
| |
| Platform
| |
| Name
| |
| Type
| |
| AKA
| - *Trojan:Win32/Vundo
- Trojan:Win32/Virtumonde
|
| abstract
| - Vundo infects victims' computers by exploiting a vulnerability in Sun Java 1.5.0.7 (aka Version 5.0 release 7) and earlier versions. An update to Java is a necessary step in the removal of Vundo. Many of the popups advertise fraudulent programs including (but not limited to) Sysprotect, Storage Protector, AntiSpywareMaster, WinFixer, and AntiVirus 2009. There are two main components to the Virtumonde.dll file: Browser Helper Objects and Class ID. Each of these components are in the Windows Registry under Local Machine, and the file names are dynamic. It attaches to the system using bogus Browser Helper Objects and DLL files attached to Winlogon and Explorer.exe. Some recent variants have begun attaching to lsass.exe instead of winlogon.exe. According to Spybot - Search & Destroy scans, there are two Virtumonde.prx files and one Virtumonde.dll file located in the Windows Registry as well as the system32 directory.
|
![[RDF Data]](/fct/images/sw-rdf-blue.png)