Method of Infection
Vundo variants typically use random filenames, however reports indicate that many variants of this increasingly large family are originally downloaded as bkinst.exe.
Current Vundo variants reported from the wild copy themselves and drop an executable file in one or more of the following subdirectories of the %Windows% directory:
addins/
AppPatch/
assembly/
Config/
Cursors/
Driver Cache/
Drivers/
Fonts/
Help/
inf/
java/
Microsoft.NET/
msagent/
Registration/
repair/
security/
ServicePackFiles/
Speech/
system/
system32/
Tasks/
Web/
Windows Update Setup Files/
Microsoft/
The file names are randomly generated by joining some of the following strings and appending .exe to the end:
abr
ac
acc
ad
anti
ap
as
av
bak
bas
bin
c
cab
cat
cmd
com
cr
db
disk
dll
dns
doc
dos
drv
dvd
eula
exp
fax
font
ftp
hard
iis
img
inet
info
ip
java
kb
key
lib
log
main
mc
mfc
mp3
ms
msvc
net
nut
odbc
ole
pc
play
ps
ras
reg
run
s
srv
svc
svr
sys
tapi
task
tcp
un
url
util
vb
vga
vss
w
wave
web
win
wms
xml
E.g. %Windows%\Cursors\wavedvd.exe
Vundo variants modify the following registry entries to ensure that their created copies execute at each Windows start:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
The value name usually starts with a "*". For example:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce\*MS Setup
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce\*WinLogon
Vundo also drops a DLL in the %Temp% directory using the filename of the executable reversed with a .dat extension. For example, if the executable created is wavedvd.exe, Vundo would drop dvdevaw.dat in the %Temp% directory.
Note: %Temp% is a variable location and refers to the directory designated for temporary files. The malware determines the location of the current Temp folder by querying the operating system. A typical path is "C:\Documents and Settings\<username>\Local Settings\Temp", or "C:\WINDOWS\TEMP".
This DLL is registered as a service process and is used to protect the main executables. The DLL is injected randomly into any of the other running processes on the system. Although the main process is visible, if the process is terminated, it will be restarted from the system memory by the injected DLL process. Using the backup copy of the executable stored in memory, the process is able to re-create any files which are deleted.
The DLL also creates a BHO (Browser Helper Object) class in the registry that may appear similar to the following (for example):
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{68132581-10F2-416E-B188-4E648075325A}
The executable also create a configuration file in its current directory, using its own filename backwards, with the extension .ini. For example: if the executable was dropper.exe it would create a configuration file named reppord.ini.
Vundo creates backup copies of the configuration file (should it exist) using the same filename, but with extensions .bak1 and .bak2.
Back to top