Trojan:Win32/Vundo.gen!BB

Trojan:Win32/Vundo.gen!BB is a generic detection for a member of the Vundo family that delivers 'out of context' pop-up advertisements to the computer on which it is installed.

Trojan:Win32/Vundo.gen!BB is installed on an affected machine as a Browser Helper Object (BHO) without a user's consent. It arrives as a DLL file that is dropped in the Windows system folder with a random file name.
 
It modifies the system registry so that it automatically runs every time Windows starts:

 

Adds value: "<malware file name>"
With data "<malware file name>.dll"
To subkey: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
 
Adds value: "<malware file name>"
With data "<malware file name>.dll"
To subkey: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
 
Adds value: "<malware file name>"
With data "<malware file name>.dll"
To subkey: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify
 
It also injects itself in the following Windows processes:
Explorer.exe
Winlogon.exe

 

It also registers itself as a BHO with a randomly-generated CLSID.

 

It creates the following mutexes to ensure that only one instance of its routine is running at any given time:

 

Local\AfSysUpdIsRunningMutex
Local\AFUpdateServersEvent
Local\AfMainMutex
Local\AfSysUpdConnectTimer

Trojan:Win32/Vundo.gen!BB may display advertisements, and may redirect users to the following IP addresses:

 

It can display pop-ups with the following browsers: