Trojan:Win32/Vundo.gen!BC

Trojan:Win32/Vundo.gen!BC is a generic detection for a member of the Vundo family that delivers 'out of context' pop-up advertisements to the computer on which it is installed.

Trojan:Win32/Vundo.gen!BC is installed on an affected machine as a Browser Helper Object (BHO) without a user's consent. It arrives as a DLL file that is dropped in the Windows system folder with a random file name.
 
It modifies the system registry so that it automatically runs every time Windows starts:
 
Adds value: "<malware file name>"
With data "<malware file name>.dll"
To subkey: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
 
Adds value: "<malware file name>"
With data "<malware file name>.dll"
To subkey: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
 
Adds value: "<malware file name>"
With data "<malware file name>.dll"
To subkey: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify
 
It also injects itself in the following Windows processes:
Explorer.exe
Winlogon.exe
 
It also registers itself as a BHO with a randomly-generated CLSID.

Displays Pop-up Advertisements
Trojan:Win32/Vundo.gen!BC may display advertisements, and may redirect users to the following IP addresses:

It can display pop-ups with the following browsers: