Trojan:Win32/Vundo.SA removal tips

The Trojan:Win32/Vundo.SA is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan:Win32/Vundo.SA virus can do?

Executable code extraction
Creates RWX memory
Expresses interest in specific running processes
Reads data out of its own binary image
A process created a hidden window
Drops a binary and executes it
HTTP traffic contains suspicious features which may be indicative of malware related traffic
Performs some HTTP requests
Uses Windows utilities for basic functionality
Detects Sandboxie through the presence of a library
Detects SunBelt Sandbox through the presence of a library
Enumerates services, possibly for anti-virtualization
Detects the presence of Wine emulator via function name
Deletes its original binary from disk
Creates or sets a registry key to a long series of bytes, possibly to store a binary or malware config
Network activity contains more than one unique useragent.
Installs itself for autorun at Windows startup
Creates a hidden or system file
Checks the version of Bios, possibly for anti-virtualization
Attempts to modify proxy settings
The sample wrote data to the system hosts file.
Collects information to fingerprint the system
Anomalous binary characteristics

Related domains:

z.whorecord.xyz

levartnetcom.net

a.tomx.xyz

imagehut4.cn

How to determine Trojan:Win32/Vundo.SA?


File Info:
crc32: 68D418C0
md5: bc197dd5a6423484f2a6ecec87ab74bf
name: BC197DD5A6423484F2A6ECEC87AB74BF.mlw
sha1: 5a88499f2d23fa18ffbb0b9d195e06f4d4a707f7
sha256: 4f954379864c3b574209d9b3405434abb39a8cfcb8a0fd1e3956d109b9043074
sha512: 9250861557ee6cbed0b8e2cdae9f96f29f36f83eab83c502ae70ce1647e89879653adad70a6f2c917e1224d702824cda3c45c7bb6dcb44b0cf6677a0aabd3ddc
ssdeep: 6144:UT4txqqDLupWRTGPuNR2c0aBF+PveIH3dyqMtyFbZw4ETcca4R7Ia2520gXlPyWX:9MqnuMCWlLbQWG3it2dw4ETdoRlK9yWX
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: xa9 Qgudjjzdp Qaulieuhycq. All rights reserved.
InternalName: ASFErr.Dll
FileVersion: 9.00.00.3250 (xpsp_sp2_rtm.040803-2158)
CompanyName: Lzodwwhgw Ulfwephmuou
ProductName: Lmizaiiwhxae Oaydvfv Media Services
ProductVersion: 9.00.00.3250
FileDescription: ASF Error Definitions
OriginalFilename: ASFErr.Dll
Translation: 0x0409 0x04b0

Trojan:Win32/Vundo.SA also known as:

Bkav	W32.AIDetect.malware1
Elastic	malicious (high confidence)
DrWeb	Trojan.Swizzor.16963
FireEye	Generic.mg.bc197dd5a6423484
McAfee	GenericRXFV-AT!BC197DD5A642
Cylance	Unsafe
Zillya	Trojan.Pirminay.Win32.3610
AegisLab	Trojan.Win32.Pirminay.lzWF
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 0055e4031 )
BitDefender	Trojan.Ransom.Cerber.1
K7GW	Trojan ( 0055e4031 )
BitDefenderTheta	AI:Packer.9D6124C021
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	Win32/Ponmocup.AA
APEX	Malicious
Avast	Win32:Malware-gen
Cynet	Malicious (score: 100)
Kaspersky	HEUR:Trojan.Win32.Generic
Alibaba	Trojan:Win32/Starter.ali2000005
NANO-Antivirus	Trojan.Win32.Swizzor.fconql
MicroWorld-eScan	Trojan.Ransom.Cerber.1
Rising	Trojan.Ponmocup!8.136 (CLOUD)
Ad-Aware	Trojan.Ransom.Cerber.1
Emsisoft	Trojan.Ransom.Cerber.1 (B)
Comodo	Malware@#w9lj8nejxv87
F-Secure	Trojan.TR/Crypt.XPACK.Gen
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	HT_VUNDO_FE3102AD.UVPM
McAfee-GW-Edition	GenericRXFV-AT!BC197DD5A642
Sophos	Mal/Generic-S
SentinelOne	Static AI – Suspicious PE
Jiangmin	Trojan/Generic.ggbv
eGambit	Generic.Malware
Avira	TR/Crypt.XPACK.Gen
MAX	malware (ai score=98)
Antiy-AVL	Trojan/Win32.Unknown
Microsoft	Trojan:Win32/Vundo.SA
Arcabit	Trojan.Ransom.Cerber.1
SUPERAntiSpyware	Trojan.Agent/Gen-Falprod[Cont]
ZoneAlarm	HEUR:Trojan.Win32.Generic
GData	Trojan.Ransom.Cerber.1
AhnLab-V3	Malware/Win32.Generic.C1463648
Acronis	suspicious
VBA32	BScope.Trojan.Hosts
ALYac	Trojan.Ransom.Cerber.1
Malwarebytes	Generic.Malware/Suspicious
Panda	Trj/CI.A
TrendMicro-HouseCall	HT_VUNDO_FE3102AD.UVPM
Tencent	Malware.Win32.Gencirc.10bfbcd5
Yandex	Trojan.GenAsa!yXElwXLaH+U
Ikarus	Trojan.Win32.Pirminay
Fortinet	W32/Kryptik.ANL!tr
AVG	Win32:Malware-gen
Cybereason	malicious.5a6423
Paloalto	generic.ml
Qihoo-360	Win32/Ransom.Cerber.HgIASOUA

How to remove Trojan:Win32/Vundo.SA?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Trojan:Win32/Vundo.SA removal tips