This Trojan may be dropped by variants of the following malware families:
- TROJ_VUNDO
- TROJ_VIRTUMUNDO
It may arrive bundled with malware packages as a malware component. It may arrive as a .DLL file that exports functions used by other malware.
It is usually dropped in the Windows system folder with a random file name. It is then injected into running processes, such as
WINLOGON.EXE and
EXPLORER.EXE as part of its installation routine.
It is also usually installed as a BHO (Browser Helper Object) to ensure its automatic execution whenever an instance of Internet Explorer is run. It requires other components in order to run properly.
More...
