Bandoo

Overview

Adware:Win32/Bandoo is a highly aggressive adware framework, Browser Hijacker, and Potentially Unwanted Program (PUA) that was notoriously prevalent in the early 2010s. Marketed deceptively as a tool to add 'emoticons' and 'winks' to email and chat clients (like Windows Live Messenger or Yahoo Messenger), it silently hijacked browser settings and flooded the user with intrusive advertisements.

What is Bandoo?
To the average user, Bandoo was highly visible and incredibly difficult to remove. While it did provide the promised emoticons, the true cost was the total subversion of their web browsing experience. The browser homepage was forcibly changed to Bandoo Search (or its affiliates), default search engines were locked, and standard websites were flooded with injected banner ads. For security analysts, Bandoo was a textbook example of aggressive Pay-Per-Install (PPI) adware. It leveraged deceptive installation tactics and deep system integration to ensure the user could not easily revert their settings.

Infection Vectors & Threat Hunting
Bandoo was distributed via its own website and bundled aggressively with freeware on download portals. When a user installed the emoticon pack, the Bandoo wrapper executed (`T1204.002`). It installed a massive, unwanted browser toolbar (`T1176`) and modified critical browser preference files (`T1112`). It established persistence via multiple Registry Run keys, BHOs (Browser Helper Objects), and often installed a watchdog Windows Service to instantly reinstall the toolbar if the user attempted to delete it (`T1543.003`).

Forensic Analysis & Impact
The primary impact was a severely degraded user experience, compromised browsing privacy (all searches were tracked), and a sluggish system due to the heavy toolbar overhead. Incident responders would observe anomalous HTTP/HTTPS traffic to Bandoo's ad networks. EDR logs would flag the constant modification of browser registry keys and the presence of Bandoo-related DLLs injected into `iexplore.exe` or `chrome.exe`.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_BANDOO {
    meta:
        description = "Detects Bandoo (advanced_threat)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "bandoo" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Bandoo Activity
id: e0dab848c33544b32a9d760ed70ce8b1
status: experimental
description: Detects generic indicators of the bandoo malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*bandoo*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Quarantine the endpoint to halt the active exfiltration of browsing telemetry and the display of malvertising.
2. Use the Windows Control Panel to thoroughly uninstall the 'Bandoo Media Inc.' software and any associated toolbars.
3. Deploy an enterprise adware removal tool (e.g., AdwCleaner) to locate and strip the deeply embedded registry hooks, BHOs, and watchdog services.
4. Force a complete reset of all installed web browsers to factory defaults to eradicate the rogue extensions and restore the homepage.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not rely solely on the browser's 'remove extension' button; Bandoo uses services and BHOs to immediately reinstall itself upon reboot.
2. Avoid ignoring the infection; adware tracking data is highly detailed and may expose corporate activities.

References & External Analysis

• Search "bandoo" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: advanced_threat)

Explore other malware families in the same category:

• Sogou
• Molebox
• Casinoonline
• Predator
• Ohmytabs

Machine-readable

Get this profile as JSON: https://jordan123234-malware-families-explorer.static.hf.space/api/bandoo.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.