Backdoor:W32/GetShell.A

Posted: July 10, 2012

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Threat Level:	6/10
Infected PCs:	32

First Seen:	July 10, 2012
OS(es) Affected:	Windows

Backdoor:W32/GetShell.A is the Windows-specific payload of Trojan-Downloader:Java/GetShell.A, a malicious Java applet that detects your OS and installs an 'appropriate' type of backdoor Trojan. Backdoor:W32/GetShell.A is responsible for the same dangers that are common to most backdoor Trojans, including opening up your PC to unwanted control by third parties, disabling or reducing your computer's security features and, potentially, downloading additional PC threats or stealing private information. Since Trojan-Downloader:Java/GetShell.A can't install Backdoor:W32/GetShell.A without your permission, SpywareRemove.com malware experts particularly recommend that you pay close attention to which applets you grant permission to run on your PC. Backdoor:W32/GetShell.A and related PC threats have been seen being propagated by benevolent websites that have been compromised in hacking attacks, although other means of distributing Backdoor:W32/GetShell.A may open up in the future.

Why Even a Safe Site Can Be Responsible for Backdoor:W32/GetShell.A Being on Your PC

Backdoor:W32/GetShell.A and the Java applet that installs Backdoor:W32/GetShell.A, Trojan-Downloader:Java/GetShell.A, were both first seen on a perfectly reputable website for a Colombian transport company. This site was hacked to add Trojan-Downloader:Java/GetShell.A to the rest of its content, and this vaguely-described Java applet (it self-identifies as merely 'Java,' by the ComuTV company) may appear to be a normal part of the website if you're not familiar with it already. Thankfully, this site was taken down by the relevant authorities once the breach was discovered, and in the aftermath, SpywareRemove.com malware researchers highlight the importance of web software security to protect your own sites from being forced to distribute Backdoor:W32/GetShell.A.

Visitors to the above site would have received a prompt to run the Trojan-Downloader:Java/GetShell.A applet, with acceptance resulting in the installation of either Backdoor:W32/GetShell.A, Backdoor:Linux/GetShell.A or Backdoor:OSX/GetShell.A. The exact type of backdoor Trojan that's installed will vary with your OS, with Windows users receiving an unwanted helping of Backdoor:W32/GetShell.A. SpywareRemove.com malware researchers recommend disabling Java or refusing this prompt as easy means of avoiding Backdoor:W32/GetShell.A infections, although actually removing Backdoor:W32/GetShell.A is best performed by appropriate security software.

The Finishing Touches on Backdoor:W32/GetShell.A's PC-Compromising Plan

Backdoor:W32/GetShell.A and other backdoor Trojans that are installed by Trojan-Downloader:Java/GetShell.A have functionally-identical behavior, in that they all attempt to contact the same IP address for further instructions. These types of unauthorized contact with third parties, known as a backdoor, can be responsible for a virtual rainbow of computer problems, although SpywareRemove.com malware analysts note the following attacks as being most likely for a Backdoor:W32/GetShell.A infection:

Attempted theft of personal information, such as data that's entered in account login fields.
The establishment of other forms of damaging software, potentially including browser hijackers, worms, spyware or rogue security applications.
Compromised security settings, such as disabled Windows UAC features, altered file-viewing attributes or reduced protection from files with invalid signature identification.
Blocked software such as Task Manager or popular anti-virus scanners.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:

file.exe

File name: file.exe
Size: 2.04 KB (2048 bytes)
MD5: 88d8c3d72e56e4f185738bb7cab84b69
Detection count: 76
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: July 11, 2012