Troj/Bredo-VV

Posted: April 23, 2012

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Threat Level:	9/10
Infected PCs:	7

First Seen:	April 23, 2012
Last Seen:	November 17, 2021
OS(es) Affected:	Windows

Troj/Bredo-VV is a Trojan that's distributed by spam e-mails under the fraudulent pretense that the file attachment containing Troj/Bredo-VV is supposedly some kind of private photo of the victim or a female acquaintance that was leaked online. Troj/Bredo-VV connects to remote servers without your consent and launches processes that imitate the names of Windows components to make Troj/Bredo-VV difficult for you to delete or even detect Troj/Bredo-VV without competent anti-malware software. Although SpywareRemove.com malware researchers haven't finished analyzing Troj/Bredo-VV, Trojans from Troj/Bredo-VV's family are noted for browser hijacks, disabling System Restore, installing many other PC threats or allowing criminals to steal personal information from your computer. Basic precautions against e-mail spam will help significantly to defend against potential Troj/Bredo-VV attacks, although it's also encouraged for you to keep anti-malware programs to detect and delete Troj/Bredo-VV whenever necessary.

Troj/Bredo-VV – Using Social Paranoia and Rumor-Mongering in Equal Measure Against Your PC

Troj/Bredo-VV is sent out by fraudulent e-mail messages that pretend that sensitive photographs relating to you or a woman you know have been leaked onto the Internet. The file attachments that are provided in this spam include Troj/Bredo-VV in .zip format (labeled with semi-random names like IMG0893.zip), and in some cases may also distribute a similar Trojan, Mal/BredoZp-B. Troj/Bredo-VV spam has been known to use a small rotation of templates that vary the theme slightly.

The subject lines can also vary similarly and may even pretend to be forwarded from another source. Deleting these e-mail messages on sight, with file attachments left unopened, is what SpywareRemove.com malware analysts strongly encourage for optimal protection of your computer from Troj/Bredo-VV. Anti-malware software may be able to detect Troj/Bredo-VV or Mal/BredoZp-B if you attempt to open the accompanying zip file, although Troj/Bredo-VV was only identified in late April of 2012 and may not be identifiable if your anti-malware programs aren't fully updated.

Why Troj/Bredo-VV's Behavior is Worse Than a Risque Photo Floating Around

After being installed, Troj/Bredo-VV conceals itself as wuauclt.exe, which makes it difficult to detect Troj/Bredo-VV as differentiated from the normal Windows file that uses the same name. SpywareRemove.com malware researchers also note with some worry that Troj/Bredo-VV has been confirmed to contact malicious websites that have been blacklisted for distributing PC threats and being involved in scams, such as losfakers.ru. Attacks like those by Troj/Bredo-VV are often used to install more specialized types of PC threats, and can ultimately result in:

Loss of personal information due to the installation of keyloggers or other forms of spyware.
Fake pop-up alerts and other fraudulent security information that's displayed by installed scamware.
Browser redirects, search engine hijacks and unauthorized homepage changes.
Loss of access to security features and programs. Trojans from Troj/Bredo-VV's family have even been found to attack System Restore.

Since Troj/Bredo-VV is ranked as a high-level danger to your PC, SpywareRemove.com malware experts suggest that you delete Troj/Bredo-VV and any other PC threats that Troj/Bredo-VV may have installed by undergoing a complete system scan with trustworthy anti-malware software. Attempts to delete Troj/Bredo-VV by manual methods have a high chance of damaging Windows or failing to remove all of Troj/Bredo-VV's components, particularly given the above issue of Troj/Bredo-VV's disingenuous choice of file names.

Aliases

Suspicious file [Panda]BackDoor.Andromeda.2 [DrWeb]Trojan.Win32.Jorik.Androm.ba [Kaspersky]W32/Trojan3.DLJ [F-Prot]

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:

file.exe

File name: file.exe
Size: 25.77 KB (25774 bytes)
MD5: 7c99b75c3c8ef446ab098a1a7071c2ab
Detection count: 64
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: May 4, 2012

mess.zip

File name: mess.zip
Size: 23.37 KB (23378 bytes)
MD5: d60bfa876dc382908fbcde1c96d5b95f
Detection count: 62
Mime Type: unknown/zip
Group: Malware file
Last Updated: May 4, 2012

msuqwt.exe

File name: msuqwt.exe
Size: 33.79 KB (33792 bytes)
MD5: 5b1e1534c828d398b0ae91820913911f
Detection count: 61
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: May 4, 2012