Troj/JavaDl-NJ

Posted: July 11, 2012

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Threat Level:	1/10
Infected PCs:	1,054

First Seen:	July 11, 2012
Last Seen:	June 20, 2023
OS(es) Affected:	Windows

Troj/JavaDl-NJ is a Java-based applet that's used to install one of three types of backdoor Trojans, with the type of Trojan being based on your operating system. Troj/JavaDl-NJ, also known by the alias Trojan-Downloader:Java/GetShell.A, has only been seen in one site that has since been shut down. However, since this site was a benign website that was hacked to include Troj/JavaDl-NJ, rather than an intentional host for Troj/JavaDl-NJ attacks, SpywareRemove.com malware researchers rate the probability of Troj/JavaDl-NJ being inserted into other benevolent websites in the future to be fairly high. Although Troj/JavaDl-NJ's payload is a non-negligible threat to your PC, as long as you're careful enough to refuse the Java prompt for Troj/JavaDl-NJ when it appears, there shouldn't be much chance of Troj/JavaDl-NJ successfully attacking your computer.

Troj/JavaDl-NJ – the Ongoing Corruption of the Web's Safety

Troj/JavaDl-NJ is a Java-based PC threat that's hosted, either deliberately or unintentionally, on various websites. The first, last and only site so far to function for this service is a Columbia transportation company website that was shut down once the security compromise was discovered. Given this chain of events, SpywareRemove.com malware experts emphasize the importance of having updated website maintenance software and other security mechanisms to deal with potential hacker-based intrusions. Careful monitoring of your site's code should also reveal Troj/JavaDl-NJ quickly, and visitors should be able to notice Troj/JavaDl-NJ due to the appearance of an unusual Java prompt.

This prompt requests that you run a vaguely-named Java applet (in fact, its listed name actually is 'Java') by the ComuTV company. If you accept this prompt, Troj/JavaDl-NJ will attempt to detect your operating system as one out of the 'big three' brands: Linux, Mac or Windows. After detecting your OS, Troj/JavaDl-NJ will install one of three Trojans:

For Mac computers, OSX/Dloadr-DPG, alias Backdoor:OSX/GetShell.A.
For Windows computers, Mal/Krap-D, alias Backdoor:W32/GetShell.A.
For Linux computers, Linux/Dldr-GV, alias Backdoor:Linux/GetShell.A.

The Dangers That Await Once You Click That Innocent Prompt from Troj/JavaDl-NJ

Trojans that are installed by Troj/JavaDl-NJ, such as Mal/Krap-D, are still newly-identified and may include other capabilities besides those noted in the below section. However, SpywareRemove.com malware analysts have compiled a short list of prominent attacks that are likely to result from Troj/JavaDl-NJ-related infections that aren't removed by anti-malware software in sufficient haste:

Backdoor vulnerabilities that allow criminals to control your PC by way of remote server-based contact. This contact will attempt to evade your firewall and may not show symptoms of its attacks even while your PC is being compromised.
Loss of personal information from phishing attacks, banker Trojan attacks, keylogging attacks and other spyware-related functions. Passwords for accounts from games, website management and/or banks are common targets.
Finally, PC threats that are installed by Troj/JavaDl-NJ also have a high probability of installing other PC threats, either included in their bodies or as files that are downloaded from remote servers.

SpywareRemove.com malware research team recommends that you use anti-malware software to identify and remove any Troj/JavaDl-NJ-installed PC threats, since their quantities may vary due to the potential installation capabilities in the original payload.

Technical Details

Additional Information

The following URL's were detected:

https://crypsearch.com/search.php?q