Home Malware Programs Trojans Trojan.Bubnix

Trojan.Bubnix

Posted: March 8, 2011

The Trojan classification Trojan.Bubnix is reserved for a sub-family of Trojan horses that use each other in conjunction along with other Trojans to create a complex series of malware drops. Trojan.Bubnix infections use semi-sophisticated means of stealth to avoid casual detection from anti-malware programs and may require recently-updated threat databases to delete. Trojan.Bubnix infections are associated with rootkits and other high-level threats, and should be removed in good haste by proven security applications to keep the system secure.

Picking Trojan.Bubnix Out of the Trojan Conga Line

The majority of PCs infected by Trojan.Bubnix are also struggling with other Trojans, since Bubnix is commonly dropped by Trojans itself. Different versions of Trojan.Bubnix may also drop other Bubnix versions, complicating removal of all the interlinked infections.

Trojan.Bubnix uses a few basic coding tricks to pretend to be a .rar file when scanned by an anti-malware program, and will even rewrite Trojan.Bubnix's code slightly over time, but should be recognized by reputable security applications that have had all their updates installed.

Even setting aside potential disruption by other infections, identifying Trojan.Bubnix via human eyes is a tough job; many versions of Trojan.Bubnix hide in the bloated Windows temporarily files folder with randomized filenames. Detecting Trojan.Bubnix quickly, however, is still a very necessary thing, since the infection informs a remote attacker of successful infiltration of your PC as soon as it happens.

Different applications may detect various types of Trojan.Bubnix by some of the following names, as well: Packed.Win32.Krap.xq, Bredolab.gen.l, Win32/Agent.QMR, TR/Agent.X.407, Trojan.Downloader.Bredolab.BU and TROJ_BUBNIX.B.

Trojan.Bubnix's Malicious Intentions for Your PC

Trojan.Bubnix's Trojans will themselves drop various Trojans and may ultimately install a rootkit-based Trojan on your machine. Rootkit malware are extremely difficult to detect and identify, and should be removed by dedicated anti-malware programs. Rootkits may persist even in Safe Mode and will not necessarily show up as an additional running process in Task Manager.

Given Trojan.Bubnix's function of communicating with remote entities on installation, Trojan.Bubnix may also be designed to allow remote attackers to access your machine for harmful purposes. This annihilates any trace of privacy or security in the computer in question, even if it appears to be running perfectly well with a Trojan.Bubnix aboard.

Other than Trojan.Bubnix's Trojan functions, Trojan.Bubnix's primary purpose appears to be to enable spamming through Gmail, Youtube and other popular websites. Infected PCs will be recruited into a botnet that eats up system resources with constant illegal activities. Deleting Trojan.Bubnix is, therefore, the right thing to do for the Internet at large, not to mention for your computer or yourself!

File System Modifications

  • The following files were created in the system:
    # File Name
    1 %SystemRoot%\System32\drivers\[RANDOM CHARACTERS].sys

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{RegistryKeys}HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\[RANDOM CHARACTERS]
Loading...