Backdoor.ADDNEW

Posted: November 6, 2012

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Threat Level:	2/10
Infected PCs:	4,127

First Seen:	November 6, 2012
Last Seen:	June 27, 2023
OS(es) Affected:	Windows

Backdoor.ADDNEW is an updated variant of DaRK DDoSer, a backdoor Trojan that's used primarily to crash websites with artificially-generated traffic. Besides including stereotypical DDoS capabilities, Backdoor.ADDNEW also has spyware-related features that let Backdoor.ADDNEW steal personal information, such as passwords, from the infected PC. SpywareRemove.com malware researchers have discovered that current Backdoor.ADDNEW attacks are heavily intertwined with the presence of Gh0st RATs, which tend to target enemies of the Chinese government (such as Tibet). Given Backdoor.ADDNEW's likelihood of being used for industrial sabotage and theft of confidential information, you should guard against Backdoor.ADDNEW and remove Backdoor.ADDNEW infections with strong anti-malware products that are capable of defeating sophisticated PC threats.

All the Hot Water that Simple Sociability Can Land You In with Backdoor.ADDNEW

The most current attacks by Backdoor.ADDNEW and related PC threats have used social networking techniques (instant messaging spam, e-mail spam, social network sites, etc) to encourage victims to install rootkits unintentionally on their computers. Along with Backdoor.ADDNEW, most attacks also resulted in the installation of Gh0st, a Remote Administration Tool that allows criminals to gain nearly total control over the compromised PC. Victims of these attacks largely have been political enemies and rivals of the Chinese government, including the Dalai Lama, diplomatic embassies and various foreign governments.

Like many backdoor Trojans, Backdoor.ADDNEW names some of its components to mimic normal file components and uses code injection to hide its presence in your PC's memory processes. Not all of Backdoor.ADDNEW's functions have been analyzed, but SpywareRemove.com malware researchers have been able to note some of Backdoor.ADDNEW's major attacks:

Like its predecessor, DaRK DDoSer, Backdoor.ADDNEW includes traffic-flooding attacks that can exploit an infected PC's resources for the purpose of crashing websites. While the primary damage in a DDoS attack is to the website in question, a Backdoor.ADDNEW-infected computer may have reduced performance as a result of the high memory usage that DDoS attacks can require.
Backdoor.ADDNEW also includes several spyware attacks that are used to steal confidential information. Of especial note is Backdoor.ADDNEW's ability to grab passwords from the Firefox browser, although other web browsers and even general text input also may be at risk.

Banishing Backdoor.ADDNEW and Its Ghostly Friend from Your PC

While Backdoor.ADDNEW should be considered a serious security and privacy breach to be resolved with haste, SpywareRemove.com malware experts note several reasons why anti-malware software should be recruited to delete Backdoor.ADDNEW safely. Backdoor.ADDNEW's tendency to be installed with advanced malware like the Gh0st RAT means that your PC usually will suffer from multiple infections. The usage of svchost.exe and other file names to conceal Backdoor.ADDNEW components can cause casual PC users to delete Windows files by mistake. Finally, rootkit techniques make removing Backdoor.ADDNEW without appropriate software potentially dangerous to your operating system.

Based on patterns of previous attacks, SpywareRemove.com malware experts note that governments, diplomatic agencies and infrastructural/security-related businesses are likely to be targeted by unique Backdoor.ADDNEW attacks in the future. However, Backdoor.ADDNEW is just as capable of damaging the PCs of casual PC users and always should be deleted as soon as Backdoor.ADDNEW is found.

Technical Details

Additional Information

The following URL's were detected:

fattykettleinexpedient.co