Backdoor.LV

Posted: September 7, 2012

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Threat Level:	6/10
Infected PCs:	43

First Seen:	September 7, 2012
OS(es) Affected:	Windows

Backdoor.LV is a backdoor Trojan that includes some additional spyware features that could be used to compromise your PC's security and privacy. SpywareRemove.com malware research team has seen a rise in reported Backdoor.LV infections as of mid-2012, although the majority (but not all) of Backdoor.LV's attacks have been associated with Middle Eastern domains and IP addresses. Backdoor.LV gathers basic system-identifying information about your computer, monitors web-browsing behavior and also attempts to detect any attached webcams, although its other attacks are likely to include functions that steal sensitive data (such as passwords for bank accounts or other online accounts). If you need to delete Backdoor.LV, you should use anti-malware software to be certain that no interlinked PC threats escape removal, and take appropriate actions to secure any compromised personal information.

Backdoor.LV: a Browser Spy Unleashed in the Cradle of Civilization

Backdoor.LV, also known as MSIL/Spy.Agent.CP, appears to be distributed primarily throughout non-English-primary countries – which can, perhaps, explain why many PC security companies have failed to develop identity entries for Backdoor.LV as of yet. Servers associated with Backdoor.LV infections are especially prominent in Saudi Arabia, Morocco, Egypt and Algeria, although SpywareRemove.com malware analysts have found other countries, including a handful of European ones, have also been included. PC users in the above regions should take particular care to avoid malicious websites that may distribute Backdoor.LV in the form of mislabeled EXE files.

Backdoor.LV includes a range of standard backdoor Trojan and spyware-based functions, but Backdoor.LV's most remarkable trait is that Backdoor.LV fails to hide the launch of an obviously malicious component, Trojan.exe. After Backdoor.LV's installation, Backdoor.LV prompts the user to open this file, which (as of the time of this article's writing) is not concealed with a misleading name or file type. Given these unusually unsubtle circumstances, SpywareRemove.com malware researchers consider it circumstantial evidence that Backdoor.LV is targeting non-English speakers in its attacks.

Why Backdoor.LV's Surge Should Be Worrisome

Backdoor.LV includes a number of characteristics that make Backdoor.LV a high-level security threat, as SpywareRemove.com malware researchers have noted in the list below:

Backdoor.LV checks for webcam input. This is often related to spyware that records webcam input to steal information, although some variants of ransomware Trojans have also been known to exploit such devices (to use their input in fake 'you are being monitored' windows).
Backdoor.LV monitors your browser's open windows. SpywareRemove.com malware researchers have seen similar attacks often used by banking Trojans that alter your browser's web pages and steal form-based data (passwords, etc).
Like any backdoor Trojan, Backdoor.LV also contacts a C&C server to allow remote attackers to access the infected PC.
Finally, SpywareRemove.com malware experts have confirmed that Backdoor.LV gather's basic information about your operating system and BIOS that may be used in other security-compromising attacks.

If you have cause to think that Backdoor.LV may be infecting your PC, you should launch an anti-malware program immediately to delete Backdoor.LV and related PC threats.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:

file.exe

File name: file.exe
Size: 57.85 KB (57856 bytes)
MD5: 69ca161f31b795df2e62091703a6e0e9
Detection count: 75
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: September 10, 2012

Trojan.exe

File name: Trojan.exe
File type: Executable File
Mime Type: unknown/exe
Group: Malware file