BKDR_RILER.SV

Posted: May 15, 2012

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Ranking:	14,636
Threat Level:	2/10
Infected PCs:	391

First Seen:	May 15, 2012
Last Seen:	August 5, 2023
OS(es) Affected:	Windows

BKDR_RILER.SV is a backdoor Trojan that compromises your computer's security from the relative safety of its hiding spot – within a normal program file like explorer.exe, opera.exe, outlook.exe, yahoomessenger.exe or msimn.exe and similar types of Internet-based applications. Because BKDR_RILER.SV can be used to control your PC from a remote server and may launch attacks that include installing other PC threats or stealing private information, any potential BKDR_RILER.SV infection is an extreme danger for your computer and everything that's stored on it. As if that weren't enough to deal with, the latest BKDR_RILER.SV attacks have been found to use virus-infected versions of BKDR_RILER.SV that also include a variant of the Sality virus; these attacks are propagated by e-mail messages that target pro-Tibet activists with advice on how to utilize Apple products. Given such evidence, SpywareRemove.com malware researchers remind all PC users to be cautious about opening file attachments from strange e-mail messages and encourage you to scan any such files with anti-malware products before you open them – since they may very well be hiding a BKDR_RILER.SV attack.

Analyzing BKDR_RILER.SV's Entrance to Avoid the Need for Forcing Its Egress

As of April 2012, the latest series of BKDR_RILER.SV attacks have used spam e-mail as a preferred means of distributing BKDR_RILER.SV and other PC threats, including the virus PE_SALITY.AC. These e-mail scams pretend to offer an 'Input Method' that would be useful for pro-Tibetan users of Apple-brand mobile phones, but any contact with the included file attachment (that appears to be a harmless text document) will trigger a Microsoft Word and Open XML File Format Converter exploit by the Trojan TROJ_ARTIEF.EDX. This exploit installs BKDR_RILER.SV, which is infected with the aforementioned Sality variant. Both of these two PC threats can also include functions for installing other PC threats and malicious components from their respective families.

If your PC doesn't have the above software, the attack will not trigger even if you do open the file in question. However, since SpywareRemove.com malware analysts have found that similar attacks can utilize a wide range of different exploits to install BKDR_RILER.SV and similar PC threats, you should always scan a file attachment before you open it, particularly if it originates from an unusual source. TROJ_ARTIEF.EDX also places a normal Word document on your hard drive, which may lead you to believe that there hasn't been any attack at all – even while BKDR_RILER.SV and PE_SALITY.AC proceed to violate your computer's security in countless ways.

A Few Good Reasons to Get Riled Up Over BKDR_RILER.SV

BKDR_RILER.SV is designed to take part in standardized backdoor Trojan-style attacks against any PC that BKDR_RILER.SV infects. These functions include broadly-applicable attacks that can be used to control and harm your computer, such as:

Making contact with a Command & Control server and sending PC identity-related information to criminals, as well as receiving instructions, transmitting private information or downloading other malicious files.
Concealing its files in your OS system folder, and further concealing their operations by loading its code into the process of a normal Windows program, as noted earlier in this article.
Loading a hidden instance of Cmd.exe or Command.com to grant command shell access to its criminal partners by way of the C&C server. This can allow a remote server to control various actions on your PC, including viewing, deleting or rearranging various files.

Obviously, the severity of these attacks causes SpywareRemove.com malware analysts to suggest BKDR_RILER.SV's immediate termination via your favorite brand of anti-malware scanner. The sophistication of BKDR_RILER.SV's concealment techniques, as well as the high probability of multiple PC threats being involved, means that a complete scan of your total hard drive should be used to ensure total disinfection of both BKDR_RILER.SV and related PC threats.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:

%System%\utntweep.dll

File name: %System%\utntweep.dll
File type: Dynamic link library
Mime Type: unknown/dll
Group: Malware file

%System%\goopnet.ini

File name: %System%\goopnet.ini
Mime Type: unknown/ini
Group: Malware file

Registry Modifications

The following newly produced Registry Values are:

HKEY..\..\{Value}HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\0000000000{2 digit numbers} PackedCatalogItem = "%System%\utntweep.dll"

Additional Information

The following URL's were detected:

techsys.site