JS/Blacole.psak

Posted: October 6, 2011

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Threat Level:	8/10
Infected PCs:	21

First Seen:	October 6, 2011
OS(es) Affected:	Windows

JS/Blacole.psak is a drive-by-download exploit that attacks your web browser through JavaScript vulnerabilities. Like most other forms of drive-by-download attacks, JS/Blacole.psak can be adjusted to install many types of harmful programs, including keyloggers, Trojans and rogue security products. Recent JS/Blacole.psak attacks have come under the collective microscope of SpywareRemove.com malware analysts, due to the compromise of the laptopvirusrepair.co.uk website, which has been altered to redirect visitors to a site that uses the JS/Blacole.psak exploit. If you've accessed this website recently, you may also be infected by a JS/Blacole.psak-related PC threat, and you should scan your PC with an appropriate anti-malware program to be certain that your hard drive isn't infected.

JS/Blacole.psak – Shutting the Door That Invites Virtual Pests Inside Your PC

Variants of the JS/Blacole.psak exploit can be identified by a number of different names, including Exploit:JS/Blacole.A, JS/iFrame.ktv, JS/Redir.AQ, Trojan-Clicker.JS.Iframe.cz, Trojan-Clicker.JS.Iframe, Trojan.Webkit!html and Exploit:JS/Blacole.B, among others. JS/Blacole.psak is only capable of attacking Windows computers, although SpywareRemove.com malware experts have noted that JS/Blacole.psak is flexible enough to infect Windows from Windows 95 all the way up to Windows 7. Because JS/Blacole.psak is JavaScript-based, you can protect your PC by disabling JavaScript for websites that you distrust. Keeping JavaScript up-to-date will also reduce similar types of vulnerabilities although total elimination isn't feasible.

Unfortunately, even trustworthy and reputable sites like laptopvirusrepair.co.uk can be compromised by a JS/Blacole.psak attack. Laptopvirusrepair's compromise is embedded in the index code and will trigger automatically when you attempt to visit the site, although you may not see visible signs of a JS/Blacole.psak attack happening.

This particular version of JS/Blacole.psak redirects you to a subdomain of zdesestvareznezahodi.com, a website that has a confirmed history of trafficking with malicious software. Although JS/Blacole.psak can contain many types of payloads, the one that JS/Blacole.psak utilizes for laptopvirusrepair.co.uk is a dropper Trojan named Trojan-Downloader.JS.Agent.geo. Dropper Trojans are used to install other forms of harmful software and may also create serious security vulnerabilities, alter your system settings or even control your PC.

Don't Let One Visit to a JS/Blacole.psak-Compromised Site Take Over Your Computer

JS/Blacole.psak payloads and the payloads of associated Trojans can be very diverse, but SpywareRemove.com malware research team advises you to be on the lookout for dangers like the following if you've visited a JS/Blacole.psak-compromised site:

Phishing sites that steal information by pretending to be fake contests, fake surveys or fake account login portals.
Scamware sites that sell fake security programs, system cleaners or defraggers.
Sites that offer fake search-enhancement toolbars (which are typically used to force you to redirect away from trustworthy search engine sites).

Nonetheless, all of the above PC threats should be treated in the same way – by using an anti-malware program to make certain that you've found and removed all JS/Blacole.psak payloads and then by avoiding such websites in the future. As for Laptopvirusrepair.co.uk, its reputation will have to remain tarnished until its code has been confirmed to be cleansed of JS/Blacole.psak.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:

index.html

File name: index.html
Size: 8.37 KB (8377 bytes)
MD5: 10e9b284004b24eb7f953eb2b61be337
Detection count: 40
Mime Type: unknown/html
Group: Malware file
Last Updated: October 7, 2011