PUP.NetFilter

NetFilter is a Potentially Unwanted Program that may be used to subvert your PC's security, acting as part of a backdoor attack or as part of an adware program. Although not all NetFilter installations are necessarily threatening, you should uninstall NetFilter software that isn't on your computer with your full awareness and consent. Because of NetFilter's close association with attacks that could install other threats, malware experts recommend using all standard threat detection strategies while deleting NetFilter.

Unwanted Network Filtering

NetFilter, also referred to by the software brand of IPTables, is a baseline component of Linux used for various network trafficking solutions. Some variants of NetFilter software also may be found in other operating systems, such as Windows, in which case they may be bundled with other programs. Malware experts found the earliest signs of potentially hazardous NetFilter implementations in 2014, with their numbers rising to a peak and then entering a slow decline in 2015.

Threatening or non-consensual variants of NetFilter may be detected by your security software, and ordinarily are seen in the following variants:

• NetFilter may install itself along with adware, such as Swift Browse. These browser add-ons may inject new advertisements into unrelated Web pages or create new pop-up windows.
• Some NetFilter variants also have been connected to RAT campaigns, or threat attacks that try to gain remote control over a PC. Symptoms of a RAT or backdoor Trojan attack may include mouse movement without any input, changes to your network settings or unusual spikes in network traffic. The goal of such attacks typically is to collect information from the infected machine, such as the login data for your bank account.

However, not all threats known for using NetFilter include symptoms of notably high visibility.

Throwing Away a Faulty Filter

While Linux users may be unsurprised by NetFilter's presence, users of alternative systems rarely should see NetFilter without seeking NetFilter out intentionally. Malware experts would recommend heavy scrutinizing of any NetFilter component that is detected by your PC security software as 'riskware,' particularly if you didn't install the product intentionally. Because of NetFilter's basis as a network trafficking tool, any PC compromised by an unwanted version of NetFilter is a likely candidate for infection from real threats. However, security software able to identify and delete NetFilter also should be able to do the same with other software linked to NetFilter.

Unwanted add-ons like CashBack or Swift Browse may not be Trojans, but malware experts often see them in close connection with a broad range of security issues. However, whether you prefer Linux or non-Linux systems, monitoring your download channels for potentially unsafe software offers the simplest way of keeping unwanted programs off of your hard drive. In general, unless NetFilter is detected by your security tools and identified as a possible threat, Linux users may ignore NetFilter as a natural component of their OS.