Rodpicom

Posted: February 12, 2013

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Threat Level:	9/10
Infected PCs:	49

First Seen:	February 12, 2013
OS(es) Affected:	Windows

Rodpicom is a variant of the Dorkbot worm that's currently being distributed through instant messenger-based spam links. In addition to using infected PCs to help with its own distribution, Rodpicom also creates backdoor vulnerabilities and launches other attacks, such as downloading other malware. Because SpywareRemove.com malware experts have verified that Rodpicom uses several methods to conceal itself and avoid being deleted, it's recommended that you use any suitable anti-malware applications to remove Rodpicom. Until Rodpicom is removed, a Rodpicom-compromised PC (like any PC that plays host to a backdoor Trojan) should be considered tantamount to under the control of malicious third parties.

Rodpicom: a New Dork with Its Mind on Taking Down Your PC's Security

Rodpicom is one of many possible variants of the Dorkbot worm and may be detected by other aliases, including Trojan.Win32.Yakes, W32.Phopifas, Trojan.Spamlink and Gen:Variant.Barys. Initial attacks from Rodpicom are recognizable for using the Skype and WLM (Windows Live Messenger) platforms, which are forced to send spam texts containing links to Rodpicom. SpywareRemove.com malware experts also note that these links may have their web addresses obscured – with the Google URL Shortener or other means – to make them appear to be harmless. However, victims who click these links, sent by messenger accounts and PCs that, themselves, already have been infected, will spread Rodpicom to their own computes.

Rodpicom also has multilingual capabilities and adjusts its message spam to conform to the language of whatever infected PC is being used to send out these messages. Accordingly, a UK or US PC that's infected with Rodpicom will be forced to send out spam in English, a France-based PC in French, and so on. Targets for Rodpicom's messages are gathered from the contacts lists of the compromised computers.

The primary danger in a Rodpicom infection is its ability to open a backdoor: a connection to a remote server that allows criminals to issue commands, spy on personal information and take over input control of your PC. While you may observe some unusual network activity or resource usage during Rodpicom's attacks, Rodpicom (like all versions of Dorkbot) will try to avoid being highly-visible and may not show any type of symptoms. SpywareRemove.com malware research team forewarns that your confidential information and the overall integrity of your PC should be considered to be at risk as long as Rodpicom remains neither disabled nor deleted.

Rodpicom's Backup Plans for Causing Computer-Based Harm

Besides the extreme security violations that are inherent in any backdoor attack, SpywareRemove.com malware experts also have found Rodpicom and related Dorkbot worms to be capable of other harmful functions. Some of these include:

The downloading and installing of other malware besides Rodpicom.
Patches to update Rodpicom, itself.
Several features that are designed to avoid Rodpicom being detected by dedicated anti-virus and anti-malware programs.

In spite of its defenses, Rodpicom can be removed by competent anti-malware products with a reasonable lack of difficulty. To make certain that you've deleted Rodpicom and any PC threats associated with Rodpicom, SpywareRemove.com malware researchers strongly recommend that you use Safe Mode before you initiate any anti-malware scans.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:

329458d157a03083b177fe53c439516f

File name: 329458d157a03083b177fe53c439516f
Size: 1.21 MB (1212416 bytes)
MD5: 329458d157a03083b177fe53c439516f
Detection count: 98
Group: Malware file
Last Updated: February 13, 2013

725effd207ab36153e8c53e7b96edfc4

File name: 725effd207ab36153e8c53e7b96edfc4
Size: 2.33 MB (2330624 bytes)
MD5: 725effd207ab36153e8c53e7b96edfc4
Detection count: 97
Group: Malware file
Last Updated: February 13, 2013

757b3545a97f063cde6f64954dd6ffc2

File name: 757b3545a97f063cde6f64954dd6ffc2
Size: 94.2 KB (94208 bytes)
MD5: 757b3545a97f063cde6f64954dd6ffc2
Detection count: 96
Group: Malware file
Last Updated: February 13, 2013

bdc68df41f282f07fd2d45267aa27449

File name: bdc68df41f282f07fd2d45267aa27449
Size: 1.2 MB (1209344 bytes)
MD5: bdc68df41f282f07fd2d45267aa27449
Detection count: 94
Group: Malware file
Last Updated: February 13, 2013

49f919c49068d963dfc65fd3baae9d20

File name: 49f919c49068d963dfc65fd3baae9d20
Size: 80.74 KB (80746 bytes)
MD5: 49f919c49068d963dfc65fd3baae9d20
Detection count: 92
Group: Malware file
Last Updated: February 13, 2013