Trojan-Downloader.JS.DarDuk

Posted: April 18, 2012

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Threat Level:	2/10
Infected PCs:	5

First Seen:	April 18, 2012
OS(es) Affected:	Windows

Trojan-Downloader.JS.DarDuk is a subgroup of the Blackhole Exploit Pack, a category of JavaScript-based exploits that are hosted by malicious websites and third-party advertisements in order to attack your PC and install harmful software without your consent. Because Trojan-Downloader.JS.DarDuk's primary function is to install other PC threats, SpywareRemove.com malware researchers strongly recommend that you scan your entire PC as soon as you suspect any possibility of a Trojan-Downloader.JS.DarDuk attack. Besides alerts from relevant security software, there aren't any significant symptoms for Trojan-Downloader.JS.DarDuk's activities, although Trojan-Downloader.JS.DarDuk requires the presence of both JavaScript and Adobe-brand software to complete its functions. Many websites that host Trojan-Downloader.JS.DarDuk will use fake 'Please wait page is loading...' messages to distract you from their Trojan-Downloader.JS.DarDuk attacks, and it's encouraged for you to scan your computer if you notice this message appear on a website that hasn't had its trustworthiness verified to your satisfaction.

Trojan-Downloader.JS.DarDuk: a Website Loading Page with Attacks Wedged in While You Wait

Trojan-Downloader.JS.DarDuk covers a range of similar browser exploits that use JavaScript to attack your PC by way of Adobe Reader and Adobe Acrobat. If your PC lacks any of the above software, you can consider yourself immunized to Trojan-Downloader.JS.DarDuk attacks, although SpywareRemove.com malware researchers caution that similar exploits are both in development and being propagated more or less continually. Many of the specific exploits that Trojan-Downloader.JS.DarDuk uses, such as CVE-2007-5659, CVE-2009-0927, CVE-2011-2110, CVE-2010-0840 or CVE-2011-3544, have also been closed by patches to the relevant software, and keeping your JavaScript and Adobe programs completely updated will also help to defend your PC against Trojan-Downloader.JS.DarDuk.

If you do access a Trojan-Downloader.JS.DarDuk-hosting site with a computer that's vulnerable to its attacks, you may see a 'Please wait page is loading' message while Trojan-Downloader.JS.DarDuk installs malicious software automatically and undetectably (unless your anti-malware software detects the attack). Security software can detect variants of Trojan-Downloader.JS.DarDuk by a wide range of aliases, including Trojan-Downloader.JS.DarDuk.do, Trojan-Downloader.JS.DarDuk.cw, Exploit:JS/Blacole.AD, Exploit:Win32/Pdfjsc.YX, JS/Kryptik.ES, Trojan.malscript!html and Mal/ExpJS-N. Trojan-Downloader.JS.DarDuk may also attempt to detect your operating system and browser type to install the most appropriate PC threat for your configuration.

How to Climb Out of the Black Hole That is Trojan-Downloader.JS.DarDuk

Because a successful Trojan-Downloader.JS.DarDuk attack always results in other types of hostile software being installed onto your computer, SpywareRemove.com malware experts suggest that you have a good anti-malware program inspect your PC immediately after any potential contact with Trojan-Downloader.JS.DarDuk. In addition to the safety tips noted earlier, you may also want to keep your browser updated, keep its security settings high and avoid potentially harmful links and websites to reduce your chances of exposure to Trojan-Downloader.JS.DarDuk-hosting sites.

Some of the most common payloads for Trojan-Downloader.JS.DarDuk and other Black Hole-related attacks include banking Trojans. Banking Trojans, as per their name, specifically target and steal information from online bank accounts and are noted for their high level of sophistication and stealth. This high-level security risk has SpywareRemove.com malware experts recommending that you contact your bank about appropriate security measures to take if you've recently removed a Trojan-Downloader.JS.DarDuk-installed PC threat from your computer.

Trojan-Downloader.JS.DarDuk

Threat Metric

Trojan-Downloader.JS.DarDuk: a Website Loading Page with Attacks Wedged in While You Wait

How to Climb Out of the Black Hole That is Trojan-Downloader.JS.DarDuk

Leave a Reply