Trojan-Spy.Win32.Lurk

Posted: April 13, 2012

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Ranking:	6,456
Threat Level:	2/10
Infected PCs:	17,109

First Seen:	April 13, 2012
Last Seen:	March 8, 2025
OS(es) Affected:	Windows

Trojan-Spy.Win32.Lurk is a Trojan that's installed through virus-based attacks from Russian advertisement servers. Although the virus that installs Trojan-Spy.Win32.Lurk is automatically injected into the relevant memory process, Trojan-Spy.Win32.Lurk is unable to survive a reboot, and is, therefore, only a risk in the sense that it installs Trojan-Spy.Win32.Lurk without your consent. Trojan-Spy.Win32.Lurk is further identified as a form of generic spyware that tries to steal personal information that potentially can include bank account passwords and other forms of sensitive data that are exploitable for account break-ins and other attacks. While SpywareRemove.com malware researchers classify Trojan-Spy.Win32.Lurk as a significant threat to be removed with good anti-malware software, the unusual ease of installation that's involved in Trojan-Spy.Win32.Lurk attacks also causes them to encourage you to use top-notch browser security settings and security software to defend against these kinds of live code injection attacks.

Trojan-Spy.Win32.Lurk – the Byproduct of an Intruder in Your RAM

Trojan-Spy.Win32.Lurk was recently identified as the ultimate payload for a separate virus that's distributed via malicious advertisements on compromised advertisement networks. Unusually for malicious software, Trojan-Spy.Win32.Lurk's virus installer doesn't require a file download of any kind – instead, the virus's encrypted .dll file is injected directly into the javaw.exe process. Javaw.exe is notable as the memory process for the famous JavaScript package. Although this code injection does require that your PC has Java aboard, SpywareRemove.com malware researchers note that Trojan-Spy.Win32.Lurk also enables the virus to be unusually flexible in other ways, since Trojan-Spy.Win32.Lurk can effectively attack both Mac and Windows-based computers.

Since the virus will be unloaded from memory after a system reboot, Trojan-Spy.Win32.Lurk is unable to persist as a long term threat, and its design makes up for that by installing Trojan-Spy.Win32.Lurk. Trojan-Spy.Win32.Lurk is designed to steal info from Russian bank websites, with the potential to target passwords and other details that could be utilized to steal money and commit other crimes with your personal information. However, Trojan-Spy.Win32.Lurk and its virus can be reconfigured to target other sites or use other attacks, and hence, protection against Trojan-Spy.Win32.Lurk should be considered a priority even if you don't use a Russian bank.

Keeping Trojan-Spy.Win32.Lurk and Its Friendly Virus from Sneaking Up Behind an Advertisement

Since Trojan-Spy.Win32.Lurk uses a secondary PC threat for its own installation, SpywareRemove.com malware researchers recommend that you keep your computer safe against both levels of Trojan-Spy.Win32.Lurk's attack simultaneously. Trojan-Spy.Win32.Lurk's related virus uses a Java exploit that has since been patched, and keeping JavaScript updated or not having Java on your computer are both viable means of crippling this method of Trojan-Spy.Win32.Lurk installation. Avoiding Russian-based advertisement rings, especially those with poor reputations for viewer safety, can also be considered as a standard precaution.

Trojan-Spy.Win32.Lurk, itself, typically will be detected once Trojan-Spy.Win32.Lurk is installed, as long as you have anti-malware software that's actively monitoring for live attacks and PC threats. After Trojan-Spy.Win32.Lurk's installation, system scans by the aforementioned software can be used to delete Trojan-Spy.Win32.Lurk, and SpywareRemove.com malware experts recommend that you do this before you use any website that requires that you enter private information on a Trojan-Spy.Win32.Lurk-infected PC.

Technical Details

Additional Information

The following URL's were detected:

news-themes.com