TROJ_ARTIEF.DOC

Posted: April 27, 2012

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Threat Level:	9/10
Infected PCs:	84

First Seen:	April 27, 2012
OS(es) Affected:	Windows

TROJ_ARTIEF.DOC is a malicious .rtf file that's distributed by spam e-mail messages under the pretense of offering news about North Korea's recent (and, for better or worse, botched) rocket launch. By exploiting .rtf-specific vulnerabilities, TROJ_ARTIEF.DOC installs its payload, the backdoor Trojan BKDR_POISON.DOC. Backdoor Trojans of any sort, including those that are installed by TROJ_ARTIEF.DOC, should always be considered serious security threats to your PC as they allow criminals to exert control over your computer via a remote Command & Control server. Although TROJ_ARTIEF.DOC's payload may be used for a range of different attacks, SpywareRemove.com malware analysts consider BKDR_POISON.DOC's keylogging attacks to be its most noteworthy characteristic, since keylogging can be used to steal passwords and other forms of sensitive information with minimal symptoms of the theft occurring. If you're in the habit of opening unusual e-mail file attachments that resemble TROJ_ARTIEF.DOC according to the above description, you may want to consider scanning your PC in case TROJ_ARTIEF.DOC has abused your trust to install a spy onto your hard drive.

TROJ_ARTIEF.DOC – Another Reason Why You Shouldn't Trust Obvious File Types from Non-Obvious Sources

Similar to TROJ_MDROP.GDL, TROJ_ARTIEF.ZIGS or Trojan dropper variants of Backdoor.Meciv, TROJ_ARTIEF.DOC is named to appear as a Word document, but its .doc file type doesn't match its true file type at all, which is a .rtf. While even .rtf files are, under normal circumstances, harmless text files, TROJ_ARTIEF.DOC exploits its file type by using a Microsoft Office vulnerability that SpywareRemove.com malware researchers identify as CVE-2010-3333, which allows TROJ_ARTIEF.DOC to execute arbitrary and malicious code after you launch its file. The following programs are vulnerable to TROJ_ARTIEF.DOC's attack, especially if not updated to reduce the presence of such security weaknesses:

Microsoft Office 2003 Service Pack 3
Microsoft Office 2004 (for Mac operating systems only)
Microsoft Office 2007 Service Pack 2
Microsoft Office 2008 (for Mac operating systems only)
Microsoft Office 2010
Microsoft Office 20011 (for Mac operating systems only)
Microsoft Office XP Service Pack 3
Open XML File Format Converter (for Mac operating systems only)

If TROJ_ARTIEF.DOC is opened and is able to take advantage of the CVE-2010-3333 vulnerability, the backdoor Trojan BKDR_POISON.DOC will be installed onto your PC. BKDR_POISON.DOC, in addition to allowing criminals to control your PC like any backdoor Trojan would, has also been noted to contain spyware-esque capabilities, which SpywareRemove.com malware researchers specifically note to extend to attacks such as keylogging, capturing screenshots and even recording webcam data.

Hoarding Your Info Away from TROJ_ARTIEF.DOC's Eager Eyes

Because TROJ_ARTIEF.DOC propagates via e-mail messages under misleading names like 'North Korea satellite launch eclipses that of Iran.doc,' SpywareRemove.com malware analysts emphasize the necessity of avoiding suspicious file attachments from mass-mailed e-mail messages as a top way to protect your PC from TROJ_ARTIEF.DOC. However, if you have opened such a file, you should be aware that symptoms of backdoor Trojans like BKDR_POISON.DOC rarely show visible symptoms and are most easily detected by anti-malware programs that are designed for the purpose.

Keeping vulnerable software (as noted earlier in this article) updated can also reduce potential vulnerabilities that TROJ_ARTIEF.DOC could exploit, and SpywareRemove.com malware researchers always recommend that you keep any applications on your PC as updated as possible for this reason. Ignoring these security issues and allowing TROJ_ARTIEF.DOC to take advantage of your PC can result in theft of account passwords and related information, which may then lead to bank account-related attacks and other security issues that can extend well past the confines of your computer.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:

Chin.doc

File name: Chin.doc
Size: 164.86 KB (164865 bytes)
MD5: 2a005bd66fb1e90269b2c0c8ef78ae6d
Detection count: 58
Mime Type: unknown/doc
Group: Malware file
Last Updated: May 3, 2012

%User Temp%\kser.exe - detected as BKDR_POISON.DOC

File name: %User Temp%\kser.exe - detected as BKDR_POISON.DOC
Mime Type: unknown/DOC
Group: Malware file