Troj/ExpJS-N

Posted: March 2, 2012

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Threat Level:	9/10
Infected PCs:	9

First Seen:	March 2, 2012
Last Seen:	June 17, 2021
OS(es) Affected:	Windows

Troj/ExpJS-N is a variant of the infamous Blackhole Exploit Kit that's used to install other types of PC threats undetectably, and without your consent – in Troj/ExpJS-N's case, these PC threats consist of banking Trojans that steal financial information (such as bank account passwords). Because recent Troj/ExpJS-N attacks have been specifically noted to target Russian websites and Russia-based victims, SpywareRemove.com malware experts note that you can relax about Troj/ExpJS-N attacks if you don't make a habit of reading Russian content. However, if you are in danger of being infected by Troj/ExpJS-N, symptoms of these attacks may not be plainly evident, and you should make a habit of using anti-malware software to protect your PC actively against script-based exploits like Troj/ExpJS-N before they can install Trojans and other PC threats onto your computer.

Troj/ExpJS-N: A Spy Delivered by Java Right Through Your Web Browser

Although Troj/ExpJS-N was defined as a PC threat as far back as the middle of 2011, brand-new Troj/ExpJS-N attacks have been noted in early March of 2012. You may be required to update your anti-malware software for recent threats to detect and block recent variants of Troj/ExpJS-N or its payload (which, at the time of this writing, consists of banker Trojans). Patching your web browser can also help to defend your PC from Troj/ExpJS-N attacks, since SpywareRemove.com malware analysts have noted that some Troj/ExpJS-N attacks utilize Internet Explorer exploits that have since been remedied via patches.

Troj/ExpJS-N is promoted by Traffbiz, a criminal company that uses a fake pay-per-view advertisement model to encourage web masters to insert the code for Troj/ExpJS-N attacks into their websites. This code distinguishes between Russian and non-Russian visitors, and only loads the Troj/ExpJS-N exploit if the visiting PC is based in Russia. If you visit websites with Russian content, SpywareRemove.com malware research team recommends that you disable JavaScript during visits to sites that may inadvertently host Troj/ExpJS-N exploits. Troj/ExpJS-N will not display obvious evidence of its attacks, but its payload of banking Trojans should be considered high-level threats to your PC.

How Troj/ExpJS-N is an Invisible First Step in Infiltrating Your Bank Account

Like other variants of Black Hole Exploit Kits, Troj/ExpJS-N uses exploits to install malicious software, more specifically, spyware-based Trojans. These Trojans will attempt to steal financial information that's linked to bank accounts and may even circumvent your bank site's security features to do so. Other than warnings from your security software, symptoms of Troj/ExpJS-N's payload may not be very evident, and SpywareRemove.com malware experts suggest that you use anti-malware scans to both detect and delete Troj/ExpJS-N-related PC threats. Troj/ExpJS-N attacks may also be detected by aliases such as Exploit:JS/Elecom.A or Exploit-Comele.

After Troj/ExpJS-N's Trojans are deleted, it's also recommended that you contact your bank and take appropriate measures (such as changing your account's password) to stop any possibility of future attacks, since chances are high that your information has already been compromised. These dangers are specific to Windows, and SpywareRemove.com malware analysts have found every indication that users of non-Windows computers can rest easy in knowing that Troj/ExpJS-N is unable to affect their operating systems.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:

file.html

File name: file.html
Size: 13.23 KB (13236 bytes)
MD5: 14fc936de0813c2f4ae5f72802bfcf9b
Detection count: 80
Mime Type: unknown/html
Group: Malware file
Last Updated: March 12, 2012

output.txt

File name: output.txt
Size: 3.65 KB (3654 bytes)
MD5: f68fd05bb4ac045a424b38a1cd983fa8
Detection count: 71
Mime Type: unknown/txt
Group: Malware file
Last Updated: March 12, 2012

More files