Troj/Inject-VI

Posted: May 31, 2012

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Threat Level:	9/10
Infected PCs:	35

First Seen:	May 31, 2012
Last Seen:	March 15, 2023
OS(es) Affected:	Windows

Troj/Inject-VI is a Trojan horse that's distributed via spam e-mail messages. Current Troj/Inject-VI e-mail templates portray themselves as fake hotel reservation messages that include Troj/Inject-VI as a file attachment. As a recently-identified PC threat, Troj/Inject-VI's full capabilities haven't yet been analyzed, although Trojans that are similar to Troj/Inject-VI have been known to install other forms of harmful software or create significant security vulnerabilities on infected PCs. If you've had any contact with file attachments from e-mail messages like the above example, SpywareRemove.com malware researchers suggest deleting Troj/Inject-VI via thorough anti-malware scans, since Troj/Inject-VI may use code-injection techniques to conceal itself and complicate its removal.

Troj/Inject-VI: Humbly Arriving in Your Mailbox with the Worst of Intentions

Like Trojans such as Win32/Cbeplay.P, Troj/Bredo-RK or IRCbot.CPH, Troj/Inject-VI uses fraudulent e-mail messages for its primary means of propagation. Troj/Inject-VI's e-mail scam of choice is that of a fake Booking.com reservation; since this reservation implies a corresponding charge to your credit card or bank account, victims are likely to panic and open the attached file without any further hesitations. However, the enclosed file that supposedly displays 'reservation details' is just an installer for the Trojan Troj/Inject-VI. Since reputable websites and companies, including Booking.com, explicitly avoid sending e-mail file attachments due to such security risks, SpywareRemove.com malware researchers note that you can safely delete any such spam e-mail immediately to protect your PC from Troj/Inject-VI.

SpywareRemove.com malware experts also note that non-Windows users are also be able to laugh in the face of Troj/Inject-VI's attempted attack, since Troj/Inject-VI lacks cross-OS compatibility and can only infect Windows computers. After its installation, Troj/Inject-VI will drop its malicious files into randomly-named subdirectories of the Application Data folder and will also make some modifications to the Windows Registry.

When Troj/Inject-VI's Reservation Turns into Your PC's Peril

As Troj/Inject-VI's complete payload has yet to be analyzed, Troj/Inject-VI may be capable of other attacks besides those that are listed below. However, current functions that SpywareRemove.com malware researchers have confirmed in Troj/Inject-VI attacks include:

Changing the firewall's authorized applications list, which can allow Troj/Inject-VI and other PC threats to transfer data to or from your PC without your consent.
Interfering with your cookie-based settings. Websites often use cookies to store passwords, account preferences and other forms of sensitive information.
Troj/Inject-VI will also set itself to launch automatically when Windows starts.
Finally, your Internet security settings will be altered to make your web-browsing experiences vulnerable to future attacks from hostile sites.

All of the above attacks use the Windows Registry, and attempting to change your Registry without appropriate assistance from a PC security expert or suitable software may permanently damage Windows. SpywareRemove.com malware analysts propone using anti-malware programs to detect and remove Troj/Inject-VI due to Troj/Inject-VI's system changes and its usage of randomly-named files (such as aliqynu.exe).

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:

t8ffot8o.exe

File name: t8ffot8o.exe
Size: 70.65 KB (70656 bytes)
MD5: 9b4e4dc586f982ef1b2d14ce17d32722
Detection count: 78
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: June 7, 2012

ms.zip

File name: ms.zip
Size: 55.02 KB (55026 bytes)
MD5: df8bce35c725968f9ed5ffb8ba9493c0
Detection count: 75
Mime Type: unknown/zip
Group: Malware file
Last Updated: June 7, 2012

file.exe

File name: file.exe
Size: 240.64 KB (240640 bytes)
MD5: 5343593f082cd71a29b1510e12e3cb0d
Detection count: 74
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: June 7, 2012

More files