Troj/Kaiten

Posted: October 26, 2011

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Threat Level:	1/10
Infected PCs:	7

First Seen:	October 26, 2011
Last Seen:	February 5, 2023
OS(es) Affected:	Windows

Troj/Kaiten is a backdoor Trojan that attacks computers running the Linux operating system (as opposed to the popular Windows or Mac-derived platforms). Although Troj/Kaiten infections are associated primarily with DDoS site-flooding attacks, SpywareRemove.com malware experts also warn that they can be used to engage in other attacks, such as stealing personal information, blocking applications or installing other forms of malicious software. Aside from very minor system changes and unusual system resource expenditures, Troj/Kaiten may show no signs of being active on your computer, but nonetheless presents an extreme threat to an infected Linux machine. The faster you resort to a good anti-malware program to remove Troj/Kaiten from your computer, the better, since every second ticking can mean another second under the control of hackers.

Troj/Kaiten: A Selective Assailant with a Flexible Plan of Assault

Troj/Kaiten is designed for the specific purpose of infecting Linux OS computers; this freely-distributed and open-source operating system is often used by computer enthusiasts and people who are interested in having a secondary operating system for security purposes. Although Troj/Kaiten isn't capable of attacking other operating systems like Windows, if Troj/Kaiten does infect your computer while you're running Linux, its attacks can be configured to cause many different types of harm.

Like other types of backdoor Trojans, Troj/Kaiten tries to avoid detection and doesn't leave obvious symptoms of its activities, although you may be able to detect Troj/Kaiten due to actions of more-obtrusive software that Troj/Kaiten installs (such as rogue security programs). Troj/Kaiten communicates with IRC servers to receive instructions on actions that Troj/Kaiten should take and SpywareRemove.com malware experts note a corresponding danger of the following:

Having your computer harnessed into performing Distributed-Denial-of-Service attacks. In addition to being illegal, DDoS attacks can shut down innocent website with traffic floods and may harm your computer with the excessive resource expenditure.
Attacks against your firewall, network security settings and other aspects of your computer's security that prevent criminals from accessing it. Relevant programs may be shut down or have their settings set to harmful values.
Other types of harmful software may also be installed on your computer by Troj/Kaiten. Spyware programs that steal passwords and other forms of sensitive info, scamware products that display fake infection alerts, and browser hijackers that redirect your web browser to harmful sites are all possible Troj/Kaiten payloads.

What You Can Do About Troj/Kaiten to Dial Back Its Damage

Troj/Kaiten is a sufficiently-diverse program for malicious purposes that SpywareRemove.com malware experts have even found Troj/Kaiten used to design variants that focus on other operating systems. For example, OSX/Tsunami-A, a Mac OS X backdoor Trojan that was discovered late in October of 2011, appears to be based on Troj/Kaiten's code. Regardless of which operating system you use, be alert for unwanted changes to your security-related programs and use up-to-date anti-malware products to protect your computer from attacks by Troj/Kaiten and related Trojans.

Symptoms of Troj/Kaiten infections can vary so much that the easiest way to detect Troj/Kaiten is by using an anti-malware program to scan your computer. Be certain that you've installed all threat definition database updates so that your scanner of choice can detect all Troj/Kaiten components. As long as you use an appropriately-competent anti-malware program to remove Troj/Kaiten, there shouldn't be any signs of long-term damage to Linux or other parts of your computer.

Technical Details

Registry Modifications

The following newly produced Registry Values are:

HKEY..\..\..\..{Subkeys}HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{fd9bc004-8331-4457-b830-4759ff704c22}HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{e2ddf680-9905-4dee-8c64-0a5de7fe133c}

Additional Information

The following URL's were detected:

dailyfeastrecipe.com