Troj/PDFJs-WT

Posted: April 6, 2012

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Ranking:	4,203
Threat Level:	2/10
Infected PCs:	10,057

First Seen:	April 6, 2012
Last Seen:	March 4, 2025
OS(es) Affected:	Windows

Troj/PDFJs-WT is a PDF-embedded Trojan that uses a combination of CCITTFax filter abuse and buffer overflow vulnerabilities to execute malicious code in an attack against your PC. Because attacks like those that are used by Troj/PDFJs-WT can be put to any number of purposes, SpywareRemove.com malware researchers recommend that you use preventative safeguards to detect and delete Troj/PDFJs-WT instead of trying to detect Troj/PDFJs-WT by its symptoms, which may be minor or nonexistent. Keeping your Adobe-brand software updated and having good anti-malware software on-hand are both suggested for stopping Troj/PDFJs-WT attacks, which are distributed through a range of malicious websites. If your PC has been victimized by a successful Troj/PDFJs-WT attack, you should scan your PC immediately with appropriate software to detect and remove any related PC threats or system changes that Troj/PDFJs-WT may have installed or created.

How Troj/PDFJs-WT Gets to Your PC Sight Unseen

Troj/PDFJs-WT and similar PDF-based attacks can be propagated by spam e-mail links, malicious sites with mislabeled download links or even by drive-by-download scripts that force your computer to launch the corrupted file undetectably. Because Troj/PDFJs-WT requires the presence of Adobe Reader or Acrobat for exploitation, lacking these applications will make your PC effectively immune to Troj/PDFJs-WT attacks. An updated web browser can also reduce exploits that can be used to launch Troj/PDFJs-WT files automatically, and, of course, SpywareRemove.com malware researchers recommend that you have security software that can detect and block Troj/PDFJs-WT before Troj/PDFJs-WT can attack your computer at all.

If you do require Adobe software to read PDF files, updating your software to versions 9.4 (for Reader) or 8.2.5 (for Acrobat) will close the CVE-2010-2883 vulnerability that Troj/PDFJs-WT uses to attack your PC; however, your computer will still be open to other PDF vulnerabilities that haven't been patched as of the time of this writing. Notably, Troj/PDFJs-WT attacks can affect both Windows and Mac operating systems, unlike many Trojans that are designed to function for just one or the other.

Troj/PDFJs-WT was detected late in March 2012, and it's suggested that you have anti-malware software that's at least updated past that point if you want to insure that your software can detect Troj/PDFJs-WT attacks successfully.

The Results of an Opened Troj/PDFJs-WT File That You May Not See Coming

Attacks by Troj/PDFJs-WT can be put to multiple purposes, but are particularly likely to lead to the installation of PC threats that can include:

Spyware programs that steal private information.
Rootkits that infected baseline system components and can often persist even after a System Restore while also being difficult to detect or remove.
Backdoor Trojans that create security issues to allow remote criminals to control your computer.
Trojan droppers and Trojan downloaders that can install other PC threats, often in a variable and configurable fashion.
Worms that can use networks and removable drives to spread to new computers.

SpywareRemove.com malware research team notes that many types of PC threats that are installed by Troj/PDFJs-WT and similar exploits may not show many or any symptoms of their payloads. Having anti-malware programs on your PC is always advised to detect either Troj/PDFJs-WT or any other infection that may have been installed by Troj/PDFJs-WT.

Technical Details

Additional Information

The following URL's were detected:

music-online.me