Troj/SWFExp-BF

Posted: January 2, 2013

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Threat Level:	9/10
Infected PCs:	3

First Seen:	January 2, 2013
Last Seen:	April 11, 2020
OS(es) Affected:	Windows

Troj/SWFExp-BF is a malicious Adobe Flash exploit that's used to conduct attacks against your PC that, in most cases, install malicious software (AKA malware) onto your computer without your permission. Troj/SWFExp-BF is just one component of a multi-component exploit that was recently uncovered for Internet Explorer, and SpywareRemove.com malware researchers warn that as of this time there is no patch to protect against this exploit. Troj/SWFExp-BF's attacks affect all versions of IE below 9, and you should consider avoiding outdated versions of IE until this security issue has been remedied by Microsoft.

How Microsoft and Adobe are, Once Again, Unwilling Vehicles for Online Attacks

Troj/SWFExp-BF is merely one of several parts of a multiple-component exploit that targets Windows PCs running Internet Explorer versions 6 through 8. Troj/SWFExp-BF and related PC threats are unpatched exploits that can't be prevented by patching your software, although more recent versions of IE (9 and 10) aren't vulnerable to Troj/SWFExp-BF's attack, which is broadly-labeled as CVE-2012-4792. Related PC threats include Sus/20124792-B, Sus/DeplyJv-A and Sus/Yoldep-A – which SpywareRemove.com malware analysts note also have been seen in other attacks that involved compromised websites for prominent hotel chains.

Contact with compromised or hostile sites that employ Troj/SWFExp-BF usually will result in malicious software being installed on your computer. This delivery method has been known to install Trojan downloaders, rootkits, banking Trojans and other advanced types of PC threats that include advanced defenses and highly-invasive attacks. Unfortunately, there aren't any symptoms that are associated with Troj/SWFExp-BF attacks, and SpywareRemove.com malware researchers warn that you may be unable to detect Troj/SWFExp-BF at all without appropriate anti-malware software.

Protecting Your PC from Troj/SWFExp-BF's Drive-by-Downloads

As noted earlier, the easiest way to keep your PC safe from Troj/SWFExp-BF is to avoid using vulnerable versions of Internet Explorer (which, SpywareRemove.com malware researchers note, is a frequent target of such attacks). In other cases, you also may find it convenient to avoid using Flash; if Flash isn't installed in the first place, then it can't be exploited to attack your computer via Troj/SWFExp-BF. Likewise, related PC threats that exploit Java and/or JavaScript can be avoided by keeping those programs uninstalled.

Additionally, Troj/SWFExp-BF's attack uses the privileges of the currently logged-in Windows account to conduct its payload's installation. Windows accounts without administrator privileges are, consequentially, less vulnerable to Troj/SWFExp-BF than admin accounts would be under the same circumstances. Still, all of these safeguards shouldn't be considered a replacement for the presence of strong anti-malware software, which should be used to remove infections that are related to Troj/SWFExp-BF whenever applicable. Because drive-by-downloads like Troj/SWFExp-BF's exploits often are used to install high-level threats, trying to detect or remove any malicious software that's installed by Troj/SWFExp-BF is strongly discouraged.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:

cc.swf

File name: cc.swf
Size: 4.53 KB (4539 bytes)
MD5: 334680e3bb31332a9d677ec77228d74c
Detection count: 34
Mime Type: unknown/swf
Group: Malware file
Last Updated: February 24, 2014

today.swf

File name: today.swf
Size: 3.94 KB (3945 bytes)
MD5: eebedd8b48e0b8fa1fdd5f93b87ff03a
Detection count: 6
Mime Type: unknown/swf
Group: Malware file
Last Updated: January 3, 2013

More files