Virus.Win32.CeeInject

Posted: November 2, 2009

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Threat Level:	8/10
Infected PCs:	68

First Seen:	December 7, 2010
OS(es) Affected:	Windows

Virus.Win32.CeeInject is a Trojan horse that may attack your PC to steal private information, install other harmful programs or create critical security vulnerabilities. Virus.Win32.CeeInject may use native Windows file names to hide Virus.Win32.CeeInject's actions and is capable of using multiple file components to attack your PC. Although information on Virus.Win32.CeeInject currently is limited, any possible Virus.Win32.CeeInject infection should be considered potentially dangerous. The variety in Virus.Win32.CeeInject's possible components makes the manual removal of Virus.Win32.CeeInject a less than ideal course of action.

The Potential Disguises Virus.Win32.CeeInject May Use

Virus.Win32.CeeInject has been reported to infect computers as part of bundled software installations or by exploiting browser vulnerabilities. Avoid downloading software from suspicious sources and disable Java and Flash for unfamiliar websites to reduce your vulnerability to a Virus.Win32.CeeInject attack.

Virus.Win32.CeeInject has been linked to file names like recguard.exe, which is a natural part of HP brand computers that protects the Windows XP Recovery Partition. However, a Virus.Win32.CeeInject infection may use this name or another harmless one to remain active while avoiding suspicion.

You can detect a possible Virus.Win32.CeeInject process by checking the memory that Virus.Win32.CeeInject uses or by noting the User Name Virus.Win32.CeeInject uses. Both these statistics can be seen in Windows Task Manager, which can be accessed with Ctrl+Alt+Del.

Why Having a Virus.Win32.CeeInject Infection is a Concern

Trojans like Virus.Win32.CeeInject can be used to cause many different types of harm to your PC, most of which occur secretively or in a disguised manner:

Virus.Win32.CeeInject may download and install other harmful programs onto your computer. Some likely possibilities include scamware such as rogue security applications, spyware such as keyloggers that steal personal information, browser hijacks and ransomware Trojans that lock up your computer.
Virus.Win32.CeeInject may create a backdoor in your security; backdoors are often used to take over a remote computer via criminal methods. Signs of a backdoor can include having a Virus.Win32.CeeInject program added to your firewall exceptions, having your firewall and other security programs disabled or observing unusual network activity or port settings.
Like most other types of malicious programs, Virus.Win32.CeeInject has been observed to launch itself without permission and remain active in the background. In this form, Virus.Win32.CeeInject may be as good as invisible, aside from the possibility of a Virus.Win32.CeeInject memory process showing up in Task Manager.

Many of Virus.Win32.CeeInject's attacks may exploit the Windows Registry to damage your computer. Altering the Windows Registry without help from a powerful security program is inadvisable, since inappropriate Registry changes can cause permanent harm to Windows. Instead of taking the matter of Virus.Win32.CeeInject's deletion into your own hands, delete Virus.Win32.CeeInject with appropriate programs for the best results.

Aliases

W32/Injector.IA!tr [Fortinet]TrojWare.Win32.Trojan.Refroso.~F [Comodo]Backdoor.Bot.124802 [BitDefender]Trojan.Refroso.bkxy [CAT-QuickHeal]Trojan.Win32.Refroso.bkyr!A2 [a-squared]BackDoor-EEF.gen.c [McAfee]BackDoor.Siggen.14353 [DrWeb]BackDoor.Generic12.BTPG [AVG]TR/Crypt.XPACK.Gen2 [AntiVir]Trojan.Win32.Refroso.blnj!A2 [a-squared]Trj/CI.A [Panda]Generic.dx!sys [McAfee]Trojan.Win32.Refroso.bkyu [Kaspersky]Win32.HEURMalware [eSafe]Dropper.Generic2.SZG [AVG]
More aliases (33)

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:

%WINDIR%\system32\m70njee6q.exe

File name: m70njee6q.exe
Size: 39.42 KB (39424 bytes)
MD5: fc44cccd79e0fb305ca7333e5314c0ff
Detection count: 81
File type: Executable File
Mime Type: unknown/exe
Path: %WINDIR%\system32
Group: Malware file
Last Updated: December 7, 2010

%WINDIR%\system32\upql081sde.exe

File name: upql081sde.exe
Size: 37.88 KB (37888 bytes)
MD5: 6d6257318aa02bc2cd334e2110c4af58
Detection count: 60
File type: Executable File
Mime Type: unknown/exe
Path: %WINDIR%\system32
Group: Malware file
Last Updated: December 7, 2010

%USERPROFILE%\Start Menu\Programs\Startup\gw3idjk1a.exe

File name: gw3idjk1a.exe
Size: 37.88 KB (37888 bytes)
MD5: 4a1a0cfb923eec2dc1e30cc08af005ca
Detection count: 16
File type: Executable File
Mime Type: unknown/exe
Path: %USERPROFILE%\Start Menu\Programs\Startup
Group: Malware file
Last Updated: December 7, 2010

%USERPROFILE%\Start Menu\Programs\Startup\fqmrhn66epl.exe

File name: fqmrhn66epl.exe
Size: 37.88 KB (37888 bytes)
MD5: 128c58228d7406ccdfde211671207234
Detection count: 14
File type: Executable File
Mime Type: unknown/exe
Path: %USERPROFILE%\Start Menu\Programs\Startup
Group: Malware file
Last Updated: December 7, 2010

%WINDIR%\system32\3ojp60r.exe

File name: 3ojp60r.exe
Size: 38.4 KB (38400 bytes)
MD5: 9c4b94cd4726c71e389b8b8e34233e0d
Detection count: 9
File type: Executable File
Mime Type: unknown/exe
Path: %WINDIR%\system32
Group: Malware file
Last Updated: December 7, 2010

%WINDIR%\system32\5rw86i8.exe

File name: 5rw86i8.exe
Size: 37.88 KB (37888 bytes)
MD5: 1a720b0df40a7282e9f3801ec0bfb0ac
Detection count: 5
File type: Executable File
Mime Type: unknown/exe
Path: %WINDIR%\system32
Group: Malware file
Last Updated: December 7, 2010