Carberp Trojan

Posted: February 4, 2011

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Threat Level:	8/10
Infected PCs:	76

First Seen:	December 8, 2012
OS(es) Affected:	Windows

Carberp Trojan is an unusually subtle Trojan virus that wrests control of your web browser, monitors and transmits information from infected systems, and downloads other malware without the user's consent. Carberp Trojan does not even pretend to be useful to the user. Once you recognize Carberp Trojan’s presence, deleting the Trojan should be the obvious recourse. Because of the complex nature of this virus' infiltration, it makes it both a challenge to find and delete in the first place.

The Background of Carberp Trojan

First appearing in 2010, Carberp Trojan, also known as Trojan.Carberp, has been far from stagnant in the intervening time up to the present. The hackers behind CarBerp Trojan have constantly updated it to prevent straightforward detection and removal. This has resulted in a unique threat that can be almost impossible to see. As mentioned above, not removing Carberp Trojan can have drastic consequences, and is no more a safe course of action than ignoring an assassin at one's back!

How Carberp Trojan's Camouflage Works

Carberp Trojan creates files in the Startup and Application Data folders. Since these folders don't require administrator privileges, this helps Carberp Trojan keep its presence on the down low. Unlike most kinds of malware, Carberp Trojan avoids altering your registry in any way. Some of its files are recognizable as chkntfs.dat and chkntfs.exe.

Because it's easy for most users to see new files in the above folders, Carberp Trojan utilizes two APIs to keep itself hidden. This concealing technique applies to all of its components and its use of the Internet Explorer browser, as well as to Carberp Trojan itself. Even when hiding in an obvious place, the infection is cunning enough to make itself undetectable from casual view.

Just Because You Can't See Carberp Trojan Does Not Mean It Can't Hurt You

Once installed and running, Trojan.Carberp has damaging symptoms, some more obvious than others. Its least harmful, but still highly annoying function is to hijack the user's browser. Browser hijacking redirects the user to unsafe sites that may try to steal your credit card information and may also be used to cause further malware infections.

The second consequence of cohabiting with Carberp Trojan consists of spyware leaks. The infection will watch all your activities and report any information designated useful (to criminals, that is!) to a remote server. Carberp Trojan may target financial or business information, as well as other sentitive data. This is one Trojan with zero respect for your privacy, and all information on the affected system should be considered potentially at risk.

In some cases, Carberp Trojan may fail to connect to the relevant site due to the latter being shut down. This may hamper Carberp Trojan's ability to function somewhat, but shouldn't be regarded as an absolute fail-safe. Given its powerfully destructive functions and evolving behavior, underestimating Carberp Trojan could be a terrible mistake.

Pay This (CARBERP) Trojan's Aggression Back In Kind

Upon the realization that this is the infection you're dealing with, Carberp Trojan should be eradicated utterly, but with patience and care, so to do it the right way. Deleting Carberp Trojan is thought to be more challenging than in the case of standard malware!
If you're relying on well-known anti-malware scanners, you should be ready for Carberp Trojan to attempt to stop them from running. Most importantly, keep malware definitions up to date with your anti-malware program. Carberp Trojan changes so often that it can easily slip through an outdated security software.
You may also attempt to remove all of Carberp's files without the aid of outside software, but this is generally not recommended for amateurs. Carberp Trojan's sophistication is such that even as of February 2011, it remains widely spread and a high threat to computer users everywhere.