Trojan.Antavmu

Posted: March 6, 2011

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Threat Level:	8/10
Infected PCs:	508

First Seen:	December 1, 2009
Last Seen:	January 5, 2022
OS(es) Affected:	Windows

The exceptionally versatile Trojan.Antavmu is designed to hack away at your PC's safety settings and then throw down more viruses, Trojans, worms and other malware. Along with its primary functions, Trojan.Antavmu may also infect Windows processes, hijack your browser and create vulnerabilities for exploitation by remote attackers. In cases of infection, if you don't want to see your computer recruited for DDoS attacks or permanently disabled you should consider deleting Trojan.Antavmu your most urgent goal.

Trojan.Antavmu is a Trojan That's Good at Hide and Seek

Staying far from insecure .exe files and websites you don't trust is the best way to keep your computer from encountering Trojan.Antavmu, but if you think you're infected, you're in for quite a trial trying to detect Trojan.Antavmu. Trojan.Antavmu may toss barriers like these in your path to avoid easy detection:

Some versions of Trojan.Antavmu have been reported to have rootkit techniques This allows Trojan.Antavmu to infect memory processes and makes Trojan.Antavmu nearly invisible as well as difficult to remove. If you get hit by a rootkit-based Trojan.Antavmu infection, you may have no recourse save to reformat your computer.
Trojan.Antavmu can also bring security programs like anti-virus scanners to a dead stop. This disallows access to the very tools you'd use to find and delete Trojan.Antavmu in the first place, making your task that much harder.
Like many other infections, Trojan.Antavmu will add entries into your registry that lets Trojan.Antavmu start with Windows. Deleting the wrong registry entries can harm your computer gravely, and removing Trojan.Antavmu without taking care of your registry may result in other serious errors.
Trojan.Antavmu may also be compressed in some instances; this makes Trojan.Antavmu smaller and more difficult to catch even when anti-virus programs are active.

Trojan.Antavmu's Payload

If you put aside all these defensive and evasive functions, Trojan.Antavmu is still a high threat based on Trojan.Antavmu's attack capability. Different versions of Trojan.Antavmu may hijack your browser and push you towards malicious URLs, create a security backdoor for remote attackers to use against you, prevent the use of a command line prompt or disable the system restore function.

Completely deleting Trojan.Antavmu is obviously a necessity to get your computer back to a safe and secure state, but here's an even better idea: practicing smart online habits to avoid catching this deadly Trojan at all!

Aliases

Heur.Packed.Unknown [Comodo]Heuristic.BehavesLike.Win32.Suspicious.B [McAfee-GW-Edition]Trojan.Win32.Antavmu.gkd [Kaspersky]Mal/Generic-A [Sophos]TrojanDownloader:Win32/Small [Microsoft]Artemis!3CFD2B7E4E53 [McAfee+Artemis]Trojan.Win32.Antavmu.fgy [K7AntiVirus]W32/Antavmu.FGY!tr [Fortinet]Trojan.Antavmu.fgy [CAT-QuickHeal]Trojan.Generic.2552964 [BitDefender]TR/Antavmu.fgy [AntiVir]WORM_AUTORUN.ZDK [TrendMicro]a variant of Win32/Injector.AEX [NOD32]Trojan:Win32/Malex [Microsoft]Heuristic.LooksLike.Win32.Downloader.B [McAfee-GW-Edition]
More aliases (131)

Use SpyHunter to Detect and Remove PC Threats

If you are concerned that malware or PC threats similar to Trojan.Antavmu may have infected your computer, we recommend you start an in-depth system scan with SpyHunter. SpyHunter is an advanced malware protection and remediation application that offers subscribers a comprehensive method for protecting PCs from malware, in addition to providing one-on-one technical support service.

Download SpyHunter's Malware Scanner*

* See Free Trial offer below. EULA and Privacy/Cookie Policy. * See Free Trial offer below. EULA and Privacy/Cookie Policy.

Why can't I open any program including SpyHunter? You may have a malware file running in memory that kills any programs that you try to launch on your PC. Tip: Download SpyHunter from a clean computer, copy it to a USB thumb drive, DVD or CD, then install it on the infected PC and run SpyHunter's malware scanner.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:

csrss.exe

File name: csrss.exe
Size: 74.75 KB (74752 bytes)
MD5: 38622323d37232934d7964c76187149c
Detection count: 94
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: January 8, 2010

file.exe

File name: file.exe
Size: 100.35 KB (100352 bytes)
MD5: ea8633aad53c4284ef1f1c417e9896bd
Detection count: 66
File type: Executable File
Mime Type: unknown/exe
Group: Malware file

%WINDIR%\system32\inetsrv\svchost.exe

File name: svchost.exe
Size: 48.5 KB (48508 bytes)
MD5: fa8657c267567e02a70e8dafa0437519
Detection count: 49
File type: Executable File
Mime Type: unknown/exe
Path: %WINDIR%\system32\inetsrv
Group: Malware file
Last Updated: September 23, 2010

winlogon.exe

File name: winlogon.exe
Size: 69.2 KB (69200 bytes)
MD5: c9f7eb2ef085a6dc3d5835d31142bc27
Detection count: 23
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: January 21, 2010

More files

Trojan.Antavmu.A