Home Malware Programs Trojans Trojan.Pushdo

Trojan.Pushdo

Posted: July 24, 2009

Threat Metric

Threat Level: 8/10
Infected PCs: 80
First Seen: July 24, 2009
Last Seen: January 20, 2021
OS(es) Affected: Windows

The Pushdo Trojan is a Trojan downloader that is largely affiliated with the Cutwail family of spambots, although the Pushdo Trojan also may be used to download and install other types of PC threats with a minimum of reconfiguration required. The Pushdo Trojan's distribution strategy utilizes, predictably, spam e-mail messages that include malicious links or file attachments. SpywareRemove.com malware experts estimate that some of the Pushdo Trojan's attacks are targeted at specific entities, based on the confirmed presence of the Pushdo Trojan and Cutwail infections on military and US government contractor networks. With the Pushdo Trojan's numbers only rising by the thousands each day, all due precautions should be taken against any likely infection vectors, and you should act to remove the Pushdo Trojan and its payloads with appropriate anti-malware software as needed.

Pushdo Trojan: Pushing Your PC Safety Right Out the Door

The Pushdo Trojan can refer to any of several variants of Pushdo, all of which include functions that allow them to bring inside and install other threats onto your machine without your permission. Payloads traditionally associated with the Pushdo Trojan, particularly in 2013, include members of the Cutwail family; SpywareRemove.com malware experts warn that recent payloads involving the Pushdo Trojan often have been known to use rootkit-level techniques for concealing themselves from various security tools.

The Cutwail family prefers to use spam e-mail botnets for distribution, and PCs that are infected by members of this family are at risk of being forced to propagate Cutwail and the Pushdo Trojan through automated spamming attacks. In some cases, any e-mail addresses that are accessible through such sources as your address book may automatically be targeted by these attacks. SpywareRemove.com malware experts also have seen the Pushdo Trojan involved in:

  • Browser redirects to Pay-Per-Click or PPC advertising content.
  • Attempts to circumvent some basic web-based security features, such as CAPTCHA systems.
  • The installation of rootkits and other high-level PC threats that use advanced methods of avoiding being detected and launching themselves automatically.

Keeping Pushdo Trojan Down Before It Drags You to a Web of Spam

Since the Pushdo Trojan uses an algorithm for the purpose of generating backup Command & Control servers, the Pushdo Trojan's attacks and its associated Cutwail botnet are expandable almost indefinitely. Additionally, current rates of infections involving the Pushdo Trojan are climbing steadily and include targets in sensitive locations, such as certain US government institutions. The robust nature of the Pushdo Trojan's attacks, as well as its definitive links to related PC threats, cause SpywareRemove.com malware researchers to recommend using only highly advanced, accurate and updated anti-malware tools to detect and remove a Pushdo Trojan infection.

While a typical Pushdo Trojan infection shows no obvious symptoms, SpywareRemove.com malware experts can recommend preemptive security steps, such as caution over unusual e-mail content, to stop a Pushdo Trojan attack before it starts. Even in cases where an e-mail seems to be sent from a trusted source, you may wish to verify that the source hasn't been compromised before you open any unusual link or file attachment that may be carrying a Pushdo Trojan – particularly if you're a government employee. Top countries suffering from the Pushdo Trojan campaigns so far include Mexico, Iran and India.

Aliases

Trj/Buzus.AH [Panda]Downloader.Generic9.CAJJ [AVG]W32/Injector.fam!tr [Fortinet]Virus.Win32.Dracur [Ikarus]Trojan.Win32.Pilleuz.a (v) [Sunbelt]Win-Trojan/Buzus.42496.BQ [AhnLab-V3]TrojanDownloader:Win32/Pushbot.A [Microsoft]Trojan/Win32.Buzus.gen [Antiy-AVL]Heuristic.BehavesLike.Win32.CodeInjection.H [McAfee-GW-Edition]TR/Spy.42496.43 [AntiVir]Trojan.MulDrop.origin [DrWeb]TrojWare.Win32.Agent.~GGI [Comodo]W32/Autorun-BBI [Sophos]Gen:Trojan.Heur.cGW@tzen8Qh [BitDefender]Trojan.Win32.Buzus.eggh [Kaspersky]
More aliases (30)
Loading...