Hey you,
BE IN THE KNOW!

35,000 ransomware infections per month and you still believe you are protected?

Sign up to receive:

  • alerts
  • news
  • free how-to-remove guides

of the newest online threats - directly to your inbox:


Remove Poshedo Trojan Completely from Your PC

shutterstock_248596792A new downloader type of Trojan has been reported to cause unauthorized downloads on user PCs infecting them with malware. The Trojan.Downloader may use obfuscators to conceal itself from most widespread antivirus software’s real-time protection. You may encounter this Trojan in case you have other malware or adware on your computer. It is strongly recommended to scan for and remove this Trojan if it is residing your computer.

Name Poshedo
Type Trojan.Downloader
Short Description Infects the user PC and connects to third-party hosts to download other files on the infected device.
Symptoms The user may witness all of the symptoms of viruses, adware, spyware, rootkit, ransomware and other malware on his PC. The trojan may not be noticed until its detected via an anti-malware scan.
Distribution Method Via PUPs, installed by bundling (Browser Hijackers) or by visiting a suspicious third-party site that is advertising it.
Detection Tool Download Malware Removal Tool, to See If Your System Has Been Affected by Poshedo
User Experience Join our forum to discuss Poshedo.

Poshedo Trojan – How Did I Get It

This Trojan may be spread via different types of spam emails. They may either resemble a service the user is registered for or mimic a reputable sender or someone from the contact list of the recipient. Symantec researchers have reported that the Trojan may arrive via what appears to be a modified .lnk shortcut. It may be in an archive (.zip, .rar. 7z) and the shortcut may have different names. The most used names by this downloader may contain the following keywords in them:

  • “Order”.
  • “Refund”.
  • “Receipt”.
  • “Product”.
  • “Contract”.

Poshedo Trojan In Detail

Symantec malware researchers have outlined in their report about Poshedo, that once the Trojan is activated it may immediately connect to one of the following hosts:

Directexe(dot)com/Xmm/bb
sjc4911.com/(dot)sql/mike
directexe(dot)com/Xmm/bb
aromkampanya(dot)com/latin/wido
directexe(dot)com/2D2A/bg
secureemail(dot)bz/ink
sjc4911.com/(dot)sql/stanr
nevergreen(dot)net/8
zohaibnadeemgroup(dot)com/pic/harris
messystaging.com/(dot)sql/mike
aromkampanya.com/sumo
tnservice.com(dot)au/isp/ugogene
www.algerie-focus(dot)com/wp-content/uploads/2016/02/01
nevergreen(dot)net/8
directexe(dot)com/2D2A/bg
nevergreen(dot)net/6
online-dropbox(dot)com/online/
droidgraphix(dot)xyz/user02/iptoo
www.amspeconline(dot)com/123/etna
jacoblennox(dot)com/wp-includes/putt
hecforex(dot)info/wp-includes/upd

All users who know how to block these malicious URLs should immediately add them to their blacklist to prevent any intrusions.These and other hosts Poshedo may connect to, might be directly dangerous to your computer because the Trojan may download several types of malware on your computer:

Ransomware – this particular malware activates itself and encrypts your files data, extorting you for money to decrypt them. Examples may be the widespread TeslaCrypt, Locky or Cryptowall 4.0.

Rootkit – this malware type may situate itself on your firmware, and it can only be cleaned via a boot scan with special anti-rootkit tools. Some rootkits are designed to remain on your computer even after a disk wipe.

Adware Viruses – these types of cyber threats contain malicious scripts that give them permissions to fill your computer with various pop-ups, fake antivirus software, and even browser redirects. They may lead to many other infections indirectly.

Killdisk Malware – this type of malware may directly destroy the data on your hard drive, replacing key files with corrupted ones. This results in you immediately losing your data.

Lockscreen Malware – this malware is ransomware, but instead of encrypting your files it may lock your screen and prevent you from accessing your computer. It may be devastating.

RATs (Remote access Trojan) – to best understand this threat imagine that the cyber-criminal has a remote control for your computer and can see everything you’re doing at any point in time. This includes keylogging your passwords while you are typing them, taking screenshots and other malicious deeds of the type.

These and other potential threats exist out there, and this Trojan may be the malware used to download them on your computer.

Remove Poshedo Trojan Completely

This cyber-threat may have already been removed by your anti-malware or antivirus program. However, it may lead to other malware, and this is why we advise following the step-by-step instructions outlined below to successfully be rid of this other malware that may be currently residing on your personal computer.

1. Boot Your PC In Safe Mode to isolate and remove Poshedo
2. Remove Poshedo with SpyHunter Anti-Malware Tool
3. Back up your data to secure it against infections by Poshedo in the future
Optional: Using Alternative Anti-Malware Tools

Vencislav Krustev

A network administrator and malware researcher at SensorsTechForum with passion for discovery of new shifts and innovations in cyber security. Strong believer in basic education of every user towards online safety.

More Posts - Website

Share on Facebook Share
Loading...
Share on Twitter Tweet
Loading...
Share on Google Plus Share
Loading...
Share on Linkedin Share
Loading...
Share on Digg Share
Share on Reddit Share
Loading...
Share on Stumbleupon Share
Loading...
Please wait...

Subscribe to our newsletter

Want to be notified when our article is published? Enter your email address and name below to be the first to know.