VIRUS ALERTS - August 3, 2005

Aliases
Trojan.Win32.Dialer.jw
TROJ_SMALL.APA
Dialer-496

Type Trojan

Dial/Eocha-A is a dialer application for accessing pornographic material.
When first run Dial/Eocha-A copies itself to the Desktop and User folders.
Dial/Eocha-A changes the Start Page and security settings for Microsoft Internet Explorer

http://www.sophos.com/virusinfo/analyses/dialeochaa.html

Aliases
Net-Worm.Win32.Bobic.d
W32.Bobax.worm.gen


Type Virus

W32/Bobax-P is a virus and backdoor for the Windows platform.
W32/Bobax-P communicates with a remote server which will instruct it to perform specific actions.
http://www.sophos.com/virusinfo/analyses/w32bobaxp.html

Aliases
Net-Worm.Win32.Bobic.d
W32.Bobax.worm.gen


Type Virus

W32/Bobax-Q is a virus and backdoor for the Windows platform.
W32/Bobax-Q communicates with a remote server which will instruct it to perform specific actions.


http://www.sophos.com/virusinfo/analyses/w32bobaxq.html

Aliases Trojan-Downloader.Win32.Agent.bq

Type Trojan

Troj/SpyDldr-B is an advertising Trojan with downloading functionality.
Troj/SpyDldr-B periodically displays the following messages:
WARNING: Windows Firewall detected suspicious network activity on your computer. Malicious software codes try to steal your privacy information, such as credit card numbers, electronic mail accounts, financial data or passwords.
Do you want to learn how to protect your computer?
Your computer might be at risk
Your virus protection status is bad
Spyware Activity Detected
Click this balloon to fix this problem
Clicking on the messages opens a browser window on a page advertising anti-spyware software.
The Trojan attempts to download and run further Trojan files.

http://www.sophos.com/virusinfo/analyses/trojspydldrb.html

Aliases
WORM_MYTOB.IX
W32.Mytob.AG@mm

Type Spyware Worm


W32/Mytob-KC is a mass-mailing worm and backdoor Trojan that can be controlled through the Internet Relay Chat (IRC) network.
W32/Mytob-KC is capable of spreading through email and through various operating system vulnerabilities such as LSASS. Email sent by W32/Mytob-KC has the following properties:
Subject line:
document
Good day
Hello
Mail Delivery System
Mail Transaction Failed
message
readme
Server Report
Status
Message text:
'This is a multi-part message in MIME format.'
'Mail transaction failed. Partial message is available.'
'The message contains Unicode characters and has been sent as a binary attachment.'
'The message cannot be represented in 7-bit ASCII encoding and has been sent as a binary attachment.'
'The original message was included as an attachment.'
'Here are your banks documents.'
The attached file consists of a base name followed by the extentions PIF, SCR, EXE or ZIP. The worm may optionally create double extensions where the first extension is DOC, TXT or HTM and the final extension is PIF, SCR, EXE or ZIP.
A patch for the vulnerability exploited by W32/Mytob-KC is available from Microsoft at

http://www.microsoft.com/technet/security/bulletin/ms04-011.mspx

Sophos's anti-virus products include Genotype? detection technology, which can proactively protect against new threats without requiring an update. Sophos customers have been protected against W32/Mytob-KC (detected as W32/Mytob-Fam) since version 3.94.

http://www.sophos.com/virusinfo/analyses/w32mytobkc.html

Aliases
Net-Worm.Win32.Bobic.d
W32.Bobax.Z@mm
W32.Proxed

Type Virus

W32/Bobax-N is an email virus for the Windows platform.
W32/Bobax-N has the ability to infect executable files.
W32/Bobax-N can send itself to email addresses harvested from the infected computer.
W32/Bobax-N attempts to contact a number of preconfigured internet sites in order to report successful infection.
Emails sent by the worm have the following characteristics:
Subject line:
Cool
Captured..
He has been captured..
Finally! Captured
Finally
God Bless the USA!
Message text (chosen from):
Saddam Hussein - Attempted Escape, Shot dead
Attached some pics that i found
Osama Bin Laden Captured.
Attached some pics that i found
Testing
Secret!
Hey,
Remember this?
Hello,
Long time! Check this out!
Hey,
I was going through my album, and look what I found..
Hey,
Check this out
+++ Attachment: No Virus found
+++ Panda AntiVirus - You are protected
+++ www.pandasoftware.com
+++ Attachment: No Virus found
+++ Norman AntiVirus - You are protected
+++ www.norman.com
+++ Attachment: No Virus found
+++ F-Secure AntiVirus - You are protected
+++ www.f-secure.com
+++ Attachment: No Virus found
+++ Norton AntiVirus - You are protected
+++ www.symantec.com
"Turn on your TV.
Osama Bin Laden has been captured.
While CNN has no pictures at this point of time, the military channel (PPV) rele
ased some pictures.
I managed to capture a couple of these pictures off my TV.
Ive attached a slideshow containing all the pictures I managed to capture.
I apologize for the low quality, its the best I could do at this point of time.
Hopefully CNN will have pictures and a video soon.
God bless the USA!"
Possible attached filename stubs:
pics
funny
bush
joke
secret
Possible attached file extensions:
pif
exe
scr
zip
W32/Bobax-N also attempts to disable the Windows firewall and attempts to suppress Windows security warnings.

http://www.sophos.com/virusinfo/analyses/w32bobaxn.html

Aliases W32/VB.MF

Type Trojan

Troj/Angelfre-D is an IRC backdoor Trojan which allows unauthorized access and control over the computer via IRC channels.

http://www.sophos.com/virusinfo/analyses/trojangelfred.html

Aliases Backdoor.Win32.Aimbot.g

Type Worm

W32/Oscabot-M is an instant messaging worm that can exploit users of AOL Instant Messaging clients.
W32/Oscabot-M connects to a specific channel on an IRC service and waits for a remote attacker to instruct the worm to send messages to contacts in the infected users AOL contacts list. The message will read:
"Tell me this isn't you!".
The word "this" is a link to the W32/Oscabot-M executable on the infected computer.

http://www.sophos.com/virusinfo/analyses/w32oscabotm.html

Aliases Trojan-Downloader.Win32.Murlo.s

Type Trojan

Troj/Winad-K is a downloader Trojan for the Windows platform. Troj/Winad-K will download files from a remote URL.

http://www.sophos.com/virusinfo/analyses/trojwinadk.html

Aliases
Keylog-CN
BackDoor-AWQ.b.dll.gen

Type Spyware Trojan


Troj/Feutel-P is a backdoor Trojan which allows a remote intruder to gain access and control over the computer. It can provide keylogging functionality and steal other information about the host.

http://www.sophos.com/virusinfo/analyses/trojfeutelp.html

Aliases
Backdoor.Win32.SdBot.xd
WORM_SDBOT.BGE

Type Worm

W32/Sdbot-ABE is a worm and IRC backdoor Trojan for the Windows platform.
W32/Sdbot-ABE also drops Troj/Rootkit-W.

http://www.sophos.com/virusinfo/analyses/w32sdbotabe.html

Aliases Trojan.W32.Pigeon-4

Type Spyware Trojan

Troj/Feutel-O is a Trojan which attempts to log key strokes.

http://www.sophos.com/virusinfo/analyses/trojfeutelo.html

Aliases
Trojan-Downloader.Win32.Agent.jt
Downloader-NZ.dll
TROJ_AGENT.UG

Type Trojan

Troj/BMInst-A is a downloader Trojan which downloads and executes an EXE from a remote URL.

http://www.sophos.com/virusinfo/analyses/trojbminsta.html

Aliases Trojan-Downloader.Win32.Dadobra.df

Type Spyware Trojan

Troj/Dadobra-DF is a downloader Trojan for the Windows platform.
Troj/Dadobra-DF includes functionality to capture keystrokes, send email, display bitmap images, access the internet and communicate with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/trojdadobradf.html

Aliases Trojan-Downloader.Win32.Small.avo

Type Trojan

Troj/Dloader-RN is a downloader Trojan for the Windows platform. The Trojan downloads and executes a file from a preconfigured FTP server.

http://www.sophos.com/virusinfo/analyses/trojdloaderrn.html

Aliases
SpamTool.Win32.Delf.h
Spam-SPM
TROJ_DONBOMB.A

Type Trojan

Troj/Spexta-A is a Trojan for the Windows platform.
Troj/Spexta-A may be used to send out spam emails to addresses harvested from the infected system. The Trojan may also download and run further malicious code.
Troj/Spexta-A may arrive as an email attachment in emails claiming to be from "CNN Newsletter" with subject line "TERROR HITS LONDON". The Trojan is included as an attachment with filename "LondonTerrorMovie.zip".

http://www.sophos.com/virusinfo/analyses/trojspextaa.html

Aliases BKDR_RANKY.CM

Type Trojan

Troj/Ranck-CT is a backdoor Trojan that allows a remote intruder to route HTTP traffic through the infected computer.
Troj/Ranck-CT, when run, listens on a randomly chosen TCP port.

http://www.sophos.com/virusinfo/analyses/trojranckct.html

Aliases
W32/Legendmir.AMJ@pws
TROJ_LEGMIR.CT
Trojan-PSW.Win32.Lmir.agn
Trojan.Lmir-111
PWS-LegMir.gen

Type Spyware Trojan

Troj/LegMir-AM is a password-stealing Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojlegmiram.html

Aliases
Trojan-Downloader.Win32.Delf.cq
Trojan.Downloader.Delph.CQ
Downloader-QF

Type Trojan


Troj/Delf-KS is a downloading Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojdelfks.html

Aliases
QLowZones-7.gen
StartPage-FI
TROJ_DELF.JW

Type Trojan

Troj/QLowZon-A is a Trojan that changes Internet Explorer settings.

http://www.sophos.com/virusinfo/analyses/trojqlowzona.html

Type Spyware Trojan

Troj/Blacklog-A is a keylogger Trojan for the Windows platform.
Troj/Blacklog-A displays a fake error message with the title "KB826929 Setup Error" and the text "Setup cannot update your Windows files because the language installed on your system is different from the update language."
The Trojan may inject itself into the explorer process or register itself as a service process in order to prevent itself from being terminated.
Troj/Blacklog-A records keystrokes to the file servms.dll in the Windows system folder. When this file becomes larger than 30kb, its contents are submitted to the author by email. The file servms.dll may be deleted.

http://www.sophos.com/virusinfo/analyses/trojblackloga.html

Aliases Backdoor.Win32.Rbot.uj

Type Spyware Worm

W32/Monkbd-A is a keylogger and backdoor worm which allows a remote intruder to gain access and control over the computer via IRC channels.
W32/Monkbd-A includes functionality to:
- steal computer information
- log keystrokes and send them to a remote location
W32/Monkbd-A may also attempt to copy itself to network shares.

http://www.sophos.com/virusinfo/analyses/w32monkbda.html

Aliases
Trojan-Dropper.Win32.VB.ga
Hacktool
TROJ_DLOADER.KK

Type Trojan

Troj/IWDL-A is a Trojan creator for the Windows platform.
Files created by Troj/IWDL-A are detected by Sophos's anti-virus products as Troj/Dloader-PO.

http://www.sophos.com/virusinfo/analyses/trojiwdla.html

Aliases
Trojan.Win32.Agent.bi
TROJ_AGENT.SH

Type Trojan

Troj/Iefeat-AK is a Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojiefeatak.html

Aliases
Trojan-PSW.Win32.QQShou.i
PWS-QQPass
Trojan.PWS.QQPass

Type Spyware Trojan

Troj/QQPass-I is a password-stealing Trojan for the Windows platform.
Troj/QQPass-I sends stolen details to a pre-specified email address.

http://www.sophos.com/virusinfo/analyses/trojqqpassi.html

Aliases Trojan-Downloader.Win32.VB.kh

Type Trojan

Troj/QQLoad-A is a downloader Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojqqloada.html