VIRUS ALERTS - December 10, 2005

Type
Spyware Trojan

Aliases
Trojan-PSW.Win32.LdPinch.vr

Troj/LdPinch-CI is an information stealing Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojldpinchci.html

Type
Spyware Trojan

Aliases
Trojan-Spy.Win32.Banker.ahy

Troj/Bancban-KJ is a Trojan for the Windows platform.

Troj/Bancban-KJ attempts to log information sent to certain websites and online banking applications. The Trojan may display fake user interfaces in order to persuade the user to enter confidential details. Stolen information is sent by email to a remote user.

http://www.sophos.com/virusinfo/analyses/trojbancbankj.html

Type
Spyware Trojan

Aliases
Trojan-Spy.Win32.Banker.ym

Troj/Banklis-A is a Trojan for the Windows platform.

The Trojan monitors internet sessions and steals login credentials when certain banking sites are visited.

http://www.sophos.com/virusinfo/analyses/trojbanklisa.html

Type
Spyware Trojan

Aliases
BackDoor-CSN

Troj/BanBot-A is a backdoor Trojan for the Windows platform.

Troj/BanBot-A can receive commands from a remote intruder to send and receive files remotely, execute code, delete files, steal passwords and hijack the mouse and keyboard.

http://www.sophos.com/virusinfo/analyses/trojbanbota.html

Type
Trojan

Aliases
Trojan.Win32.DNSChanger.aa
DNSChanger.a

Troj/DNSBust-D is a Trojan for the Windows platform.

Troj/DNSBust-D includes functionality to access the internet and communicate with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/trojdnsbustd.html

Type
Worm

W32/Sdbot-AGB is a worm and IRC backdoor Trojan for the Windows platform.

W32/Sdbot-AGB runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels.

http://www.sophos.com/virusinfo/analyses/w32sdbotagb.html

Type
Worm

Aliases
WORM_RBOT.DAT

W32/Rbot-BAP is a worm and IRC backdoor Trojan for the Windows platform.

W32/Rbot-BAP spreads:

- to other network computers infected with: Troj/Kuang, W32/Sasser, Troj/NetDevil, W32/MyDoom, W32/Bagle and Troj/Optix
- to other network computers by exploiting common buffer overflow vulnerabilities, including: LSASS (MS04-011), RPC-DCOM (MS04-012), WKS (MS03-049) (CAN-2003-0812), WebDav (MS03-007), UPNP (MS01-059), WINS (MS04-045), Dameware (CAN-2003-1030) and MSSQL (MS02-039) (CAN-2002-0649)
- by copying itself to network shares protected by weak passwords

W32/Rbot-BAP runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels.

http://www.sophos.com/virusinfo/analyses/w32rbotbap.html

Type
Worm

Aliases
Backdoor.Win32.Rbot.abl

W32/Rbot-BAQ is a worm and backdoor Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/w32rbotbaq.html

Type
Worm

W32/Rbot-BAT is a worm and IRC backdoor Trojan for the Windows platform.

W32/Rbot-BAT spreads:

- to other network computers infected with: Troj/Kuang, Troj/Sub7, Troj/NetDevil, W32/MyDoom, W32/Bagle and Troj/Optix
- to other network computers by exploiting common buffer overflow vulnerabilities, including: LSASS (MS04-011), RPC-DCOM (MS04-012), WebDav (MS03-007) and Dameware (CAN-2003-1030)
- to other network computers running MSSQL servers protected by weak passwords
- by copying itself to network shares protected by weak passwords

W32/Rbot-BAT runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels.

http://www.sophos.com/virusinfo/analyses/w32rbotbat.html

Type
Worm

W32/Rbot-BAV is a worm and IRC backdoor Trojan for the Windows platform.

W32/Rbot-BAV spreads to other network computers by exploiting common buffer overflow vulnerabilities, including: LSASS (MS04-011), RPC-DCOM (MS04-012), WKS (MS03-049) (CAN-2003-0812), Veritas (CAN-2004-1172), MSSQL (MS02-039) (CAN-2002-0649) and ASN.1 (MS04-007) and by copying itself to network shares protected by weak passwords.

W32/Rbot-BAV runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels.

http://www.sophos.com/virusinfo/analyses/w32rbotbav.html

Type
Worm

W32/Rbot-BAW is a network worm for the Windows platform.

W32/Rbot-BAW spreads:

- to other network computers by exploiting common buffer overflow vulnerabilities, including: LSASS (MS04-011), RPC-DCOM (MS04-012), WKS (MS03-049) (CAN-2003-0812), Veritas (CAN-2004-1172), MSSQL (MS02-039) (CAN-2002-0649), PNP (MS05-039), IMAIL Server and ASN.1 (MS04-007)
- via the MSN, Yahoo and AOL Instant Messenger programs
- to other network computers running MSSQL servers protected by weak passwords
- by copying itself to network shares protected by weak passwords.

W32/Rbot-BAW runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels.

http://www.sophos.com/virusinfo/analyses/w32rbotbaw.html

Type
Worm

W32/Rbot-BAX is a worm and IRC backdoor Trojan for the Windows platform.

W32/Rbot-BAX spreads:

- to other network computers infected with Troj/Optix
- to other network computers by exploiting common buffer overflow vulnerabilities, including: LSASS (MS04-011) and RPC-DCOM (MS04-012)
- by copying itself to network shares protected by weak passwords

W32/Rbot-BAX runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels.

http://www.sophos.com/virusinfo/analyses/w32rbotbax.html

Type
Worm

Aliases
Backdoor.Win32.Rbot.adf

W32/Rbot-BAY is a worm and IRC backdoor Trojan for the Windows platform.

W32/Rbot-BAY spreads:

- to other network computers infected with: Troj/Kuang, Troj/Sub7, Troj/NetDevil, W32/MyDoom, W32/Bagle and Troj/Optix
- to other network computers by exploiting common buffer overflow vulnerabilities, including: LSASS (MS04-011), RPC-DCOM (MS04-012), WKS (MS03-049) (CAN-2003-0812), WebDav (MS03-007), IIS5SSL (MS04-011) (CAN-2003-0719), UPNP (MS01-059), Veritas (CAN-2004-1172), Dameware (CAN-2003-1030) and ASN.1 (MS04-007)
- by copying itself to network shares protected by weak passwords

W32/Rbot-BAY runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels.

http://www.sophos.com/virusinfo/analyses/w32rbotbay.html

Type
Worm

Aliases
Backdoor.Win32.Agobot.gen
W32/Gaobot.worm.gen.d
Win32/Agobot.NGJ
W32.Gaobot.ALV
WORM_AGOBOT.TS

W32/Agobot-UJ is a worm and IRC backdoor Trojan for the Windows platform.

W32/Agobot-UJ spreads to other network computers by exploiting common buffer overflow vulnerabilities, including: RPC-DCOM (MS04-012), WKS (MS03-049) (CAN-2003-0812) and WebDav (MS03-007) and by copying itself to network shares protected by weak passwords.

W32/Agobot-UJ runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels.

When first run W32/Agobot-UJ copies itself to the %CurrentFolder%\ folder and to:

&ltSystem> \svchostt.exe
&ltSystem> \svchostt.exe.poly
&ltSystem> \winhlpp32.exe

http://www.sophos.com/virusinfo/analyses/w32agobotuj.html

Type
Trojan

Aliases
Trojan-Dropper.Win32.Delf.ev
Downloader.ab
Trojan.Dropper
TROJ_DELF.EV

Troj/Dloade-AAH is a Trojan for the Windows platform.

Troj/Dloade-AAH includes functionality to download, install and run new software.

When Troj/Dloade-AAH is installed the following files are created:

&ltTemp> \atiupdate.exe
&ltSystem> \msshed32.exe

http://www.sophos.com/virusinfo/analyses/trojdloadeaah.html

Type
Trojan

Aliases
Trojan-Dropper.Win32.ExeBundle.286

Troj/ExeBund-C is a multidropper Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojexebundc.html

Type
Trojan

Aliases
Trojan-Downloader.Win32.Small.bsi

Troj/Dloadr-ABO is a Trojan for the Windows platform.

Troj/Dloadr-ABO includes functionality to download, install and run new software.

http://www.sophos.com/virusinfo/analyses/trojdloadrabo.html

Type
Trojan

Aliases
Trojan-Downloader.Win32.Banload.kf

Troj/Banload-KF is a Trojan for the Windows platform.

Troj/Banload-KF includes functionality to download, install and run new software.

http://www.sophos.com/virusinfo/analyses/trojbanloadfk.html

Type
Spyware Trojan

Aliases
Trojan-Spy.Win32.Banbra.df
PWS-Banker.gen.ba
PWSteal.Banpaes

Troj/Bancban-LC is a password stealing Trojan for the Windows platform.

Troj/Bancban-LC includes functionality to access the internet and communicate with a remote server via HTTP.

Troj/Bancban-LC targets the customers of certain Brazilian online banking websites by attempting to steal account details.

http://www.sophos.com/virusinfo/analyses/trojbancbanlc.html

Type
Trojan

Aliases
Trojan-Proxy.Win32.Cimuz.bz

Troj/Cimuz-O includes functionality to access the internet and communicate with a remote server via HTTP.

Troj/Cimuz-O acts as a proxy server, and may download and execute remote files.

http://www.sophos.com/virusinfo/analyses/trojcimuzo.html

Type
Trojan

Troj/Asune-A is a Trojan for the Windows platform.

Troj/Asune-A includes functionality to access the internet and communicate with a remote server via HTTP. The

Torjan attempts to download and execute code.

Troj/Asune-A also launches Windows Notepad.

http://www.sophos.com/virusinfo/analyses/trojasunea.html

Type
Trojan

Aliases
Trojan-Downloader.Win32.VB.pa
PWS-Banker.dldr
TROJ_DLOADER.ASK

Troj/Dloadr-ABN is a Trojan for the Windows platform.

When run, Troj/Dloadr-ABN copies itself to &ltSystem> \ios.exe.

http://www.sophos.com/virusinfo/analyses/trojdloadrabn.html

Type
Trojan

Aliases
IM-Worm.Win32.Kelvir.bq
W32/Kelvir.worm.gc
W32.Kelvir.JJ
WORM_KELVIR.CY

W32/Kelvir-BQ is a worm for the Windows platform.

W32/Kelvir-BQ attempts to spread via MSN messenger.

http://www.sophos.com/virusinfo/analyses/w32kelvirbq.html