VIRUS ALERTS - December 12, 2005

Type
Trojan

Aliases
Backdoor.Win32.Delf.ajn

Troj/KillFil-P is a Trojan for the Windows platform.

When Troj/KillFil-P is installed the following files are created:

<System> \V22005312.EPE
<System> \(E19AD12C-A48F-4D7F-9AE3-00D7249CD16A

http://www.sophos.com/virusinfo/analyses/trojkillfilp.html

Type
Spyware Trojan

Aliases
Trojan-Spy.Win32.Banker.dr

Troj/Banker-IO is an internet banking Trojan.

http://www.sophos.com/virusinfo/analyses/trojbankerio.html

Type
Virus

Aliases
Virus.DOS.Pozor.a
Univ.ow/a

Dopozor-475 is a virus which overwrites the start of all files in the current folder with a copy of itself, destroying the original data.

Dopozor-475 also sets the system date to August 23, 1982.

Dopozor-475 is 16-bit DOS code but will still run on some versions of Windows.

http://www.sophos.com/virusinfo/analyses/dopozor475.html

Type
Trojan

Aliases
Trojan-Downloader.Win32.Agent.dk
Downloader-RR

Troj/DownLdr-RR is a Trojan for the Windows platform.

Troj/DownLdr-RR includes functionality to download, install and run new software.

http://www.sophos.com/virusinfo/analyses/trojdownldrrr.html

Type
Trojan

Aliases
Trojan-Downloader.Win32.Banload.f

Troj/Banload-O is a Trojan for the Windows platform.

Troj/Banload-O includes functionality to access the internet and communicate with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/trojbanloado.html

Type
Trojan

Aliases
Worm.Win32.VB.ar
W32/Downloader.HGY
TROJ_HGY.A

Troj/Dloadr-D is a worm for the Windows platform.

Troj/Dloadr-D includes functionality to download, install and run new software.

http://www.sophos.com/virusinfo/analyses/trojdloadrd.html

Type
Trojan

Aliases
Trojan-Downloader.Win32.VB.ft

Troj/Abox-D is a Trojan for the Windows platform.

When Troj/Abox-D is installed it creates the file <Temp> \ABox.ftp.

This file may be deleted.

Troj/Abox-D includes functionality to silently download, install and run new software.

http://www.sophos.com/virusinfo/analyses/trojaboxd.html

Type
Trojan

Aliases
Trojan-Downloader.Win32.Agent.xa

Troj/Dloade-AAB is a Trojan for the Windows platform.

Troj/Dloade-AAB includes functionality to access the internet and communicate
with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/trojdloadeaab.html

Type
Trojan

Aliases
Trojan-Downloader.Win32.Small.bfy

Troj/Dloade-AAC is a Trojan for the Windows platform.

Troj/Dloade-AAC includes functionality to access the internet and communicate
with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/trojdloadeaac.html

Type
Trojan

Troj/DownLdr-EJ is a downloader Trojan for the Windows platform.

Troj/DownLdr-EJ includes functionality to download, install and run new software.

http://www.sophos.com/virusinfo/analyses/trojdownldrej.html

Type
Trojan

Troj/Dloade-AAD is a Trojan for the Windows platform.

Troj/Dloade-AAD includes functionality to download, install and run new software.

http://www.sophos.com/virusinfo/analyses/trojdloadeaad.html

Type
Worm

Aliases
Backdoor.Win32.Rbot.age
W32/Sdbot.worm.gen.bh

W32/Rbot-BBB is a worm and IRC backdoor Trojan for the Windows platform.

W32/Rbot-BBB runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels.

W32/Rbot-BBB spreads to remote network shares protected by weak passwords and to computers vulnerable to common exploits, including LSASS (MS04-011), RPC-DCOM , (MS04-012), WebDav (MS03-007), IIS5SSL (MS04-011) (CAN-2003-0719), UPNP (MS01-059), Dameware (CAN-2003-1030) and ASN.1 (MS04-007).

http://www.sophos.com/virusinfo/analyses/w32rbotbbb.html

Type
Spyware Trojan

Aliases
Trojan-Spy.Win32.Small.dg
PWS-JA

Troj/Torpig-S is an information stealing Trojan for the Windows platform.

The Trojan attempts to steal passwords, as well as logging keypresses and open window titles to text files and periodically sends the collected information to a remote user via HTTP.

Troj/Torpig-S automatically closes security warning messages displayed by common anti-virus and security related applications.

http://www.sophos.com/virusinfo/analyses/trojtorpigs.html

Type
Trojan

Aliases
Trojan-PSW.Win32.Lmir.aod
PWS-LegMir.dll
PWSteal.Lemir

Troj/LegMir-BW is a Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojlegmirbw.html

Type
Spyware Trojan

Aliases
Trojan-PSW.Win32.Lineage.mu

Troj/Lineage-BU is a password stealing Trojan for the Windows platform.

Troj/Lineage-BU includes functionality to access the internet and communicate with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/trojlineagebu.html

Type
Trojan

Aliases
TROJ_RANKY.HI

Troj/Ranck-DE is a backdoor Trojan which allows a remote intruder to gain access and control over the computer.

http://www.sophos.com/virusinfo/analyses/trojranckde.html

Type
Trojan

Aliases
Trojan-Downloader.Win32.PassAlert.d
StartPage-IC
Download.Trojan

Troj/Dloade-AAI is a Trojan for the Windows platform.

Troj/Dloade-AAI includes functionality to access the internet and communicate with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/trojdloadeaai.html

Type
Trojan

Aliases
Trojan-Downloader.Win32.Banload.lo

Troj/Dloade-AAJ is a Trojan for the Windows platform.

Troj/Dloade-AAJ includes functionality to download, install and run other software.

http://www.sophos.com/virusinfo/analyses/trojdloadeaaj.html

Type
Trojan

Aliases
Backdoor.Win32.GrayBird.ej
BackDoor-ARR.svr

Troj/GrayBrd-A is a Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojgraybrda.html

Type
Trojan

Aliases
Backdoor.Win32.Agent.qn

Troj/Agent-FN is a Trojan for the Windows platform.

Troj/Agent-FN includes functionality to download, install and run new software.

http://www.sophos.com/virusinfo/analyses/trojagentfn.html

Type
Trojan

Aliases
Trojan-Clicker.Win32.VB.ij
Downloader-ACV
Trojan.Popper

Troj/Clicker-AI is a Trojan for the Windows platform.

The Trojan communicates with a remote server via HTTP. Troj/Clicker-AI may download files from a remote site.

http://www.sophos.com/virusinfo/analyses/trojclickerai.html

Type
Trojan

Aliases
Trojan-Downloader.Win32.Agent.uf

Troj/Agent-UF is a Trojan for the Windows platform.

Troj/Agent-UF includes functionality to access the internet and communicate with a remote server via HTTP. It attempts to download and execute further code from predefined websites.

http://www.sophos.com/virusinfo/analyses/trojagentuf.html

Type
Trojan

Aliases
Backdoor.Win32.Agent.qa

Troj/Viran-C is a Trojan for the Windows platform.

Troj/Viran-C includes functionality to access the internet and communicate with a remote server via HTTP.

When first run Troj/Viran-C copies itself to:

<Common Files> \system\lsass.exe
<System> \ctfmon.exe
<System> \userinit.exe

and creates the following files:

<System> \divx5.dll
<System> \h323.txt

The file divx5.dll is detected as Troj/HideProc-K.

http://www.sophos.com/virusinfo/analyses/trojviranc.html

Type Spyware Worm

W32/Sdbot-AGZ is a network worm with backdoor functionality for the Windows platform.

http://www.sophos.com/virusinfo/analyses/w32sdbotagz.html

Type Trojan

Aliases Backdoor.Win32.Prosti.q

Troj/Prosti-Q is a Trojan for the Windows platform.
Troj/Prosti-Q includes functionality to access the internet and communicate with a remote server via HTTP. It attempts to download and execute further code. The Trojan may also allow a remote intruder to perform some backdoor commands.
Troj/Prosti-Q attempts to disable or bypass some security procedures.

http://www.sophos.com/virusinfo/analyses/trojprostiq.html

Type Trojan

Troj/Zlob-S is a Trojan for the Windows platform.
Troj/Zlob-S includes functionality to access and download code from the
Internet.

http://www.sophos.com/virusinfo/analyses/trojzlobs.html

Type Trojan

Troj/Ranck-DJ is a Trojan for the Windows platform.
The Trojan listens on a random port for incoming connections and allows remote attackers the ability to route HTTP traffic through the infected computer.

http://www.sophos.com/virusinfo/analyses/trojranckdj.html

Type Trojan

Aliases Hoax.Win32.Renos.ae
Spyaxe
Trojan.Spaxe

Troj/FakeVir-B is a Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojfakevirb.html

Type Trojan

Aliases Trojan.Win32.Puper.bp
Puper.dll

Troj/Puper-U is a browser hijacking Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojpuperu.html

Type Trojan

Aliases Backdoor.Win32.Hupigon.qo
BackDoor-AWQ.b
Backdoor.Graybird
BKDR_HUPIGON.MO

Troj/GrayBrd-C is a backdoor Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojgraybrdc.html