VIRUS ALERTS - December 13, 2005

Type
Worm

Aliases
Backdoor.Win32.IRCBot.es
WORM_IRCBOT.CM

W32/Cuebot-I is a worm for the Windows platform.

W32/Cuebot-I spreads to other network computers by exploiting common buffer overflow vulnerabilities, including PNP (MS05-039).

Sophos's anti-virus products include Genotype? detection technology, which can proactively protect against new threats without requiring an update. Sophos customers have been protected against W32/Cuebot-I (detected as W32/Cuebot-Gen) since version 3.98.

http://www.sophos.com/virusinfo/analyses/w32cueboti.html

Type
Spyware Trojan

Aliases
Backdoor.IRC.Zapchast
IRC/Flood.mirc

Troj/Zapchas-AE is a Trojan for the Windows platform.

The Trojan utilizes the legitimate IRC client "mIRC" along with malicious configuration scripts to serve as a backdoor on infected computers.

http://www.sophos.com/virusinfo/analyses/trojzapchasae.html

Type
Trojan

Aliases
Trojan-Proxy.Win32.Ranky.db
Proxy-FBSR
TROJ_RANKY.HM

Troj/Ranck-DH is a proxy Trojan that allows a remote attacker to route internet traffic through the infected computer.

http://www.sophos.com/virusinfo/analyses/trojranckdh.html

Type
Worm

Aliases
Backdoor.Win32.SdBot.aad

W32/Tilebot-CE is a worm and backdoor Trojan for the Windows platform.

W32/Tilebot-CE spreads to other network computers by exploiting common buffer overflow vulnerabilities, including: LSASS (MS04-011), RPC-DCOM (MS04-012), PNP (MS05-039) and ASN.1 (MS04-007).

http://www.sophos.com/virusinfo/analyses/w32tilebotce.html

Type
Spyware Trojan

Aliases
TSPY_QQROB.CB
Trojan-Downloader.Win32.Delf.acv

Troj/QQRob-AO is a downloader Trojan for the Windows platform.

Troj/QQRob-AO includes functionality to capture keystokes, download, install and run new software.

http://www.sophos.com/virusinfo/analyses/trojqqrobao.html

Type
Trojan

Aliases
DNSChanger.a

Troj/DNSChan-B is a Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojdnschanb.html

Type
Trojan

Aliases
Trojan.Win32.Small.ga

Troj/Small-EZ is a Trojan for the Windows platform.

Troj/Small-EZ has the functionality to move application windows and display text at random intervals.

http://www.sophos.com/virusinfo/analyses/trojsmallez.html

Type
Worm

Aliases
Backdoor.Win32.Rbot.aju
W32/Sdbot.worm.gen.bh

W32/Rbot-BBJ is a worm and IRC backdoor Trojan for the Windows platform.

W32/Rbot-BBJ spreads:

- to other network computers infected with: Troj/Kuang, Troj/Sub7, Troj/NetDevil, W32/MyDoom, W32/Bagle and Troj/Optix
- to other network computers by exploiting common buffer overflow vulnerabilities, including: LSASS (MS04-011), RPC-DCOM (MS04-012), WKS (MS03-049) (CAN-2003-0812), WebDav (MS03-007), IIS5SSL (MS04-011) (CAN-2003-0719), UPNP (MS01-059), Veritas (CAN-2004-1172), Dameware (CAN-2003-1030) and ASN.1 (MS04-007)
- by copying itself to network shares protected by weak passwords

W32/Rbot-BBJ runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels.

http://www.sophos.com/virusinfo/analyses/w32rbotbbj.html

Type
Worm

Aliases
Backdoor.Win32.Rbot.aie

W32/Rbot-BBK is a worm and IRC backdoor Trojan for the Windows platform.

W32/Rbot-BBK spreads:

- to other network computers infected with: Troj/Kuang, Troj/Sub7, Troj/NetDevil, W32/MyDoom, W32/Bagle and Troj/Optix
- to other network computers by exploiting common buffer overflow vulnerabilities, including: LSASS (MS04-011), RPC-DCOM (MS04-012), WKS (MS03-049) (CAN-2003-0812), WebDav (MS03-007), IIS5SSL (MS04-011) (CAN-2003-0719), UPNP (MS01-059), Veritas (CAN-2004-1172), Dameware (CAN-2003-1030), PNP (MS05-039) and ASN.1 (MS04-007)
- by copying itself to network shares protected by weak passwords

W32/Rbot-BBK runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels.

http://www.sophos.com/virusinfo/analyses/w32rbotbbk.html

Type
Worm

W32/Rbot-BBL is a worm and IRC backdoor Trojan for the Windows platform.

W32/Rbot-BBL runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels.

http://www.sophos.com/virusinfo/analyses/w32rbotbbl.html

Type
Spyware Trojan

Aliases
Trojan-Spy.Win32.Banbra.df
PWS-Banker.gen.b
TSPY_BANKER.AUM

Troj/Bancban-LG is an Internet Banking Trojan for the Windows platform.

Troj/Bancban-LG includes functionality to access the internet and communicate with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/trojbancbanlg.html

Type
Worm

W32/Rbot-BBM is a worm and IRC backdoor Trojan for the Windows platform.

W32/Rbot-BBM runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels.

http://www.sophos.com/virusinfo/analyses/w32rbotbbm.html

Type
Worm

W32/Rbot-BBN is a worm and IRC backdoor Trojan for the Windows platform.

W32/Rbot-BBN runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels.

http://www.sophos.com/virusinfo/analyses/w32rbotbbn.html

Type
Trojan

Aliases
Trojan-Downloader.Win32.Banload.lx

Troj/BankDl-Z is a downloading Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojbankdlz.html

Type
Trojan

Aliases
Trojan-Downloader.Win32.Agent.fk

Troj/Dloadr-ABP is a Trojan for the Windows platform.

Troj/Dloadr-ABP has the functionality to communicate with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/trojdloadrabp.html

Type
Trojan

Aliases
Email-Worm.Win32.Bagle.pac
W32/Bagle.gen

Troj/BagleDl-AM is a Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojbagledlam.html

Type
Trojan

Aliases
Trojan-Spy.Win32.Delf.ld
TSPY_DELF.BK

Troj/QQRob-AD is a Trojan for the Windows platform.

Troj/QQRob-AD includes functionality to access the internet and communicate with a remote server via HTTP.

Troj/QQRob-AD may attempt to turn off various Anti-Virus and security related services in an attempt to stay undetected.

http://www.sophos.com/virusinfo/analyses/trojqqrobad.html

Type
Spyware Trojan

Troj/QQPass-FC is a Trojan for the Windows platform.

The Trojan steals passwords and sends stolen credentials to a remote user via email.

http://www.sophos.com/virusinfo/analyses/trojqqpassfc.html

Type
Trojan

Aliases
Backdoor.Win32.Dumador.cx

Troj/Dumador-CZ is a Trojan for the Windows platform.

Troj/Dumador-CZ includes functionality to access the internet and communicate with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/trojdumadorcz.html

Type
Worm

Aliases
W32/Generic.d

W32/Style-A is a P2P worm for the Windows platform.

W32/Style-A copies itself to the floppy drive and folders likely to be shared by P2P applications.

W32/Style-A changes several registry entries in order to make the infected computer unusable.

http://www.sophos.com/virusinfo/analyses/w32stylea.html

Type
Trojan

Aliases
Trojan-Downloader.Win32.Agent.zd

Troj/Small-FA is a Trojan for the Windows platform.

Troj/Small-FA includes functionality to access the internet and communicate with a remote server via HTTP.

When Troj/Small-FA is installed it creates the file <Windows> \volumeco.exe.

http://www.sophos.com/virusinfo/analyses/trojsmallfa.html

Type
Trojan

Aliases
Trojan-PSW.Win32.Lmir.alf
PWS-LegMir.dll

Troj/LegMir-BX is a Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojlegmirbx.html

Type
Trojan

Aliases
Trojan-Dropper.Win32.Agent.jm

Troj/Agent-FP is a Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojagentfp.html

Type
Trojan

Aliases
Trojan-Downloader.Win32.Agent.aap
Downloader-AFM

Troj/Dloadr-ABQ is a Trojan for the Windows platform.

Troj/Dloadr-ABQ includes functionality to download, install and run new software.

http://www.sophos.com/virusinfo/analyses/trojdloadrabq.html

Type
Trojan

Aliases
Backdoor.Win32.Hupigon.ri

Troj/GrayBrd-D is a Trojan for the Windows platform.

Troj/GrayBrd-D includes functionality to access the internet and communicate with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/trojgraybrdd.html

Type
Trojan

Aliases
Trojan-Downloader.BAT.Ftp.bs

Troj/Downldr-EN is a Trojan for the Windows platform.

When Troj/Downldr-EN is installed it creates the file \%CurrentFolder%\o.

http://www.sophos.com/virusinfo/analyses/trojdownldren.html

Type
Trojan

Aliases
Hoax.Win32.SpyWare.a
AdClicker-AJ

Troj/Clicker-AJ is a Trojan for the Windows platform.

Troj/Clicker-AJ displays a fake warning message informing the user of a computer
that it is infected. The user is then encouraged to click on a button, which
will result in a website being opened that sells a product purported to remove
the infection.

http://www.sophos.com/virusinfo/analyses/trojclickeraj.html

Type
Spyware Trojan

Aliases
Trojan-Spy.Win32.Banker.ahy

Troj/Bancban-LH is an internet banking Trojan.

Troj/Bancban-LH includes functionality to send notification messages to remote locations.

http://www.sophos.com/virusinfo/analyses/trojbancbanlh.html

Type
Trojan

Troj/BankDl-AA is a downloading Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojbankdlaa.html

Type
Trojan

Aliases
Backdoor.Win32.GrayBird.eq
Backdoor.Graybird
BKDR_GRAYBIRD.EV
BackDoor-AWQ.b

Troj/GrayBrd-E is a backdoor Trojan which allows a remote intruder to gain access and control over the computer.

Troj/GrayBrd-E includes functionality to access the internet and communicate with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/trojgraybrde.html