VIRUS ALERTS - December 14, 2005

Type Spyware Trojan

Aliases Trojan-PSW.Win32.Lineage.on

Troj/Lineage-ON is a password stealing Trojan for the Windows platform that attempts to steal passwords associated with the game called "Lineage".
Troj/Lineage-ON includes functionality to access the internet and communicate with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/trojlineageon.html

Type Trojan

Troj/Dloadr-AAM is a Trojan for the Windows platform.
Troj/Dloadr-AAM includes functionality to access the internet and communicate with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/trojdloadraam.html

Type Trojan

Aliases Trojan-Downloader.Win32.Banload.ft
PWS-Banker.dldr
Download.Trojan

Troj/Banload-I is a Trojan for the Windows platform.
Troj/Banload-I includes functionality to download, install and run new software.

http://www.sophos.com/virusinfo/analyses/trojbanloadi.html

Type Spyware Trojan

Aliases PWS-Lineage

Troj/Lineage-OZ is a password stealing Trojan for the Windows platform.
Troj/Lineage-OZ includes functionality to log both keystrokes and mouse operations, and to email such information to a predefined email address. The Trojan attempts to disable some security related applications so that this email activity is undected.

http://www.sophos.com/virusinfo/analyses/trojlineageoz.html

Type Trojan

Aliases TROJ_VBSWG.A

Troj/VBSWG-AC is a Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojvbswgac.html

Type Trojan

Aliases TROJ_VBSWG.A

Troj/VBSWG-AD is a Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojvbswgad.html

Type Worm

Aliases Backdoor.Win32.VBbot.i

W32/Chode-O is an instant messenger worm with IRC backdoor functionality for the Windows platform that spreads by sending itself to IM contacts using MSN and AOL's instant messenger.

http://www.sophos.com/virusinfo/analyses/w32chodeo.html

Type Spyware Trojan

Aliases MultiDropper-PH

Troj/Danmec-B is a Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojdanmecb.html

Type Worm

Aliases Backdoor.Win32.Rbot.pac
W32.Spybot.Worm

W32/Rbot-AOH is a worm and IRC backdoor Trojan for the Windows platform.
W32/Rbot-AOH spreads:
- to other network computers by exploiting common buffer overflow vulnerabilites, including: RPC-DCOM (MS04-012), PNP (MS05-039) and ASN.1 (MS04-007)
- by copying itself to network shares protected by weak passwords

http://www.sophos.com/virusinfo/analyses/w32rbotaoh.html

Type Worm

Aliases Net-Worm.Win32.Hiberium.b
W32.Iberio
WORM_ZOTOB.O

W32/Hiberi-B is a worm and backdoor Trojan for the Windows platform.
W32/Hiberi-B spreads to other network computers by exploiting common buffer overflow vulnerabilites, including PNP (MS05-039).
W32/Hiberi-B runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer.
W32/Hiberi-B includes functionality to download, install and run new software.

http://www.sophos.com/virusinfo/analyses/w32hiberib.html

Type Spyware Trojan

Aliases Backdoor.Win32.Dumador.az

Troj/Dumaru-S is a password stealing backdoor Trojan for the Windows platform.
Troj/Dumaru-S can log keystrokes on an infected computer, steal email and ftp details, as well as information from Protected Storage.
Troj/Dumaru-S contains a backdoor component that downloads a text file that can instruct it to do any of the following:
Upload or download a file
Execute a file
Create a remote command prompt

http://www.sophos.com/virusinfo/analyses/trojdumarus.html

Type Worm

W32/Sdbot-ADH is a worm and IRC backdoor Trojan for the Windows platform.
W32/Sdbot-ADH spreads to other network computers infected with: Troj/Kuang, Troj/Sub7, Troj/NetDevil and W32/MyDoom.
W32/Sdbot-ADH runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels.

http://www.sophos.com/virusinfo/analyses/w32sdbotadh.html

Type Worm

Aliases Backdoor.Win32.Rbot.adf

W32/Rbot-AOG is a worm and IRC backdoor Trojan for the Windows platform.
W32/Rbot-AOG spreads:
- to other network computers infected with: Troj/Kuang, Troj/Sub7, Troj/NetDevil, W32/MyDoom, W32/Bagle and Troj/Optix
- to other network computers by exploiting common buffer overflow vulnerabilites, including: LSASS (MS04-011), RPC-DCOM (MS04-012), WKS (MS03-049) (CAN-2003-0812), WebDav (MS03-007), IIS5SSL (MS04-011) (CAN-2003-0719), MSSQL (MS02-039) (CAN-2002-0649), UPNP (MS01-059), Veritas (CAN-2004-1172) and Dameware (CAN-2003-1030)
- by copying itself to network shares protected by weak passwords
The following patches for the operating system vulnerabilities exploited by W32/Rbot-AOG can be obtained from the Microsoft website:
MS04-011
MS04-012
MS03-049
MS03-007
MS02-039
MS01-059
W32/Rbot-AOG runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels.

http://www.sophos.com/virusinfo/analyses/w32rbotaog.html

Type Worm

Aliases Backdoor.Win32.SdBot.aad

W32/Tilebot-Q is a worm and IRC backdoor Trojan for the Windows platform.
W32/Tilebot-Q spreads to other network computers by exploiting common buffer overflow vulnerabilites, including: LSASS (MS04-011), RPC-DCOM (MS04-012), WKS (MS03-049) (CAN-2003-0812) and MSSQL (MS02-039) (CAN-2002-0649) and by copying itself to network shares protected by weak passwords.
The following patches for the operating system vulnerabilities exploited by W32/Tilebot-Q can be obtained from the Microsoft website:
MS04-011
MS04-012
MS03-049
MS02-039
W32/Tilebot-Q runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels.

http://www.sophos.com/virusinfo/analyses/w32tilebotq.html

Type Worm

Aliases Backdoor.Win32.Rbot.gen

W32/Rbot-AOF is a worm for the Windows platform.
W32/Rbot-AOF spreads to other network computers by exploiting common buffer overflow vulnerabilites, including: LSASS (MS04-011), RPC-DCOM (MS04-012) and IIS5SSL (MS04-011) (CAN-2003-0719) and by copying itself to network shares protected by weak passwords.
The following patches for the operating system vulnerabilities exploited by W32/Rbot-AOF can be obtained from the Microsoft website:
MS04-011
MS04-012

http://www.sophos.com/virusinfo/analyses/w32rbotaof.html

Type Worm

Aliases Email-Worm.Win32.Anker.r
W32.Ahker.D@mm
WORM_AHKER.K

W32/Ahker-K is an email worm for the Windows platform.
W32/Ahker-K will download a ZIP copy of itself from a website in order to send out via email.
W32/Ahker-K will mail itself out to email addresses found on an infected computer.
W32/Ahker-K will arrive as a ZIP attachment to an email. The characteristics of the email will be as follows:
Attachment name: "Mini-Game.zip"
Subject:
"FW: Check this out! LMFAO!!"
"FW: Bin Laden mini game! Download it NOW! LOL!"
"FW: Latest Bin Laden mini game!"
"FW: Breaking News! Bin Laden's...MINI GAME! LOL!"
"FW: BREAKING NEWS!! LOL!"
"FW: FW: check Saddam's first ever mini game!"
"FW: FW: Download Saddam's NEW mini game!"
"FW: FW: Download Bush's mini game! LMFAO!"
"Here it is! LOL!<BR> <BR>"
"FW: FW: CNN releases Bin Laden's mini game!"
"FW: FW: CHECK this out! "
From: webmaster@games.com
Body:
"You'll find it in the attachement! Have fun!
Enjoy Bin Laden's & Saddam's latest mini-game!"
From: games@cnn.com
Body:
"Here it is! LOL!
Enjoy Bin Laden's & Saddam's latest mini-game!"
From: webmaster@gamespot.com
Body:
"You'll find the game attached! LMFAO!
Enjoy Bin Laden's & Saddam's latest mini-game!"
From: webmaster@ign.com
Body:
"Thanks to CNN for this new funny game! LOL! Keep it up!
Enjoy Bin Laden's & Saddam's latest mini-game!"
From: webmaster@gamepro.com
Body:
"Just have fun...can't say much! LOL!
Enjoy Bin Laden's & Saddam's latest mini-game!"
From: webmaster@gamerevolution.com
Body:
"Have fun! The best! enjoy!
Enjoy Bin Laden's & Saddam's latest mini-game!"
From: webmaster@ahker-games.org
Body:
"Awesome game. Download it! thanks CNN!
Enjoy Bin Laden's & Saddam's latest mini-game!"
From: webmaster@downloads.com
Body:
"It's cool!!!!!!!!!! I want to thank CNN!
Enjoy Bin Laden's & Saddam's latest mini-game!"
From: webmaster@arcade.com
Body:
"If you wanna laugh out loud...just try this mini game...! LOL!
Enjoy Bin Laden's & Saddam's latest mini-game!"
From: mini-games@iml.edu.lb
Body:
"You'll find the mini-game in the attachement!!
Enjoy Bin Laden's & Saddam's latest mini-game!"

http://www.sophos.com/virusinfo/analyses/w32ahkerk.html

Type Trojan

Troj/VBbot-I is a backdoor Trojan for the Windows platform that allows access to the infected computer via an IRC channel.

http://www.sophos.com/virusinfo/analyses/trojvbboti.html

Type Trojan

Aliases Trojan-Downloader.Win32.Zlob.cq

Troj/LewDl-D is a downloader Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojlewdld.html

Type Trojan

Aliases Downloader-ARQ

Troj/Krepper-Z is a Trojan for the Windows platform.
Troj/Krepper-Z includes functionality to access the internet and communicate with a remote server via HTTP. The Trojan may also download and execute further files.

http://www.sophos.com/virusinfo/analyses/trojkrepperz.html

Type Spyware Trojan

Aliases Trojan-Spy.Win32.Banker.ahy

Troj/Bancban-LP is a internet banking Trojan for the Windows platform.
Troj/Bancban-LP includes the following functionalities:
- to communicate with remote servers
- to steal confidential information

http://www.sophos.com/virusinfo/analyses/trojbancbanlp.html

Type Spyware Worm

Aliases Backdoor.Win32.Rbot.akq
WORM_RBOT.DDA

W32/Rbot-BCD is a network worm with backdoor Trojan functionality for the Windows platform.
W32/Rbot-BCD spreads using a variety of techniques including:
-exploiting weak passwords on computers and SQL servers
-exploiting operating system vulnerabilities
-using backdoors opened by other worms or Trojans.
W32/Rbot-BCD can be controlled by a remote attacker over IRC channels. The backdoor component of W32/Rbot-BCD can be instructed by a remote user to perform the following functions:
start an FTP server
start a Proxy server
start a web server
take part in distributed denial of service (DDoS) attacks
log keypresses
capture screen/webcam images
packet sniffing
port scanning
download/execute arbitrary files
start a remote shell (RLOGIN)
steal product registration information from certain software

http://www.sophos.com/virusinfo/analyses/w32rbotbcd.html

Type Worm

Aliases Backdoor.Win32.Rbot.adf
W32/Sdbot.MFP

W32/Rbot-BBW is a worm and IRC backdoor Trojan for the Windows platform.
W32/Rbot-BBW spreads:
- to other network computers infected with: Troj/Kuang, Troj/Sub7, Troj/NetDevil, W32/MyDoom, W32/Bagle and Troj/Optix
- to other network computers by exploiting common buffer overflow vulnerabilities, including: LSASS (MS04-011), RPC-DCOM (MS04-012), WKS (MS03-049) (CAN-2003-0812), WebDav (MS03-007), IIS5SSL (MS04-011) (CAN-2003-0719), UPNP (MS01-059), Veritas (CAN-2004-1172), Dameware (CAN-2003-1030) and ASN.1 (MS04-007)
- by copying itself to network shares protected by weak passwords
W32/Rbot-BBW runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels.

http://www.sophos.com/virusinfo/analyses/w32rbotbbw.html

Type Trojan

Aliases Trojan-Downloader.Win32.Banload.bc

Troj/Banload-BC is a Trojan for the Windows platform.
Troj/Banload-BC includes functionality to access the internet and communicate with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/trojbanloadbc.html

Type Trojan

Aliases Trojan-Downloader.Win32.Banload.ce

Troj/Banload-CE is a Trojan for the Windows platform.
Troj/Banload-CE includes functionality to access the internet and communicate with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/trojbanloadce.html

Type Spyware Trojan

Aliases Trojan-Spy.Win32.Banker.ahy

Troj/Bancban-LQ is a banking Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojbancbanlq.html

Type Trojan

Aliases Trojan-Downloader.Win32.ConHook.l
W32/Downloader.IZD

Troj/ConHook-L is a Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojconhookl.html

Type Spyware Trojan

Troj/Stawin-I is a keylogging Trojan for the Windows platform.
Troj/Stawin-I includes functionality to email notification messages to remote locations.
When logging data, Troj/Stawin-I will target interactions with banks and financial institutions, such as data entered into online banking forms. The logged data will be sent to a specific email address.

http://www.sophos.com/virusinfo/analyses/trojstawini.html

Type Spyware Trojan

Troj/LegMir-BZ is a backdoor Trojan for the Windows platform.
Troj/LegMir-BZ includes password stealing functionality.

http://www.sophos.com/virusinfo/analyses/trojlegmirbz.html