VIRUS ALERTS - December 15, 2005

Type Spyware Worm

Aliases PWS-Banker.gen.p
TSPY_BANCOS.BIA

W32/Antiman-G is an email worm for the Windows platform.
W32/Antiman-G includes functionality to access the internet and communicate with a remote server via HTTP, and may attempt to download a file from a remote website.
W32/Antiman-G may attempt to terminate processes, delete files and close windows related to certain anti-virus and security programs.
W32/Antiman-G logs user information and keystrokes, in particular those related to certain Brazilian banking websites.
W32/Antiman-G may send itself by email to addresses it harvests from the infected computer.

http://www.sophos.com/virusinfo/analyses/w32antimang.html

Type Worm

Aliases Email-Worm.Win32.Bagle.ex

W32/Bagle-AX is a mass-mailing worm for the Windows platform.
W32/Bagle-AX sends a ZIP file as an email attachment. The ZIP file contains an executable detected as Troj/BagleDl-AO.
Once installed, this executable attempts to download further files, which may include copies of the original worm W32/Bagle-AX.

http://www.sophos.com/virusinfo/analyses/w32bagleax.html

Type Trojan

Aliases Backdoor.Win32.IRCBot.kk

Troj/IRCBot-AY is a IRC backdoor Trojan for the Windows platform.
Troj/IRCBot-AY has the functionality to allow a remote intruder to gain access and control.

http://www.sophos.com/virusinfo/analyses/trojircbotay.html

Type Trojan

Aliases Backdoor.Win32.Hupigon.ls
BackDoor-AWQ.b

Troj/Feutel-AX is a Trojan for the Windows platform.
Troj/Feutel-AX includes functionality to access the internet and communicate with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/trojfeutelax.html

Type Trojan

Aliases BackDoor-AWQ.b

Troj/Feutel-AY is a Trojan for the Windows platform.
Troj/Feutel-AY includes functionality to access the internet and communicate with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/trojfeutelay.html

Type Trojan

Aliases Trojan-Downloader.Win32.Banload.cp

Troj/BanLoad-AD is a Trojan for the Windows platform.
Troj/BanLoad-AD includes functionality to access the internet and communicate with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/trojbanloadad.html

Type Spyware Trojan

Aliases Trojan-PSW.Win32.LdPinch.yu

Troj/Dcmbot-G is an internet banking Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojdcmbotg.html

Type Worm

W32/Rbot-BCL is a worm and IRC backdoor Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/w32rbotbcl.html

Type Trojan

Aliases Trojan-Downloader.Win32.Zlob.cu

Troj/LewDr-A is a Trojan for the Windows platform.
Troj/LewDr-A will drop a file to the Windows system folder with the name mscornet.exe, this file is detected as Troj/LewDl-E.

http://www.sophos.com/virusinfo/analyses/trojlewdra.html

Type Spyware Trojan

Troj/Dcmbot-H is an internet banking Trojan for the Windows platform.
The Trojan contains the functionality to capture keystrokes and access the Internet.

http://www.sophos.com/virusinfo/analyses/trojdcmboth.html