VIRUS ALERTS - December 17, 2005

Type
Trojan

Aliases
Trojan.Win32.StartPage.aw

Troj/StartPa-IW is a Trojan for the Windows platform.

Troj/StartPa-IW includes functionality to access the internet and communicate with a remote server via HTTP.

The Trojan downloads additional files which may define further behavior.

http://www.sophos.com/virusinfo/analyses/trojstartpaiw.html

Type
Trojan

Aliases
TROJ_DRSMARTL.A

Troj/Drsmartl-C is a Trojan for the Windows platform.

The Trojan includes functionality to download, install and run new software.

http://www.sophos.com/virusinfo/analyses/trojdrsmartlc.html

Type
Trojan

Aliases
Dialer.Win32.gen

Dial/Stardial-D is a dialer application.

Registry entries are created under:

HKLM\SOFTWARE\MainPean Highspeed\

http://www.sophos.com/virusinfo/analyses/dialstardiald.html

Type
Spyware Trojan

Aliases
Trojan-Spy.Win32.Agent.t
W32/PWStealer.Z
W32/Agent.AY
PWS-IT
PWS-IT.kit trojan

Troj/BluEye-D is a Backdoor generator toolkit. It is capable of recording keystrokes and opening a backdoor to allow access to the command shell on victim's computer. The keystrokes will be saved in a log file which an intruder can access via the backdoor.

http://www.sophos.com/virusinfo/analyses/trojblueyed.html

Type Worm

W32/Dasher-C is a worm for the Windows platform.
W32/Dasher-C spreads by exploiting various vulnerability includes the following:
WINS vulnerability (MS04-045)
WINDOWS PNP vulnerability (MS05-039)
MSDTC vulnerability (MS05-051)
MSSQL Authentication vulnerability (MS02-056)
W32/Dasher-C will attempt to disable auto starting of Windows Update.

http://www.sophos.com/virusinfo/analyses/w32dasherc.html

Type Worm

W32/Titog-C is a worm for the Windows platform.

http://www.sophos.com/virusinfo/analyses/w32titogc.html

Type Trojan

Troj/Winser-C is a Trojan for the Windows platform.
The Trojan can be used to exploit the Windows Internet Naming Service (WINS) buffer overflow vulnerability (MS04-045) to gain remote shell access on Microsoft Windows servers running the WINS service.

http://www.sophos.com/virusinfo/analyses/trojwinserc.html

Type Trojan

Troj/SqlHello-A is a Trojan for the Windows platform.
The Trojan can be used to exploit the SQL buffer overflow vulnerability (MS02-056) to gain remote shell access on Microsoft Windows servers running SQL Server or MSDE (Microsoft Desktop Engine).

http://www.sophos.com/virusinfo/analyses/trojsqlhelloa.html

Type Worm

Aliases Backdoor.Win32.SdBot.aad

W32/Tilebot-CM is a worm and IRC backdoor Trojan for the Windows platform.
W32/Tilebot-CM spreads to other network computers by exploiting common buffer overflow vulnerabilities, including: LSASS (MS04-011), RPC-DCOM (MS04-012), MSSQL (MS02-039) (CAN-2002-0649), PNP (MS05-039) and ASN.1 (MS04-007) and by copying itself to network shares protected by weak passwords.
W32/Tilebot-CM runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels.
W32/Tilebot-CM includes functionality to access the internet and communicate with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/w32tilebotcm.html

Type Spyware Worm

Aliases Email-Worm.Win32.Combra.c
W32.Comdor.K@mm
WORM_COMBRA.E

W32/Combra-L is a worm for the Windows platform.
W32/Combra-L includes functionality to:
- access the internet and communicate with a remote server via HTTP
- send notification messages to remote locations

http://www.sophos.com/virusinfo/analyses/w32combral.html

Type Worm

Aliases Email-Worm.Win32.Combra.c

W32/Combra-K is a worm for the Windows platform.
W32/Combra-K includes functionality to:
- access the internet and communicate with a remote server via HTTP
- send notification messages to remote locations

http://www.sophos.com/virusinfo/analyses/w32combrak.html

Type Worm

Aliases Backdoor.Win32.Agent.rd

W32/Agent-FS is a worm and backdoor Trojan for the Windows platform.
W32/Agent-FS spreads to other network computers by exploiting common buffer overflow vulnerabilities, including ASN.1 (MS04-007).

http://www.sophos.com/virusinfo/analyses/w32agentfs.html

Type Worm

Aliases Backdoor.Win32.Pakes
W32/Sdbot.MFK

W32/Rbot-BBE is a worm and IRC backdoor Trojan for the Windows platform.
W32/Rbot-BBE spreads to other network computers by exploiting common buffer overflow vulnerabilities, including: RPC-DCOM (MS04-012), PNP (MS05-039) and ASN.1 (MS04-007).
W32/Rbot-BBE runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels.

http://www.sophos.com/virusinfo/analyses/w32rbotbbe.html

Type Worm

Aliases Backdoor.Win32.Rbot.gen
W32/Spybot.NEP

W32/Sdbot-AGK is a worm and IRC backdoor Trojan for the Windows platform.
W32/Sdbot-AGK spreads to other network computers by exploiting common buffer overflow vulnerabilities, including: RPC-DCOM (MS04-012), PNP (MS05-039) and ASN.1 (MS04-007) and by copying itself to network shares protected by weak passwords.
W32/Sdbot-AGK runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels.

http://www.sophos.com/virusinfo/analyses/w32sdbotagk.html

Type Virus

Virdem-526 is an appending COM virus.

http://www.sophos.com/virusinfo/analyses/virdem526.html

Type Trojan

Troj/Dloadr-ACA is a downloader Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojdloadracm.html

Type Trojan

Aliases Trojan.Win32.StartPage.aw

Troj/StartPa-IW is a Trojan for the Windows platform.
Troj/StartPa-IW includes functionality to access the internet and communicate with a remote server via HTTP.
The Trojan downloads additional files which may define further behavior.

http://www.sophos.com/virusinfo/analyses/trojstartpaiw.html

Type Trojan

Aliases TROJ_DRSMARTL.A

Troj/Drsmartl-C is a Trojan for the Windows platform.
The Trojan includes functionality to download, install and run new software.

http://www.sophos.com/virusinfo/analyses/trojdrsmartlc.html

Type Trojan

Aliases Dialer.Win32.gen

Dial/Stardial-D is a dialer application.
Registry entries are created under:
HKLM\SOFTWARE\MainPean Highspeed\

http://www.sophos.com/virusinfo/analyses/dialstardiald.html

Type Spyware Trojan

Aliases Trojan-Spy.Win32.Agent.t
W32/PWStealer.Z
W32/Agent.AY
PWS-IT
PWS-IT.kit trojan

Troj/BluEye-D is a Backdoor generator toolkit. It is capable of recording keystrokes and opening a backdoor to allow access to the command shell on victim's computer. The keystrokes will be saved in a log file which an intruder can access via the backdoor.

http://www.sophos.com/virusinfo/analyses/trojblueyed.html