VIRUS ALERTS - December 18, 2005

Type
Trojan

Aliases
Backdoor.Win32.ByShell.b
Backdoor.ByShell.a
W32/Byshell.A

Troj/ByShell-A is an NT rootkit which intercepts various system APIs.

Troj/ByShell-A comprises the number of files and includes the functionality to hide processes, insert itself into other applications process space and bypass security applications including firewall.

Troj/ByShell-A allows an unauthorized remote access to the infected computer

http://www.sophos.com/virusinfo/analyses/trojbyshella.html

Type
Trojan

Aliases
Exploit.Win32.MS05-039.ac
Exploit-DcomRpc.g.gen

Troj/ExpBdoor-A is a Trojan for the Windows platform.

Troj/ExpBdoor-A exploits an operating system vulnerability to open a backdoor
on a remote computer.

A patch for the operating system vulnerability exploited by Troj/ExpBdoor-A is available from Microsoft:
MS05-039

http://www.sophos.com/virusinfo/analyses/trojexpbdoora.html

Type
Worm

Aliases
Email-Worm.Win32.NetSky.ak
W32/Netsky.am
W32.Netsky@mm
WORM_NETSKY.AP

W32/Netsky-W is a variant of the W32/Netsky worms for the Windows platform that attempts to spread via email.

http://www.sophos.com/virusinfo/analyses/w32netskyw.html

Type
Trojan

Aliases
Trojan-Downloader.Win32.PassAlert.d
StartPage-IC

Troj/Dloadr-ACO is a downloader Trojan for the Windows platform.

Troj/Dloadr-ACO includes functionality to download and run programs from the internet and bypass personal firewall software.

http://www.sophos.com/virusinfo/analyses/trojdloadraco.html

Type
Worm

Aliases
Backdoor.Win32.SdBot.ajs

W32/Sdbot-AJS is a network worm and IRC backdoor Trojan for the Windows platform.

W32/Sdbot-AJS runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels.

W32/Sdbot-AJS includes functionality to access the internet and communicate with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/w32sdbotajs.html

Type
Spyware Worm

Aliases
Email-Worm.Win32.Locksky.l
W32/Loosky.gen@MM

W32/Loosky-L is an email worm for the Windows platform.

W32/Loosky-L spreads by sending email with the following characteristics:

Subject line:
Your mail Account is Suspended

Message text:
We regret to inform you that your account has been suspended due to the violation of our site policy, more info is attached.

Attached file:
acc_inf01.exe

The worm also installs a proxy server and opens a backdoor allowing a remote user to take control of the infected computer.

W32/Loosky-L records a user's keystrokes and attemtps to steal and stored passwords.

http://www.sophos.com/virusinfo/analyses/w32looskyl.html

Type
Trojan

Aliases
Trojan-Clicker.Win32.Small.jf

Troj/AdClick-BJ is a Trojan for the Windows platform.

Type
Spyware Trojan

Aliases
Trojan-Spy.Win32.Banker.ahy
PWS-Banker.gen.bb

Troj/Bancban-MD is a Trojan for the Windows platform.

Troj/Bancban-MD includes functionality to send notification messages to remote locations.

http://www.sophos.com/virusinfo/analyses/trojbancbanmd.html

Type Spyware Worm

Aliases Backdoor.Win32.Rbot.aeu

W32/Rbot-BCQ is a worm and IRC backdoor Trojan for the Windows platform.
W32/Rbot-BCQ spreads:
- to other network computers infected with: Troj/Kuang, Troj/Sub7, Troj/NetDevil, W32/MyDoom, W32/Bagle and Troj/Optix
- to other network computers by exploiting common buffer overflow vulnerabilities, including: LSASS (MS04-011), RPC-DCOM (MS04-012), WKS (MS03-049) (CAN-2003-0812), WebDav (MS03-007), IIS5SSL (MS04-011) (CAN-2003-0719), UPNP (MS01-059), Veritas (CAN-2004-1172), Dameware (CAN-2003-1030) and ASN.1 (MS04-007)
- by copying itself to network shares protected by weak passwords
W32/Rbot-BCQ runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels.
The following patches for the operating system vulnerabilities exploited by W32/Rbot-BCQ can be obtained from the Microsoft website:
MS04-011
MS04-012
MS03-049
MS03-007
MS01-059
MS04-007

http://www.sophos.com/virusinfo/analyses/w32rbotbcq.html

Type Trojan

Aliases Trojan-PSW.Win32.QQShou.au

Troj/QQPass-AO is a Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojqqpassao.html

Type Spyware Trojan

Aliases Trojan-Dropper.Win32.Small.ajq

Troj/Kbroy-C is a Windows keylogger Trojan which may arrive with pornographic material.
When first run Troj/Kbroy-C copies itself to <Program Files>\Internet Explorer\svchst.exe

http://www.sophos.com/virusinfo/analyses/trojkbroyc.html

Type Spyware Trojan

Aliases Trojan-PSW.Win32.Lmir.apn

Troj/LegMir-CA is a Trojan for the Windows platform.
Troj/LegMir-CA includes functionality to access the internet and communicate with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/trojlegmirca.html

Type Spyware Trojan

Aliases Trojan-Spy.Win32.Goldun.bw
Spy-Agent.k

Troj/Brospy-I is a Trojan for the Windows platform.
Troj/Brospy-I monitors browser activity, and attempts to steal passwords that are cached or in protected storage, and email usernames and passwords. The Trojan includes functionality to access the internet and communicate with a remote server via HTTP.
Troj/Brospy-I attempts to disable some anti-spyware applications.

http://www.sophos.com/virusinfo/analyses/trojbrospyi.html

Type Trojan

Aliases Trojan.Win32.LowZones.am
QLowZones-38

Troj/LowZone-BB is a Trojan for the Windows platform.



http://www.sophos.com/virusinfo/analyses/trojlowzonebb.html

Type Trojan

Troj/AdClick-BM is a Trojan which attempts to install a stealthing component and download configuration data from a remote server to display further pop-ups.

http://www.sophos.com/virusinfo/analyses/trojadclickbm.html

Type Spyware Trojan

Aliases Trojan-Spy.Win32.Banker.ans

Troj/Bancban-ME is an Internet banking Trojan for the Windows platform.
Troj/Bancban-ME includes functionalities to:
- send notification messages to remote locations
- steal confidential information

http://www.sophos.com/virusinfo/analyses/trojbancbanme.html

Type Worm

W32/Rbot-BDB is a worm and IRC backdoor Trojan for the Windows platform.
W32/Rbot-BDB spreads to other network computers by exploiting the buffer overflow vulnerabilities: LSASS (MS04-011), RPC-DCOM (MS04-012), WKS (MS03-049) (CAN-2003-0812), WebDav (MS03-007), Veritas (CAN-2004-1172), Dameware (CAN-2003-1030), PNP (MS05-039) and ASN.1 (MS04-007) and by copying itself to network shares protected by weak passwords.
The following patches for the operating system vulnerabilities exploited by W32/Rbot-BDB can be obtained from the Microsoft website:
MS04-011
MS04-012
MS03-049
MS03-007
MS01-059
MS04-007

http://www.sophos.com/virusinfo/analyses/w32rbotbdb.html