VIRUS ALERTS - December 20, 2005

Type
Trojan

Aliases
Trojan-Downloader.Win32.Banload.nc

Troj/Banload-AS is a Trojan for the Windows platform.

Troj/Banload-AS includes functionality to access the internet and communicate
with a remote server via HTTP.

The downloaded file is detected as Troj/Bancban-MF

http://www.sophos.com/virusinfo/analyses/trojbanloadas.html

Type
Worm

W32/Rbot-BDE is a worm and IRC backdoor Trojan for the Windows platform.

W32/Rbot-BDE spreads to other network computers infected with Troj/Kuang and to other network computers by exploiting common buffer overflow vulnerabilities, including: WebDav (MS03-007) and IIS5SSL (MS04-011) (CAN-2003-0719).

W32/Rbot-BDE runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels.

http://www.sophos.com/virusinfo/analyses/w32rbotbde.html

Type
Trojan

Aliases
Trojan-Spy.Win32.Banker.ahy

Troj/Bancban-MF is a Trojan for the Windows platform.

Troj/Bancban-MF includes functionality to send notification messages to remote locations.

http://www.sophos.com/virusinfo/analyses/trojbancbanmf.html

Type
Spyware Trojan

Aliases
Trojan-Spy.Win32.Banker.ahy

Troj/Bancban-MI is an Internet banking Trojan for the Windows platform.

Troj/Bancban-MI includes functionalities to:

- send notification messages to remote locations via email
- steal confidential information

http://www.sophos.com/virusinfo/analyses/trojbancbanmi.html

Type
Spyware Trojan

Troj/Bancban-MG is an Internet banking Trojan for the Windows platform.

Troj/Bancban-MG includes functionalities to:

- send notification messages to remote locations
- steal confidential information

http://www.sophos.com/virusinfo/analyses/trojbancbanmg.html

Type
Trojan

Aliases
Trojan-Downloader.Win32.Tibs.s

Troj/Vixup-N is a downloader Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojvixupn.html

Type
Trojan

Troj/Vixup-O is a Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojvixupo.html

Type
Trojan

Aliases
Trojan.Win32.Dialer.mi

Troj/QDial-B is a Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojqdialb.html

Type
Trojan

Aliases
Trojan-Downloader.Win32.Tibs.s

Troj/Vixup-P is a Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojvixupp.html

Type
Trojan

Troj/Vixup-Q is a Trojan for the Windows platform.

Sophos's anti-virus products include Genotype? detection technology, which can proactively protect against new threats without requiring an update. Sophos customers have been protected against Troj/Vixup-Q (detected as Troj/Vixup-Gen) since version 3.98.

http://www.sophos.com/virusinfo/analyses/trojvixupq.html

Type
Spyware Trojan

Aliases
PWS-Banker.gen.b

Troj/Bancban-ML is an Internet banking Trojan for the Windows platform.

Troj/Bancban-ML has the functionalities to:

- send messages to a remote location
- steal information

http://www.sophos.com/virusinfo/analyses/trojbancbanml.html

Type
Spyware Trojan

Troj/IRCBot-BC is a backdoor IRC Trojan for Windows platform.

Troj/IRCBot-BC has the functionalities to:

- allow a remote intruder to gain access and control over the infected computer via IRC
- steal information
- silently download, install and run new software

http://www.sophos.com/virusinfo/analyses/trojircbotbc.html

Type
Spyware Trojan

Troj/QQRob-AI is a Trojan for the Windows platform.

Troj/QQRob-AI includes functionality to access the internet and communicate with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/trojqqrobai.html

Type
Trojan

Aliases
Downloader-PZ
TROJ_HARNIG.GEN

Troj/Harnig-B is a Trojan for the Windows platform.

Troj/Harnig-B includes the following functionalities to:

- access the Internet and communicate with a remote server via HTTP
- terminate processes
- silently download, install and run new software

http://www.sophos.com/virusinfo/analyses/trojharnigb.html

Type
Worm

Aliases
Backdoor.Win32.SdBot.xd
W32/Sdbot.worm.gen.bz

W32/Tilebot-CN is a worm and IRC backdoor Trojan for the Windows platform.

W32/Tilebot-CN includes the functionalities to:

- access the internet and communicate with a remote server via HTTP
- provide a backdoor server to allow a remote intruder to gain access and control via IRC
- enumerate all drives and processes on the infected computer
- create new AOL Instant Messenger profiles
- perform port scanning

http://www.sophos.com/virusinfo/analyses/w32tilebotcn.html

Type
Worm

W32/Rbot-BCR is a worm for the Windows platform.

http://www.sophos.com/virusinfo/analyses/w32rbotbcr.html

Type
Worm

Aliases
WORM_XDDTRAY.A
W32.Xddtray@mm

W32/Traxg-G is a worm for the Windows platform.

W32/Traxg-G includes functionality to spread through emails, network shares or by coping itself to the drives A and D.

W32/Traxg-G may display the following fake warning message:

Warning
This Folder Has Been Damage!

http://www.sophos.com/virusinfo/analyses/w32traxgg.html

Type
Worm

W32/Rbot-BEC is a worm and IRC backdoor Trojan for the Windows platform.

W32/Rbot-BEC spreads:

- to computers infected with the W32/Sasser worm
- to other network computers by exploiting common buffer overflow
vulnerabilities, including: LSASS (MS04-011), RPC-DCOM (MS04-012), WebDav (MS03-007), and ASN.1 (MS04-007)
- by copying itself to network shares and Microsoft SQL servers protected by weak passwords

W32/Rbot-BEC runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels.

http://www.sophos.com/virusinfo/analyses/w32rbotbec.html

Type
Trojan

Aliases
Backdoor.Win32.Delf.ajw

Troj/Delf-AJW is a backdoor Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojdelfajw.html

Type
Trojan

Aliases
Bloodhound.Beagle
W32/Bagle.gen

Troj/BagleDl-AP is a downloader Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojbagledlap.html

Type
Spyware Trojan

Aliases
Backdoor.Win32.Hupigon.se
BackDoor-AWQ.b

Troj/Feutel-BC is a backdoor Trojan for the Windows platform that provides unauthorized remote access to the infected computer.

http://www.sophos.com/virusinfo/analyses/trojfeutelbc.html

Type
Trojan

Troj/AdClick-BO is a Trojan for the Windows platform.

Troj/AdClick-BO includes functionality to access the internet and communicate with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/trojadclickbo.html

Type
Trojan

Aliases
BackDoor-AZV

Troj/QHosts-K is a Trojan for the Windows platform.

Troj/QHosts-K modifies an infected computer's Hosts file.

http://www.sophos.com/virusinfo/analyses/trojqhostsk.html

Type
Spyware Trojan

Aliases
Backdoor.Win32.Hupigon.pi
BackDoor-AWQ.b
Trojan.W32.Pigeon-5

Troj/Feutel-BB is a backdoor Trojan for the Windows platform.

Troj/Feutel-BB includes functionality to access the internet and communicate with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/trojfeutelbb.html

Type
Trojan

Aliases
Backdoor.Win32.Hupigon.so
BackDoor-AWQ.b

Troj/GrayBrd-N is a backdoor Trojan for the Windows platform.

Troj/GrayBrd-N includes functionality to access the internet and communicate with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/trojgraybrdn.html

Type
Trojan

Aliases
Trojan-Downloader.Win32.Quyl.a

Troj/Dloade-AAL is a Trojan for the Windows platform.

Troj/Dloade-AAL includes functionality to download, install and run new software.

http://www.sophos.com/virusinfo/analyses/trojdloadeaal.html

Type
Trojan

Aliases
Trojan-Downloader.Win32.Agent.yd
Trojan.Downloader.Agent-208

Troj/Dloade-AAM is a downloading Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojdloadeaam.html

Type
Worm

Aliases
WORM_SDBOT.CQK
W32.Spybot.Worm

W32/Tilebot-CO is a worm and IRC backdoor Trojan for the Windows platform.

W32/Tilebot-CO spreads to other network computers by exploiting common buffer overflow vulnerabilities, including: LSASS (MS04-011), RPC-DCOM (MS04-012), PNP (MS05-039) and ASN.1 (MS04-007) and by copying itself to network shares protected by weak passwords.

W32/Tilebot-CO runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels.

http://www.sophos.com/virusinfo/analyses/w32tilebotco.html

Type
Trojan

Troj/Banbra-BD is a Trojan for the Windows platform

http://www.sophos.com/virusinfo/analyses/trojbanbrabd.html

Type Trojan

Aliases Trojan-Downloader.Win32.Banload.ng

Troj/Banload-CL is a Trojan for the Windows platform.
Troj/Banload-CL attempts to download and execute further software. It is typically used to download internet banking Trojans.

http://www.sophos.com/virusinfo/analyses/trojbanloadcl.html