VIRUS ALERTS - December 21, 2005

Type
Trojan

Aliases
Trojan-Downloader.Win32.Delf.acx

Troj/Banload-CO is a Trojan downloader for the Windows platform.

Troj/Banload-CO includes functionality to access the internet and communicate
with a remote server via HTTP.

The downloaded file is detected as Troj/Bancban-MO.

http://www.sophos.com/virusinfo/analyses/trojbanloadco.html

Type
Spyware Trojan

Aliases
Trojan-Spy.Win32.Banbra.df

Troj/Bancban-MO is a Trojan for the Windows platform.

Troj/Bancban-MO includes functionality to send notification messages to remote
locations.

http://www.sophos.com/virusinfo/analyses/trojbancbanmo.html

Type
Spyware Trojan

Aliases
Trojan-Spy.Win32.Bancos.ha

Troj/Bancos-GV is an Internet banking Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojbancosgv.html

Type
Trojan

Aliases
Trojan-Downloader.Win32.Banload.at

Troj/Banload-CM is a Trojan downloader for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojbanloadcm.html

Type
Trojan

Aliases
Backdoor.Win32.Delf.ahv

Troj/Delf-MC is a Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojdelfmc.html

Type
Spyware Trojan

Aliases
Trojan-Spy.Win32.Bancos.ha
W32/Bancos.FCL

Troj/Bancos-GR is an internet banking Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojbancosgr.html

Type
Spyware Trojan

Aliases
Trojan-Spy.Win32.Banbra.df
W32/Bancos.FCQ

Troj/Bancban-MN is a Trojan for the Windows platform.

Troj/Bancban-MN includes functionality to access the internet and communicate with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/trojbancbanmn.html

Type
Spyware Trojan

Aliases
Trojan-Spy.Win32.Banker.ahy
W32/Bancos.FCP

Troj/Bancban-MH is a Trojan for the Windows platform.

Troj/Bancban-MH includes functionality to send notification messages to remote locations.

http://www.sophos.com/virusinfo/analyses/trojbancbanmh.html

Type
Spyware Trojan

Aliases
Trojan-Spy.Win32.Banker.abg
W32/Bancos.FCN

Troj/Bancban-MM is a Trojan for the Windows platform.

Troj/Bancban-MM includes functionality to send notification messages to remote
locations.

http://www.sophos.com/virusinfo/analyses/trojbancbanmm.html

Type
Spyware Trojan

Troj/Lineage-KX is a password stealing Trojan for the Windows platform.

When Troj/Lineage-KX is installed it creates the file <System> \wintt1.dll.

http://www.sophos.com/virusinfo/analyses/trojlineagekx.html

Type
Trojan

Aliases
Trojan-Downloader.Win32.Banload.dd

Troj/DownLdr-FM is a Trojan for the Windows platform.

Troj/DownLdr-FM includes functionality to access the internet and communicate
with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/trojdownldrfm.html

Type
Spyware Trojan

Aliases
Trojan-Spy.Win32.Bancos.ha
W32/Bancos.EZS

Troj/Bancos-GF is a Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojbancosgf.html

Type
Spyware Worm

W32/Feebs-A is a worm for the Windows platform.

The worm may arrive as an attachment to an email claiming to be sent via "Protected E-Mail service" with bogus credentials. The message may lure the recipient into entering the supplied credentials into an attached HTML document.

W32/Feebs-A also creates several copies of itself in ZIP format in paths containing "share".

W32/Feebs-A may also harvest information from the infected computer and send stolen data to a remote user via FTP.

http://www.sophos.com/virusinfo/analyses/w32feebsa.html

Type
Trojan

Troj/Bifrose-R is a Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojbifroser.html

Type
Trojan

Aliases
JS/Exploit-BO.gen

Troj/Dloadr-ACP is a downloader Trojan for the Windows platform.

Troj/Dloadr-ACP attempts to download and execute a file from the internet.

http://www.sophos.com/virusinfo/analyses/trojdloadracp.html

Type
Trojan

Aliases
Exploit-ByteVerify

Troj/Bizves-C is a Trojan for the Windows platform.

Troj/Bizves-C creates a file named loadclean.exe in the Windows folder.
Loadclean.exe is detected by Sophos's anti-virus products as Troj/Bizves-Gen.

http://www.sophos.com/virusinfo/analyses/trojbizvesc.html

Type
Trojan

Aliases
Trojan-Downloader.Win32.Adload.

Troj/Dloadr-ACQ is a downloader Trojan for the Windows platform.
The Trojan downloads a file to C:\drsmartload.exe and runs the downloaded file.

At the time of writing drsmartload.exe is detected by Sophos's anti-virus products as Troj/Drsmartl-C.

http://www.sophos.com/virusinfo/analyses/trojdloadracq.html

Type
Trojan

Aliases
Trojan-Downloader.Win32.Delf.xq

Troj/Banload-CA is a Trojan for the Windows platform.

The Trojan downloads and runs additional files from a remote site.

http://www.sophos.com/virusinfo/analyses/trojbanloadca.html

Type
Trojan

Aliases
Trojan-Downloader.Win32.Banload.ls

Troj/Banload-CC is a Trojan for the Windows platform.

The Trojan downloads and runs additional files from a remote site.

http://www.sophos.com/virusinfo/analyses/trojbanloadcc.html

Type
Spyware Trojan

Aliases
Trojan-Spy.Win32.Bancos.lo

Troj/VBanker-C is a Trojan for the Windows platform.

The Trojan monitors Internet Explorer windows for sessions with online banking web sites. The Trojan captures login credentials and sends stolen information to a remote attacker.

http://www.sophos.com/virusinfo/analyses/trojvbankerc.html

Type
Trojan

Aliases
Trojan-Downloader.Win32.Dadobra.jz

Troj/Banload-CB is a Trojan for the Windows platform.

The Trojan downloads and runs additional files from a remote site.

http://www.sophos.com/virusinfo/analyses/trojbanloadcb.html

Type
Spyware Trojan

Aliases
Trojan-Spy.Win32.Bancos.jl

Troj/VBanker-B is a Trojan for the Windows platform.

The Trojan monitors Internet Explorer windows for sessions with online banking web sites. The Trojan captures login credentials and sends stolen information to a remote attacker.

http://www.sophos.com/virusinfo/analyses/trojvbankerb.html

Type
Trojan

Aliases
Constructor.Win32.SMWG.b
New

Troj/Smwg-A is a Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojsmwga.html

Type
Spyware Trojan

Aliases
Trojan-PSW.Win32.Lineage.rq
New

Troj/Lineage-CA is a password stealing Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojlineageca.html

Type
Spyware Trojan

Aliases
PWS-LegMir
PWSteal.Trojan

Troj/LegMir-CG is a pasword stealing Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojlegmircg.html

Type
Spyware Worm

Aliases
W32.Spybot.Worm

W32/Tibick-B is a P2P worm and IRC backdoor Trojan for the Windows platform.

W32/Tibick-B spreads via file sharing on P2P networks.

W32/Tibick-B has the functionalities to:

- allow a remote intruder to gain access and control over the infected computer via IRC
- steal information
- participate in DDos
- silently download, install and run new software

http://www.sophos.com/virusinfo/analyses/w32tibickb.html

Type
Worm

Aliases
WORM_SDBOT.CRG

W32/Sdbot-AJA is a worm and IRC backdoor Trojan for the Windows platform.

W32/Sdbot-AJA includes functionalities to:

- access the internet and communicate with a remote server via HTTP
- allow a remote intruder to gain access and control over the infected computer via IRC

http://www.sophos.com/virusinfo/analyses/w32sdbotaja.html

Type
Spyware Trojan

Aliases
Trojan-Spy.Win32.Banbra.df
PWS-Banker.gen.bb

Troj/Bancban-MP is a Trojan for the Windows platform.

Troj/Bancban-MP includes functionality to access the internet and communicate with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/trojbancbanmp.html

Type
Trojan

Aliases
Download.Trojan

Troj/Jupdrop-A is a dropper Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojjupdropa.html

Type
Trojan

Aliases
Trojan-Proxy.Win32.Delf.al

Troj/Jupdow-A is a Trojan for the Windows platform.

Troj/Jupdow-A attempts to download configuration files from a remote website to the Windows temp folder, and may then attempt to download files from further websites.

http://www.sophos.com/virusinfo/analyses/trojjupdowa.html