VIRUS ALERTS - December 22, 2005

Type
Spyware Worm

Aliases
Backdoor.Win32.Rbot.akr

W32/Rbot-BFM is a network worm with backdoor Trojan functionality for the Windows platform.

W32/Rbot-BFM spreads using a variety of techniques including:

-exploiting weak passwords on computers and SQL servers
-exploiting operating system vulnerabilities such as LSASS (MS04-011) and RPC-DCOM (MS04-012)
-using backdoors opened by other worms or Trojans.

W32/Rbot-BFM can be controlled by a remote attacker over IRC channels.

http://www.sophos.com/virusinfo/analyses/w32rbotbfm.html

Type
Trojan

Aliases
Backdoor.Win32.SdBot.aad
IM.Giftcom.All

Troj/Dropper-CD is a Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojdroppercd.html

Type
Worm

Aliases
Backdoor.Win32.SdBot.aad
W32/Sdbot.worm.gen.g
W32.Spybot.Worm
IM.Giftcom.All

W32/Tilebot-CR is a worm for the Windows platform.

W32/Tilebot-CR spreads to other network computers by exploiting common buffer overflow vulnerabilities, including: WKS (MS03-049) (CAN-2003-0812), PNP (MS05-039) and ASN.1 (MS04-007) and via AOL Instant Messenger.

W32/Tilebot-CR runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels.

W32/Tilebot-CR includes functionality to:

- set up an FTP server
- spread via AOL Instant Messager by sending messages automatically
- change Internet Explorer start page
- set or remove network shares
- port scanning
- packet sniffing
- access the internet and communicate with a remote server via HTTP
- harvest information from clipboard

Sophos's anti-virus products include Genotype? detection technology, which can proactively protect against new threats without requiring an update. Sophos customers have been protected against W32/Tilebot-CR (detected as W32/Tilebot-Gen) since version 3.99.

http://www.sophos.com/virusinfo/analyses/w32tilebotcr.html

Type
Spyware Worm

Aliases
WORM_RBOT.CWA
Backdoor.Win32.SdBot.ajf

W32/Rbot-CWA is a network worm with backdoor Trojan functionality for the Windows platform.

W32/Rbot-CWA spreads using a variety of techniques including:

-exploiting weak passwords on computers and SQL servers
-exploiting operating system vulnerabilities
-using backdoors opened by other worms or Trojans.

W32/Rbot-CWA can be controlled by a remote attacker over IRC channels.

http://www.sophos.com/virusinfo/analyses/w32rbotcwa.html

Type
Trojan

Troj/DownLdr-IM is a Trojan for the Windows platform.

Troj/DownLdr-IM includes functionality to download, install and run new software.

http://www.sophos.com/virusinfo/analyses/trojdownldrim.html

Type
Spyware Trojan

Aliases
Trojan-Spy.Win32.Banbra.ee

Troj/Bancos-IJ is a password stealing Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojbancosij.html

Type
Spyware Trojan

Aliases
Trojan-Spy.Win32.Banker.ang

Troj/Bander-T is a Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojbandert.html

Type
Spyware Trojan

Aliases
Trojan-Spy.Win32.Banker.ahy

Troj/Bancban-NT is a Trojan for the Windows platform.

Troj/Bancban-NT includes functionality to send notification messages to remote locations.

http://www.sophos.com/virusinfo/analyses/trojbancbannt.html

Type
Trojan

Aliases
Trojan-Downloader.Win32.Small.bgy

Troj/MancSyn-B is a Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojmancsynb.html

Type
Spyware Trojan

Aliases
Trojan-Spy.Win32.Filtek.b

Troj/Rumale-D is a Keylogging Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojrumaled.html

Type
Spyware Trojan

Aliases
Trojan-Spy.Win32.Banker.ahy
W32/Banker.GVL

Troj/Bancban-MU is a internet banking Trojan for the Windows platform.

Troj/Bancban-MU includes functionality to send notification messages to remote locations.

http://www.sophos.com/virusinfo/analyses/trojbancbanmu.html

Type
Spyware Trojan

Aliases
Backdoor.Win32.Agent.nc

Troj/Bckdr-AX is a Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojbckdrax.html

Type
Spyware Trojan

Aliases
Trojan-Spy.Win32.Banker.to

Troj/Bancban-MV is a Trojan for the Windows platform.

Troj/Bancban-MV includes functionality to send notification messages to remote locations.

http://www.sophos.com/virusinfo/analyses/trojbancbanmv.html

Type
Worm

W32/Rbot-BFN is a worm and IRC backdoor Trojan for the Windows platform.

W32/Rbot-BFN spreads to other network computers by exploiting common buffer overflow vulnerabilities, including: LSASS (MS04-011), WKS (MS03-049) (CAN-2003-0812) and ASN.1 (MS04-007).

W32/Rbot-BFN runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels.

http://www.sophos.com/virusinfo/analyses/w32rbotbfn.html

Type
Trojan

Aliases
Backdoor.Win32.GrayBird.ev
BackDoor-ALC

Troj/GrayBrd-AY is a backdoor Trojan for the Windows platform.

Troj/GrayBrd-AY includes functionality to access the internet and communicate with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/trojgraybrday.html

Type
Trojan

Aliases
Downloader-ACK
Trojan-Downloader.Win32.Banload.my

Troj/Dloadr-ACR is a Trojan for the Windows platform.

Troj/Dloadr-ACR has the functionalities to:

- access the Internet
- silently download, install and run new software

http://www.sophos.com/virusinfo/analyses/trojdloadracr.html

Type
Trojan

Aliases
Trojan-Downloader.Win32.Banload.ls

Troj/Banload-DJ is a Trojan for the Windows platform.

Troj/Banload-DJ has the functionalities to:

- silently download, install and run new software
- modify Windows Firewall setting

http://www.sophos.com/virusinfo/analyses/trojbanloaddj.html

Type
Spyware Trojan

Aliases
Trojan-Spy.Win32.Banbra.df

Troj/Bancban-MT is an internet banking Trojan for the Windows platform.

Troj/Bancban-MT has the functionalities to:

- steal information
- send notification messages to a remote location via email

http://www.sophos.com/virusinfo/analyses/trojbancbanmt.html

Type
Spyware Trojan

Aliases
PWS-Banker.gen.ba
PWSteal.Banpaes

Troj/Bancban-MK is an Internet banking Trojan for the Windows platform.

Troj/Bancban-MK includes the functionalities to:

- send messages to a remote location
- steal information

http://www.sophos.com/virusinfo/analyses/trojbancbanmk.html

Type
Spyware Trojan

Aliases
Trojan-Spy.Win32.Banker.anx
PWS-Banker.gen.i

Troj/Bancban-MJ is a Trojan for the Windows platform.

Troj/Bancban-MJ attempts to log information sent to certain websites and online banking applications. The Trojan may display fake user interfaces in order to persuade the user to enter confidential details. Stolen information is sent by email to a remote user

Troj/Bancban-MJ may also perform the following functions:

- start a Proxy server
- download and execute additional files

http://www.sophos.com/virusinfo/analyses/trojbancbanmj.html

Type
Spyware Trojan

Aliases
Trojan-Spy.Win32.Banker.yy
PWS-Banker.gen.h
PWSteal.Banpaes

Troj/Bander-S is a Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojbanders.html

Type
Spyware Trojan

Aliases
Trojan-Spy.Win32.Banpaes.w
PWS-Banker.gen.h
PWSteal.Banpaes

Troj/Bander-R is a Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojbanderr.html

Type
Worm

Aliases
Backdoor.Win32.Spyboter.gen

W32/Bropia-U is a worm for the Windows platform.

W32/Bropia-U spreads via file sharing on P2P networks.

W32/Bropia-U includes functionality to access the internet and communicate with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/w32bropiau.html

Type
Spyware Worm

Aliases
W32/Protoride.worm

W32/Protorid-AG is a worm and IRC backdoor Trojan for the Windows platform.

W32/Protorid-AG spreads to other network computers infected with: Troj/NetDevil, W32/MyDoom, W32/Bagle and Troj/Optix and by copying itself to network shares protected by weak passwords.

W32/Protorid-AG runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels.

http://www.sophos.com/virusinfo/analyses/w32protoridag.html

Type
Spyware Trojan

Aliases
IM-Worm.Win32.Delf.a

Troj/Mesoto-A is a Trojan for the Windows platform.

Troj/Mesoto-A attempts to steal passwords and user information related to Microsoft MSN Messenger, and may send stolen information to a remote user via email.

Troj/Mesoto-A may display a fake MSN screen to encourage users to enter their details.

Troj/Mesoto-A may display a fake MSN screen.

http://www.sophos.com/virusinfo/analyses/trojmesotoa.html

note: Screen shot on above link. Click on where it says "description" when you get to the page.

Type
Trojan

Aliases
DNSChanger.a

Troj/DNSChan-K is a Trojan for the Windows platform.

Troj/DNSChan-K includes functionality to access the internet and communicate with a remote server via HTTP.

Troj/DNSChan-K also attempts to modify DNS settings on the computer.

http://www.sophos.com/virusinfo/analyses/trojdnschank.html

Type
Trojan

Troj/Zlob-AJ is a Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojzlobaj.html

Type
Trojan

Aliases
Trojan.Bagle.BN

Troj/BagleDl-AS is a Trojan for the Windows platform.

Troj/BagleDl-AS includes functionality to access the internet and communicate with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/trojbagledlas.html

Type
Trojan

Aliases
Email-Worm.Win32.Bagle.ex

Troj/BagleDl-AT is a downloader Trojan for the Windows platform.

Troj/BagleDl-AT downloads a file to the windows folder as <random number>.exe.
At the time of writing the downloaded file is detected by Sophos's anti-virus products as W32/Bagle-AR.

http://www.sophos.com/virusinfo/analyses/trojbagledlat.html

Type
Trojan

Troj/BagleDl-AU is a Trojan for the Windows platform.

Troj/BagleDl-AU includes functionality to access the internet and communicate with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/trojbagledlau.html