VIRUS ALERTS - December 23, 2005

Type
Spyware Trojan

Aliases
Trojan-Downloader.Win32.Dadobra.df

Troj/Dadobra-DF is a downloader Trojan for the Windows platform.

Troj/Dadobra-DF includes functionality to capture keystrokes, send email, display bitmap images, access the internet and communicate with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/trojdadobradf.html

Type
Trojan

Aliases
Trojan-Downloader.Win32.Small.avo

Troj/Dloader-RN is a downloader Trojan for the Windows platform. The Trojan downloads and executes a file from a preconfigured FTP server.

http://www.sophos.com/virusinfo/analyses/trojdloaderrn.html

Type
Trojan

Aliases
Trojan-Downloader.Win32.Banload.ib

Troj/Banload-H is a Trojan for the Windows platform.

Troj/Banload-H includes functionality to access the internet and communicate with a remote server via HTTP.

Troj/Banload-H may try to silently download and execute programs from a predefined web-site.

At the time of writing, this file is detected as Troj/Bancb-Fam.

http://www.sophos.com/virusinfo/analyses/trojbanloadh.html

Type
Trojan

Aliases
Trojan-Dropper.VBS.Inor.cz
JS/Exploit-HelpXSite

Troj/Webdrop-C is a downloader Trojan for the Windows platform.

Troj/Webdrop-C may attempt to download onto a susceptible computer files detected as Troj/Inor-Fam, Troj/DownLdr-DL, Troj/Dloader-KH, and Troj/Codebase-C.

http://www.sophos.com/virusinfo/analyses/trojwebdropc.html

Type
Trojan

Aliases
Downloader-AFH

Troj/Spywad-J is a Trojan for the Windows platform.

Troj/Spywad-J periodically displays fake warning messages in the Windows taskbar and attempts to change the user's Desktop wallpaper to another fake warning message.

http://www.sophos.com/virusinfo/analyses/trojspywadj.html

Type
Trojan

Aliases
Trojan-Downloader.Win32.Delf.wn

Troj/Dloadr-AAD is a Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojdloadraad.html

Type
Trojan

Aliases
Trojan-Downloader.Win32.Small.bfy
Generic Downloader.u
Download.Trojan

Troj/Dowadv-A is a downloader Trojan for the Windows platform.

Troj/Dowadv-A contacts a remote website to determine how many and which files to download.

Troj/Dowadv-A attempts to close certain notification windows related to anti-virus and security programs.

http://www.sophos.com/virusinfo/analyses/trojdowadva.html

Type
Spyware Trojan

Aliases
Trojan-Spy.Win32.Delf.bf
Win32/Spy.Delf.BF
TROJ_DELF.DO

Troj/Feutel-AH is a backdoor Trojan for the Windows platform.

Troj/Feutel-AH contains backdoor functionality that allows a remote user to:
access the computer's file system

create screen and video captures

listen in on the infected computer

download, upload and run files

log key presses

Troj/Feutel-AH may create a DLL file which is keylogging component of the Trojan.

http://www.sophos.com/virusinfo/analyses/trojfeutelah.html

Type
Spyware Trojan

Aliases
Trojan-Dropper.Win32.Agent.abo
trojan or variant New

Troj/Torpig-L is a Trojan for the Windows platform.

The Trojan attempts to steal passwords, as well as logging keypresses and open window titles to text files and periodically sends the collected information to a remote user via HTTP.

The Trojan downloads and executes additional files from a remote site. Configuration files may also be downloaded which define further behaviors.

Troj/Torpig-L automatically closes security warning messages displayed by common anti-virus and security-related applications.

http://www.sophos.com/virusinfo/analyses/trojtorpigl.html

Type
Worm

Aliases
Backdoor.Win32.Iroffer.23b05
W32/Sdbot.worm.gen.t
W32.Spybot.Worm

W32/Rbot-AXW is a network worm and IRC backdoor Trojan for the Windows platform. W32/Rbot-AXW runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels.

W32/Rbot-AXW spreads to other network computers by exploiting common buffer overflow vulnerabilities, including: LSASS (MS04-11) (CAN-2003-0812), RPC-DCO (MS04-012), WKS (MS03-049) (CAN-2003-0812) and ASN.1 (MS04-007) and by copying itself to network shares protected by weak passwords.

http://www.sophos.com/virusinfo/analyses/w32rbotaxw.html

Type
Trojan

Aliases
Backdoor.Win32.Prosti.c
AFXrootkit.gen
BKDR_PROSTI.D

Troj/Prosti-C is a backdoor Trojan creation kit.

Troj/Prosti-C is used to configure and create backdoor Trojan servers.

These servers are detected by Sophos Anti-Virus as W32/Bdoor-ZAR.

http://www.sophos.com/virusinfo/analyses/trojprostic.html

Type
Trojan

Aliases
Trojan-Downloader.Win32.Small.ccj

Troj/Small-FQ is a Trojan for the Windows platform.

Troj/Small-FQ has the functionality to download, install and run new software.

http://www.sophos.com/virusinfo/analyses/trojsmallfq.html

Type
Trojan

Aliases
Trojan.Win32.StartPage.afb
TROJ_STARTPAG.YC

Troj/Mifeng-E is a Trojan for the Windows platform.

Troj/Mifeng-E changes the Start Page for Microsoft Internet Explorer by setting the corresponding registry entry.

http://www.sophos.com/virusinfo/analyses/trojmifenge.html

Type
Trojan

Aliases
Trojan-PSW.Win32.Lmir.ans

Troj/Fasong-C is a Trojan for the Windows platform

http://www.sophos.com/virusinfo/analyses/trojfasongc.html

Type
Trojan

Aliases
Trojan-PSW.Win32.Lmir.ans
PWS-LegMir

Troj/Fasong-D is a Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojfasongd.html

Type
Trojan

Aliases
Trojan-PSW.Win32.Lmir.apk

Troj/Fasong-E is a Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojfasonge.html

Type
Worm

Aliases
WORM_SDBOT.CWF
W32/Tilebot-Gen

W32/Tilebot-GS is a worm and IRC backdoor for the Windows platform.

W32/Tilebot-GS spreads to other network computers by exploiting common buffer overflow vulnerabilities, including: LSASS (MS04-011), RPC-DCOM (MS04-012), WKS (MS03-049) (CAN-2003-0812), PNP (MS05-039) and ASN.1 (MS04-007) and by copying itself to network shares protected by weak passwords.

W32/Tilebot-GS runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels.

W32/Tilebot-GS includes functionality to access the internet and communicate with a remote server via HTTP.

Sophos's anti-virus products include Genotype? detection technology, which can proactively protect against new threats without requiring an update. Sophos customers have been protected against W32/Tilebot-GS (detected as W32/Tilebot-Gen) since version 3.97

The following patches for the vulnerabilities exploited by W32/Tilebot-GS are available from Microsoft:

http://www.microsoft.com/technet/security/bulletin/ms03-049.mspx

http://www.microsoft.com/technet/security/bulletin/ms04-007.mspx

http://www.microsoft.com/technet/security/bulletin/ms04-011.mspx

http://www.microsoft.com/technet/security/bulletin/ms04-012.mspx

http://www.microsoft.com/technet/security/bulletin/ms05-039.mspx

http://www.sophos.com/virusinfo/analyses/w32tilebotgs.html

Type
Trojan

Aliases
BackDoor-CKA
Trojan.Bifrose-4

Troj/Bckdr-AY is a backdoor Trojan for the Windows platform that may arrive bundled with other malware.

http://www.sophos.com/virusinfo/analyses/trojbckdray.html

Type
Trojan

Troj/ServU-BS is a hacked version of a commercial FTP application.

By default, the Trojan runs an ftp server on TCP port 43958. This can be overriden by configuration data read from a file called comtcldebug.dll in the current folder.

http://www.sophos.com/virusinfo/analyses/trojservubs.html

Type
Spyware Trojan

Aliases
Trojan.Win32.Small.ev

Troj/Spyjack-I is a Trojan for the Windows platform.

Troj/Spyjack-I includes functionality to access the internet and communicate with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/trojspyjacki.html

Type
Trojan

Aliases
Trojan.Win32.StartPage.jy
StartPage-DE

Troj/StartPa-IO is a Trojan for the Windows platform.

Troj/StartPa-IO attempts to prevent the Start Page of Internet Explorer being set to a certain website.

http://www.sophos.com/virusinfo/analyses/trojstartpaio.html

Type
Trojan

Aliases
Backdoor.Win32.VB.aoq

Troj/VB-NU is a backdoor Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojvbnu.html

Type
Trojan

Troj/VBbot-J is a backdoor Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojvbbotj.html

Type
Spyware Trojan

Aliases
Trojan-Downloader.Win32.Zlob.bl

Troj/Zlob-BL is a Trojan for the Windows platform.

Troj/Zlob-BL can download and run code from the internet, and steal information.

http://www.sophos.com/virusinfo/analyses/trojzlobbl.html

Type
Worm

VBS/BWG-D is a worm for the Windows platform.

VBS/BWG-D may attempt to spread using Microsoft Outlook. The worm may also delete anti-virus applications.

http://www.sophos.com/virusinfo/analyses/vbsbwgd.html

Type
Worm

W32/Cratab-A is a worm for the Windows platform.

W32/Cratab-A can copy itself to the A: drive as 1.bat or 2.bat.

http://www.sophos.com/virusinfo/analyses/w32crataba.html

Type
Worm

Aliases
Email-Worm.Win32.Bagle.ex

W32/Bagle-BY is an email worm for the Windows platform.

The worm sends email containing an attached ZIP file. At the time of writing, these ZIP files and the contained EXE files are detected by Sophos's anti-virus products as Troj/BagleDl-AZ.

The email may use one of the following for a message subject:

New Year's
New Year's Day.
Happy New Year
We congratulate happy New Year

The message text may contain either "The password is <image file>" or "Password: <image file>"

http://www.sophos.com/virusinfo/analyses/w32bagleby.html

Type Trojan

Aliases Email-Worm.Win32.Bagle.ev

Troj/Bagle-AS is a backdoor Trojan.
When the Trojan executes it will start a backdoor and send connection information to a number of websites.

http://www.sophos.com/virusinfo/analyses/trojbagleas.html

Type Worm

Sophos's anti-virus products detect members of the W32/Ixbot family of IRC backdoor worms as W32/Ixbot-Gen.
The worm usually spread using the AOL Instant Messenger service.
Members of the W32/Ixbot family of worms typically include functionality to:
- remove or disable registry entries related to security and anti-virus
applications
- download files from the internet

http://www.sophos.com/virusinfo/analyses/w32ixbotgen.html

Type
Trojan

Aliases
W32/Bagle.dldr

Troj/BagleDl-AZ is a Trojan for the Windows platform.

Troj/BagleDl-AZ includes functionality to access the internet and communicate with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/trojbagledlaz.html