VIRUS ALERTS - December 23, 2005

Type Trojan

Aliases Trojan-Downloader.Win32.Agent.wn
in32/TrojanDownloader.Small.AOD

Troj/Dloadr-AAV is a Trojan for the Windows platform.
Troj/Dloadr-AAV downloads and executes several additional files from remote sites.

http://www.sophos.com/virusinfo/analyses/trojdloadraav.html

Type Trojan

Aliases Email-Worm.Win32.Bagle.ev

Troj/BagleDl-AL is a Trojan for the Windows platform.
Troj/BagleDl-AL attempts to remove services, processes, files and registry entries associated with anti-virus and security software.

http://www.sophos.com/virusinfo/analyses/trojbagledlal.html

Type Spyware Trojan

Aliases Trojan-Spy.Win32.Banker.ahy

Troj/Banker-HZ is a Trojan for the Windows platform.
The Trojan monitors Internet Explorer sessions and attempts to steal credentials entered into login forms on certain financial websites. Collected information is sent to a remote attacker via email or FTP.


http://www.sophos.com/virusinfo/analyses/trojbankerhz.html

Type Spyware Trojan

Aliases Trojan-PSW.Win32.Gamania.ai

Troj/Lineage-BO is a password stealing and keylogging Trojan for the Windows
platform.
Troj/Lineage-BO sends the stolen information to a remote user via HTTP.

http://www.sophos.com/virusinfo/analyses/trojlineagebo.html

Type Trojan

Troj/Pujebot-A is a Trojan for the Windows platform.
When run, Troj/Pujebot-A connects to an IRC server and joins a predetermined channel and awaits commands from remote attackers.

http://www.sophos.com/virusinfo/analyses/trojpujebota.html

Type Spyware Trojan

Aliases Trojan-PSW.Win32.Lineage.or

Troj/Lineage-OR is a password stealing Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojlineageor.html

Type Worm

Aliases Backdoor.Win32.IRCBot.je

W32/Rbot-AZC is a worm and IRC backdoor Trojan for the Windows platform.
W32/Rbot-AZC runs continuously in the background, providing a backdoor server
which allows a remote intruder to gain access and control over the computer via
IRC channels.

http://www.sophos.com/virusinfo/analyses/w32rbotazc.html

Type Spyware Trojan

Aliases Trojan-PSW.Win32.Lineage.lp
TSPY_LINEAGE.LC

Troj/Lineage-BN is a password stealing Trojan for the Windows platform that
attempts to steal passwords associated with the game called "Lineage".
Troj/Lineage-BN includes functionality to access the internet and communicate
with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/trojlineagebn.html

Type Spyware Worm

Aliases Email-Worm.Win32.Locksky.f
W32.Looksky.A@mm
WORM_LOCKSKY.A

W32/Loosky-C is a multi-component email worm with Trojan functionality for the
Windows platform.
W32/Loosky-C acts as a proxy, rerouting information through the infected
computer.
W32/Loosky-C has a backdoor component that can send information about the
infected computer to a remote user, modify and run files on the infected
computer as well as download and execute files if instructed to do so.
W32/Loosky-C attempts to send itself to email addresses harvested from the
infected computer. Emails sent have the following characteristics:
Subject line:
Oh my god! Can't believe this
Message text:
Guess what happened!
I joined this amazing dat.ing portal and met 6 girls in my city in half a day!
I got laid 4 times this week, and now I don't know how to explain you but
there's no way I can handle all these chicks who love to have fun !
I never imagined there'd be so many hot/cool chicks in my area willing to
just meet up and have fun.
Buddy, I highly recommed this, log on, it's no charge! Get a cool nickname
and start dating.
This is the right time
Attachment name:
homebiz_2.exe

http://www.sophos.com/virusinfo/analyses/w32looskyc.html

Type Trojan

Aliases Trojan-Downloader.Win32.Bagle.n

Troj/BagleDl-BA is a Trojan for the Windows platform.
Troj/BagleDl-BA includes functionality to access the internet and communicate with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/trojbagledlba.html

Type Trojan

Troj/BagleDl-BB is a Trojan for the Windows platform.
Troj/BagleDl-BB includes functionality to access the internet and communicate with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/trojbagledlbb.html

Type Trojan

Troj/BagleDl-BC is a Trojan for the Windows platform.
Troj/BagleDl-BC includes functionality to access the internet and communicate with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/trojbagledlbc.html

Type Trojan

Troj/BagleDl-BD is a Trojan for the Windows platform.
Troj/BagleDl-BD includes functionality to access the internet and communicate with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/trojbagledlbd.html