VIRUS ALERTS - December 26, 2005

Type
Worm

Aliases
Backdoor.Win32.Rbot.gen
W32/Sdbot.worm.gen.bh

W32/Rbot-BFS is a worm and IRC backdoor Trojan for the Windows platform.

W32/Rbot-BFS spreads:

- to other network computers infected with: W32/MyDoom and W32/Bagle
- to other network computers by exploiting common buffer overflow vulnerabilities, including: LSASS (MS04-011), RPC-DCOM (MS04-012), WKS (MS03-049) (CAN-2003-0812), WebDav (MS03-007), IIS5SSL (MS04-011) (CAN-2003-0719), Veritas (CAN-2004-1172) and ASN.1 (MS04-007)
- by copying itself to network shares protected by weak passwords

W32/Rbot-BFS runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels.

http://www.sophos.com/virusinfo/analyses/w32rbotbfs.html

Type
Worm

Aliases
Email-Worm.Win32.Brontok.c

W32/Brontok-I is a worm for the Windows platform.

http://www.sophos.com/virusinfo/analyses/w32brontoki.html

Type
Worm

W32/Brontok-H is a worm for the Windows platform.

http://www.sophos.com/virusinfo/analyses/w32brontokh.html

Type
Spyware Trojan

Aliases
Backdoor.Win32.PcClient.jf
BackDoor-CKB

Troj/PcClient-X is a backdoor Trojan for the Windows platform that provides unauthorized remote access to the infected computer.

Troj/PcClient-X includes keylogging functionality.

http://www.sophos.com/virusinfo/analyses/trojpcclientx.html

Type
Trojan

Aliases
Trojan-Downloader.Win32.B

Troj/Banload-AI is a Trojan for the Windows platform.

Troj/Banload-AI includes functionality to access the internet and communicate with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/trojbanloadai.html

Type
Trojan

Troj/Bander-AD is a Trojan for the Windows platform.

Troj/Bander-AD includes functionality to access the internet and communicate with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/trojbanderad.html

Type
Spyware Trojan

Troj/Agent-IG is a Trojan for the Windows platform.

Troj/Agent-IG is capable of spying on a user's browsing habits, modifying Microsoft Internet Explorer settings, downloading further executables and displaying popup advertisements.

http://www.sophos.com/virusinfo/analyses/trojagentig.html

Type
Spyware Trojan

Troj/Agent-IF is a Trojan for the Windows platform.

Troj/Agent-IF is capable of spying on a user's browsing habits, modifying Microsoft Internet Explorer settings, downloading further executables and displaying popup advertisements.

http://www.sophos.com/virusinfo/analyses/trojagentif.html

Type
Trojan

Aliases
Trojan-Proxy.Win32.Xorpix.h

Troj/Agent-IE is a Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojagentie.html

Type Trojan

Troj/Raker-B is a Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojrakerb.html

Type Spyware Trojan

Aliases PWS-JA

Troj/Torpig-V is an information stealing Trojan for the Windows platform.
The Trojan attempts to steal passwords, as well as logging keypresses and open window titles to text files and periodically sends the collected information to a remote user via HTTP.
Troj/Torpig-V automatically closes security warning messages displayed by common anti-virus and security related applications.

http://www.sophos.com/virusinfo/analyses/trojtorpigv.html

Type Spyware Worm

W32/Rbot-BFT is a worm and IRC backdoor Trojan for the Windows platform.
W32/Rbot-BFT spreads to other network computers by exploiting common buffer overflow vulnerabilities, including: LSASS (MS04-011), RPC-DCOM (MS04-012), WKS (MS03-049) (CAN-2003-0812), MSSQL (MS02-039) (CAN-2002-0649) and ASN.1 (MS04-007) and by copying itself to network shares protected by weak passwords.

http://www.sophos.com/virusinfo/analyses/w32rbotbft.html

Type Spyware Trojan

Aliases Trojan-Spy.Win32.Banker.dr

Troj/Banker-LI is a Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojbankerli.html

Type Trojan

Aliases Backdoor.Win32.Hupigon.qb

Troj/Hupigon-K is a Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojhupigonk.html

Type Spyware Trojan

Aliases Trojan-Spy.Win32.Banker.ahy

Troj/Bancban-MX is an internet banking Trojan for the Windows platform.
Troj/Bancban-MX has the functionalities to:
- enumerate windows and display fake screens
- steal information
- send notification messages to remote location via email

http://www.sophos.com/virusinfo/analyses/trojbancbanmx.html

Type Spyware Trojan

Aliases Trojan-PSW.Win32.Lineage.rk

Troj/Lineage-CG is a password stealing Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojlineagecg.html

Type Trojan

Aliases Trojan.Win32.StartPage.qp
W32/Startpage.FP

Troj/StartPa-IH is a Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojstartpaih.html

Type Worm

Aliases WORM_SDBOT.CWF
W32/Tilebot-Gen

W32/Tilebot-GS is a worm and IRC backdoor for the Windows platform.
W32/Tilebot-GS spreads to other network computers by exploiting common buffer overflow vulnerabilities, including: LSASS (MS04-011), RPC-DCOM (MS04-012), WKS (MS03-049) (CAN-2003-0812), PNP (MS05-039) and ASN.1 (MS04-007) and by copying itself to network shares protected by weak passwords.
W32/Tilebot-GS runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels.
W32/Tilebot-GS includes functionality to access the internet and communicate with a remote server via HTTP.
Sophos's anti-virus products include Genotype? detection technology, which can proactively protect against new threats without requiring an update. Sophos customers have been protected against W32/Tilebot-GS (detected as W32/Tilebot-Gen) since version 3.97
The following patches for the vulnerabilities exploited by W32/Tilebot-GS are available from Microsoft:
MS03-049
MS04-007
MS04-011
MS04-012
MS05-039

http://www.sophos.com/virusinfo/analyses/w32tilebotgs.html

Type Trojan

Aliases BackDoor-CKA
Trojan.Bifrose-4

Troj/Bckdr-AY is a backdoor Trojan for the Windows platform that may arrive bundled with other malware.

http://www.sophos.com/virusinfo/analyses/trojbckdray.html

Type Trojan

Troj/ServU-BS is a hacked version of a commercial FTP application.
By default, the Trojan runs an ftp server on TCP port 43958. This can be overriden by configuration data read from a file called comtcldebug.dll in the current folder.

http://www.sophos.com/virusinfo/analyses/trojservubs.html

Type Spyware Trojan

Aliases Trojan.Win32.Small.ev

Troj/Spyjack-I is a Trojan for the Windows platform.
Troj/Spyjack-I includes functionality to access the internet and communicate with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/trojspyjacki.html

Type Trojan

Aliases Trojan.Win32.StartPage.jy
StartPage-DE

Troj/StartPa-IO is a Trojan for the Windows platform.
Troj/StartPa-IO attempts to prevent the Start Page of Internet Explorer being set to a certain website.

http://www.sophos.com/virusinfo/analyses/trojstartpaio.html

Type Trojan

Aliases Backdoor.Win32.VB.aoq

Troj/VB-NU is a backdoor Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojvbnu.html

Type Trojan

Troj/VBbot-J is a backdoor Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojvbbotj.html

Type Spyware Trojan

Aliases Trojan-Downloader.Win32.Zlob.bl

Troj/Zlob-BL is a Trojan for the Windows platform.
Troj/Zlob-BL can download and run code from the internet, and steal information.

http://www.sophos.com/virusinfo/analyses/trojzlobbl.html

Type Worm

VBS/BWG-D is a worm for the Windows platform.
VBS/BWG-D may attempt to spread using Microsoft Outlook. The worm may also delete anti-virus applications.

http://www.sophos.com/virusinfo/analyses/vbsbwgd.html

Type Worm

W32/Cratab-A is a worm for the Windows platform.
W32/Cratab-A can copy itself to the A: drive as 1.bat or 2.bat.

http://www.sophos.com/virusinfo/analyses/w32crataba.html

Type Worm

Aliases Email-Worm.Win32.Bagle.ex

W32/Bagle-BY is an email worm for the Windows platform.
The worm sends email containing an attached ZIP file. At the time of writing, these ZIP files and the contained EXE files are detected by Sophos's anti-virus products as Troj/BagleDl-AZ.
The email may use one of the following for a message subject:
New Year's
New Year's Day.
Happy New Year
We congratulate happy New Year
The message text may contain either "The password is <image file>" or "Password: <image file>"

http://www.sophos.com/virusinfo/analyses/w32bagleby.html

Type Trojan

Aliases W32/Bagle.dldr

Troj/BagleDl-AZ is a Trojan for the Windows platform.
Troj/BagleDl-AZ includes functionality to access the internet and communicate with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/trojbagledlaz.html

Type Spyware Worm

W32/Hazif-C is a password stealing worm for the Windows platform.
W32/Hazif-C can spread to the floppy drive with a preconfigured filename.
W32/Hazif-C can be used to steal passwords for Yahoo Instant Messenger and can be preconfigured to send stolen passwords via email, Yahoo IM, or by accessing a remote URL.

http://www.sophos.com/virusinfo/analyses/w32hazifc.html