VIRUS ALERTS - December 27, 2005

Type
Trojan

Aliases
Trojan-Downloader.Win32.Agent.kx
BackDoor-CFO

Troj/Agent-IK is a Trojan for the Windows platform.

Troj/Agent-IK includes functionality to access the internet and communicate with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/trojagentik.html

Type
Trojan

Aliases
Trojan.Win32.Pakes
W32/Agent.WT

Troj/Agent-IJ is a Trojan for the Windows platform.

Troj/Agent-IJ includes functionality to download, install and run new software.

http://www.sophos.com/virusinfo/analyses/trojagentij.html

Type
Trojan

Aliases
AdClicker-DN

Troj/MarktMan-C is a downloader Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojmarktmanc.html

Type
Trojan

Troj/Agent-II is a Trojan for the Windows platform.

Troj/Agent-II runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels.

http://www.sophos.com/virusinfo/analyses/trojagentii.html

Type
Worm

Aliases
Virus.Win32.VB.ab

W32/Sweate-A is a worm for the Windows platform.

W32/Sweate-A displays a fake error message when executed, and attempts to
copy itself to various locations.

http://www.sophos.com/virusinfo/analyses/w32sweatea.html

Type
Worm

Aliases
Backdoor.Win32.Landis.q
W32/NoChod@MM
Virkel.F

W32/Chode-Q is an instant messaging worm for the Windows platform with IRC backdoor functionality.

W32/Chode-Q attempts to spread via MSN Instant Messenger and AOL Instant Messenger by sending users a link to a copy of the worm.

http://www.sophos.com/virusinfo/analyses/w32chodeq.html

Type
Spyware Trojan

Aliases
Trojan-Spy.Win32.Banpaes.w
PWS-Banker.gen.i

Troj/Bander-X is a Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojbanderx.html

Type
Spyware Trojan

Aliases
Trojan-Spy.Win32.Banker.yy
PWS-Banker.gen.i

Troj/Bander-Y is a Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojbandery.html

Type
Spyware Trojan

Aliases
Trojan-Spy.Win32.Banker.ang
PWS-Banker.gen.g

Troj/Bander-Z is a Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojbanderz.html

Type
Trojan

Aliases
BackDoor.k

Troj/VB-NV is a backdoor server for Windows platform.

Troj/VB-NV is capable of:
Downloading files from remote servers
Stealing various computer information
Running a network traffic proxy

http://www.sophos.com/virusinfo/analyses/trojvbnv.html

Type
Trojan

Troj/Puper-AB is a Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojpuperab.html

Type
Trojan

Aliases
Trojan.Win32.StartPage.adi

Troj/StartPa-IP is a Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojstartpaip.html

Type Spyware Worm

W32/Hazif-C is a password stealing worm for the Windows platform.
W32/Hazif-C can spread to the floppy drive with a preconfigured filename.
W32/Hazif-C can be used to steal passwords for Yahoo Instant Messenger and can be preconfigured to send stolen passwords via email, Yahoo IM, or by accessing a remote URL.

http://www.sophos.com/virusinfo/analyses/w32hazifc.html

Type Trojan

Aliases Backdoor.Win32.Robobot.az
DDoS-Boxed

Troj/Borobot-V is an IRC backdoor Trojan for windows platform.

http://www.sophos.com/virusinfo/analyses/trojborobotv.html

Type Trojan

Troj/Small-FS is a Trojan for the Windows platform.
Troj/Small-FS includes functionality to access the internet and communicate with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/trojsmallfs.html

Type Trojan

Aliases Trojan-Downloader.Win32.Harnig.ax

Troj/Dloadr-AH is a Trojan for the Windows platform.
Troj/Dloadr-AH includes functionality to access the internet and communicate with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/trojdloadrah.html

Type Spyware Worm

Aliases Backdoor.Win32.Rbot.alk
W32/Sdbot.worm.gen.ae

W32/Rbot-BFV is a network worm with backdoor Trojan functionality for the Windows platform.
W32/Rbot-BFV spreads using a variety of techniques including:
-exploiting weak passwords on computers and SQL servers
-exploiting operating system vulnerabilities
-using backdoors opened by other worms or Trojans.
W32/Rbot-BFV can be controlled by a remote attacker over IRC channels. The backdoor component of W32/Rbot-BFV can be instructed by a remote user to perform the following functions:
start an FTP server
start a Proxy server
start a web server
take part in distributed denial of service (DDoS) attacks
log keypresses
capture screen/webcam images
packet sniffing
port scanning
download/execute arbitrary files
start a remote shell (RLOGIN)
steal product registration information from certain software

http://www.sophos.com/virusinfo/analyses/w32rbotbfv.html

Type Spyware Worm

Aliases Backdoor.Win32.IRCBot.az

W32/Rbot-BFU is a network worm with backdoor Trojan functionality for the Windows platform.
W32/Rbot-BFU spreads using a variety of techniques including:
-exploiting weak passwords on computers and SQL servers
-exploiting operating system vulnerabilities
-using backdoors opened by other worms or Trojans.
W32/Rbot-BFU can be controlled by a remote attacker over IRC channels. The backdoor component of W32/Rbot-BFU can be instructed by a remote user to perform the following functions:
start an FTP server
start a Proxy server
start a web server
take part in distributed denial of service (DDoS) attacks
log keypresses
capture screen/webcam images
packet sniffing
port scanning
download/execute arbitrary files
start a remote shell (RLOGIN)
steal product registration information from certain software

http://www.sophos.com/virusinfo/analyses/w32rbotbfu.html

Type Trojan

Aliases Trojan-PSW.Win32.VB.fu
PWS.g

Troj/HazifKit-B is a tool for creating password-stealing Trojans.
Trojans produced using this tool are detected as Troj/Hazif-C.

http://www.sophos.com/virusinfo/analyses/trojhazifkitb.html

Type Trojan

Troj/Agent-IH is a Trojan for the Windows platform.
Troj/Agent-IH will harvest email addresses from the infected computer and report them to a remote URL.
Troj/Agent-IH may inject code into running processes in order to avoid detection.

http://www.sophos.com/virusinfo/analyses/trojagentih.html

Type Spyware Trojan

Aliases PWS-Banker.gen.t

Troj/Iyus-P is a password stealing Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojiyusp.html

Type Spyware Trojan

Aliases Trojan-PSW.Win32.Agent.an

Troj/Agent-HZ is a password stealing Trojan for the Windows platform.
Troj/Agent-HZ has the functionalities to:
- steal email server passwords
- send notification messages to remote locations
- access the Internet and communicate with a remote server via HTTP

http://www.sophos.com/virusinfo/analyses/trojagenthz.html

Type Spyware Trojan

Aliases Trojan-PSW.Win32.Lmir.kn
W32/Legendmir.FJ

Troj/LegMir-CN is a password stealing Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojlegmircn.html

Type Worm

Aliases Email-Worm.Win32.Zafi.g
W32.Erkez.G@mm

W32/Erkez-G is an email and peer-to-peer worm for the Windows platform.
W32/Erkez-G sends emails in the following format, where the subject and message are chosen depending upon the email address the worm is being sent to:
Subject:
msn photo ecard,commercial ecard )
broma ),humor )
rolig reklam ),haha - rolig )
witzig reklame ),witzig bild
grappig beeld ),een grappig reclame
blague ),humour - reclame )
cherzo ),comico quadro )
Message:
ImageFormat: <Size>
ImageSize: <Size Kb>
Message: you need to see this )
From: <Name>
Date: <Date sent>
AV-Control: <Filename>
Cuadro/Format: <Size>
Cuadro/Medida: <Size Kb>
Mensaje: Sexo y humor para pasar un buen rato! )
Expedidor: <Name>
Data: <Date sent>
Control: <Filename>

MORE: http://www.sophos.com/virusinfo/analyses/w32erkezg.html

Type Worm

W32/Rbot-AQM is a worm and IRC backdoor Trojan for the Windows platform.
W32/Rbot-AQM spreads:
- to other network computers infected with: Troj/Kuang, Troj/Sub7, Troj/NetDevil, W32/MyDoom, W32/Bagle and Troj/Optix
- to other network computers by exploiting common buffer overflow vulnerabilities, including: LSASS (MS04-011), RPC-DCOM (MS04-012), IIS5SSL (MS04-011) (CAN-2003-0719), UPNP (MS01-059) and Dameware (CAN-2003-1030)
- by copying itself to network shares protected by weak passwords
W32/Rbot-AQM runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels.

http://www.sophos.com/virusinfo/analyses/w32rbotaqm.html

Type Worm

Aliases Rootkit.Win32.Agent.ap
W32.IRCBot
W32/Poebot.gen

W32/Poebot-N is a worm for the Windows platform.
W32/Poebot-N spreads to other network computers by exploiting common buffer overflow vulnerabilities, including: LSASS (MS04-011), RPC-DCOM (MS04-012), WKS (MS03-049) (CAN-2003-0812), WebDav (MS03-007), Veritas (CAN-2004-1172), Dameware (CAN-2003-1030), PNP (MS05-039) and ASN.1 (MS04-007) and by copying itself to network shares protected by weak passwords.

http://www.sophos.com/virusinfo/analyses/w32poebotn.html

Type Trojan

Aliases Trojan-Proxy.Win32.Daemonize.bl
PWS-Vipgsm

Troj/Daemoni-N is a backdoor Trojan which allows a remote intruder to gain access and control over the computer.
Troj/Daemoni-N includes functionality to access the internet and communicate with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/trojdaemonin.html

Type Trojan

Aliases Trojan.PSP.Brick.a
Trojan.PSPBrick

Troj/PSPBrick-A is a trojan for the Sony Playstation Station Portable (PSP).
WhenTroj/PSPBrick-A is executed it displays a message which claims it is a hack for the PSP 2.0 firmware. The following files are then deleted resulting in the device being unusable.
/vsh/etc/index.dat
/kd/loadcore.prx
/kd/loadexec.prx
/kd/init.prx

http://www.sophos.com/virusinfo/analyses/trojpspbricka.html

Type Worm

Aliases Backdoor.Win32.Rbot.aeh
W32.IRCBot
W32/Kelvir.worm.gen virus

W32/Rbot-AQO is a worm and IRC backdoor Trojan for the Windows platform which allows a remote intruder to gain access and control over the computer.
When first run W32/Rbot-AQO copies itself to <System>\winl32xe.exe and creates registry entries to run winl32xe.exe on startup.

http://www.sophos.com/virusinfo/analyses/w32rbotaqo.html

Type Worm

Aliases Backdoor.Win32.Rbot.adf
W32/Sdbot.worm.gen.ar
W32.Spybot.Worm

W32/Rbot-AQP is a worm and IRC backdoor Trojan for the Windows platform.
W32/Rbot-AQP spreads to other network computers infected with: Troj/Kuang, Troj/Sub7, Troj/NetDevil, W32/MyDoom, W32/Bagle and Troj/Optix and to other network computers by exploiting common buffer overflow vulnerabilities, including: LSASS (MS04-011), RPC-DCOM (MS04-012), WKS (MS03-049) (CAN-2003-0812), WebDav (MS03-007), IIS5SSL (MS04-011) (CAN-2003-0719), UPNP (MS01-059), Veritas (CAN-2004-1172), Dameware (CAN-2003-1030) and ASN.1 (MS04-007).
W32/Rbot-AQP runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels.

http://www.sophos.com/virusinfo/analyses/w32rbotaqp.html