VIRUS ALERTS - December 27, 2005

Type Worm

W32/Mytob-GF is a mass-mailing worm and IRC backdoor Trojan for the Windows platform.
W32/Mytob-GF runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels.
Messages sent by the worm will have the following characteristics.
Subject title chosen from:
Notice: **Last Warning**
*IMPORTANT* Please Confirm Your Account
Account Alert
Notice of account limitation
Important Notification
*IMPORTANT* Please Validate Your Account
Security measures
<random characters>
Message text:
'Dear Valued Member,
According to our terms of services, you will have to confirm your e-mail by the following link or your account will be suspended within 24 hours for security reasons.
<link to worm>
Thank you for your attention to this request. We apologize for any inconvenience.
Sincerely <random name> Security Department'

http://www.sophos.com/virusinfo/analyses/w32mytobgf.html

Type Trojan

Aliases Email-Worm.Win32.Bagle.ex
Trojan.Lodeight.A

Troj/BagleDl-BE is a downloader Trojan for the Windows platform.
Troj/BagleDl-BE includes functionality to access the internet and communicate with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/trojbagledlbe.html

Type Worm

Aliases WORM_SDBOT.CUA

W32/Sdbot-AJR is a worm and IRC backdoor Trojan for the Windows platform.
W32/Sdbot-AJR runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels.
W32/Sdbot-AJR includes functionality to access the internet and communicate with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/w32sdbotajr.html

Type Trojan

Aliases Trojan-Downloader.Win32.Banload.ez
Downloader-ABU
TROJ_BANLOAD.AK

Troj/Dadobra-M is a Trojan for Windows platform.
Troj/Dadobra-M has the following functionalities:
- communicate with a remote server via HTTP
- download file from a remote server via HTTP and run the file
- send emails to the email addresses found on an infected computer


http://www.sophos.com/virusinfo/analyses/trojdadobram.html

Type Trojan

Troj/Akbot-A is a Trojan for the Windows platform.
Troj/Akbot-A runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels.

http://www.sophos.com/virusinfo/analyses/trojakbota.html

Type Trojan

Aliases Trojan-Downloader.Win32.Dadobra.cu

Troj/Dadobra-CU is a Trojan for the Windows platform.
Troj/Dadobra-CU includes functionality to access the internet and communicate with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/trojdadobracu.html

Type Trojan

Aliases WORM_RBOT.DAP

W32/Rbot-BFW is a worm and IRC backdoor Trojan for the Windows platform.
W32/Rbot-BFW spreads to other network computers by exploiting common buffer overflow vulnerabilities, including: LSASS (MS04-011), RPC-DCOM (MS04-012), WKS (MS03-049) (CAN-2003-0812) and ASN.1 (MS04-007) and by copying itself to network shares protected by weak passwords.

http://www.sophos.com/virusinfo/analyses/w32rbotbfw.html

Type Trojan

Aliases Trojan-Downloader.Win32.Zlob.dk
Downloader-XC

Troj/Zlob-AK is a Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojzlobak.html

Type Worm

W32/Rbot-BFY is a worm and IRC backdoor Trojan for the Windows platform.
W32/Rbot-BFY spreads:
- to other network computers infected with: Troj/Kuang, Troj/Sub7, Troj/NetDevil, W32/MyDoom, W32/Bagle and Troj/Optix
- to other network computers by exploiting common buffer overflow vulnerabilities, including: LSASS (MS04-011), RPC-DCOM (MS04-012), IIS5SSL (MS04-011) (CAN-2003-0719) and Dameware (CAN-2003-1030)
- by copying itself to network shares protected by weak passwords

http://www.sophos.com/virusinfo/analyses/w32rbotbfy.html

Type Trojan

Aliases Trojan-Downloader.Win32.Dadobra.af

Troj/Dadobra-AF is a Trojan for the Windows platform.
Troj/Dadobra-AF includes functionality to access the internet and communicate with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/trojdadobraaf.html

Type Spyware Trojan

Aliases PWS-Banker.gen.f

Troj/Banker-OF is an internet banking and backdoor Trojan which allows a remote intruder to gain access and control over the computer.

http://www.sophos.com/virusinfo/analyses/trojbankerof.html

Type Trojan

Aliases Backdoor.Win32.ServU-based

Troj/ServU-BT is a modified version of a commercial FTP application.

http://www.sophos.com/virusinfo/analyses/trojservubt.html