VIRUS ALERTS - December 28, 2005

Type
Trojan

Aliases
Backdoor.Win32.Bifrose.d

Troj/Bifrose-CH is a Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojbifrosech.html

Type
Trojan

Aliases
Trojan-Dropper.Win32.Delf.op

Troj/Dropper-CG is a Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojdroppercg.html

Type
Worm

Aliases
WORM_SDBOT.CVL
Backdoor.Win32.SdBot.ajn

W32/Sdbot-AJV is a worm and IRC backdoor Trojan for the Windows platform.

W32/Sdbot-AJV runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels.

http://www.sophos.com/virusinfo/analyses/w32sdbotajv.html

Type
Trojan

Aliases
Trojan-Downloader.Win32.Small.amb
StartPage-DU

Troj/DownLdr-JG is a downloader Trojan for the Windows platform.

Troj/DownLdr-JG includes functionality to access the internet and communicate with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/trojdownldrjg.html

Type
Trojan

Aliases
Trojan-Spy.Win32.Bancos.mn
PWS-Banker.gen.h

Troj/Bancban-MY is a Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojbancbanmy.html

Type
Worm

Aliases
Backdoor.Win32.SdBot.xd

W32/Sdbot-AJU is a worm and IRC backdoor Trojan for the Windows platform.

W32/Sdbot-AJU spreads to other network computers by exploiting common buffer overflow vulnerabilities, including: WKS (MS03-049) (CAN-2003-0812), PNP (MS05-039) and ASN.1 (MS04-007).

W32/Sdbot-AJU runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels.

http://www.sophos.com/virusinfo/analyses/w32sdbotaju.html

Type
Trojan

Troj/Spyaks-B is a Trojan for the Windows platform.

The Trojan downloads and installs additional files from a remote site.

Troj/Spyaks-B may create popup alerts with the title "Your computer is infected!" and the message text:

"Dangerous malware infection was detected on your PC
The system will now download and install most efficient anti malware program to prevent data loss and your private information theft.
Click here to protect your computer from the biggest malware threats."

http://www.sophos.com/virusinfo/analyses/trojspyaksb.html

Type
Trojan

Troj/Zlob-DA is a Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojzlobda.html

Type
Trojan

Troj/Yaemb-A is a Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojyaemba.html

Type
Trojan

Troj/VBClick-B is a Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojvbclickb.html

Type
Trojan

Troj/StartP-B is a Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojstartpb.html

Type
Trojan

Troj/Small-FO is a Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojsmallfo.html

Type
Trojan

Troj/Small-FN is a Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojsmallfn.html

Type
Trojan

Aliases
Trojan-Downloader.Win32.Small.ccm
Downloader-ASE

Troj/DownLdr-LA is a Trojan for the Windows platform.

Troj/DownLdr-LA includes functionality to access the internet and communicate with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/trojdownldrla.html

Type
Trojan

Aliases
W32/Backdoor.HPJ

Troj/Hackarmy-C is a backdoor Trojan which allows a remote intruder to gain access and control over the computer trough the randomly chosen TCP port or an IRC channel.

Troj/Hackarmy-C includes functionality to access the internet and communicate with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/trojhackarmyc.html

Type
Trojan

Aliases
Backdoor.Win32.HacDef.bo

Troj/Delta-F is a Trojan for the Windows platform.

Troj/Delta-F includes functionality to access the internet and communicate with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/trojdeltaf.html

Type
Trojan

Troj/Mircgirl-A is a backdoor Trojan for the Windows platform.

Troj/Mircgirl-A searches for files with a MRC extension (mIRC scripts) and appends them with code that causes another mirc script to load. This script may attempt to drop a thrid party DLL that extends the scripting capability of mIRC.

http://www.sophos.com/virusinfo/analyses/trojmircgirla.html

Type
Trojan

Aliases
Exploit.Win32.Agent.t
Exploit-WMF trojan

Troj/DownLdr-LW is a Windows Metafile (WMF) file which exploits a vulnerability allowing the download and execution of an EXE file from a remote URL.

At the time of writing, the downloaded file was Troj/DownLdr-LA.

http://www.sophos.com/virusinfo/analyses/trojdownldrlw.html

Type
Trojan

Aliases
Trojan.Win32.Crypt.p

Troj/Cinject-A is a Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojcinjecta.html

Type
Spyware Trojan

Aliases
Trojan-PSW.Win32.Agent.bu
PWS-JA trojan

Troj/Torpig-Y is a password stealing Trojan for the Windows platform.

Troj/Torpig-Y attempts to steal passwords, as well as logging keypresses and open window titles to text files and periodically sends the collected information to a remote user via HTTP.

http://www.sophos.com/virusinfo/analyses/trojtorpigy.html

Type
Worm

Aliases
Backdoor.Win32.Rbot.gen
WORM_RBOT.GEN

W32/Rbot-BGH is a worm with backdoor functionality for the Windows platform.

W32/Rbot-BGH spreads to other network computers by exploiting common buffer overflow vulnerabilities, including: LSASS (MS04-011), RPC-DCOM (MS04-012), WKS (MS03-049) (CAN-2003-0812), PNP (MS05-039) and ASN.1 (MS04-007) and by copying itself to network shares protected by weak passwords.

W32/Rbot-BGH runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels.

http://www.sophos.com/virusinfo/analyses/w32rbotbgh.html

Type
Trojan

Aliases
SpamTool.Win32.Mailbot.m

Troj/Mipbot-C is a Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojmipbotc.html

Type
Trojan

Aliases
Trojan-Downloader.Win32.Agent.acd
Exploit-WMF

Troj/DownLdr-NO is a Windows Metafile (WMF) file which exploits a vulnerability allowing the download and execution of an EXE file from a remote URL.

http://www.sophos.com/virusinfo/analyses/trojdownldrno.html

Type
Trojan

Aliases
Trojan-Downloader.Win32.Harnig.ax

Troj/DownLdr-NN is a downloader Trojan for the Windows platform.

Troj/DownLdr-NN attempts to download and execute several files from the internet.

http://www.sophos.com/virusinfo/analyses/trojdownldrnn.html

Type
Trojan

Troj/DownLdr-NM is a downloader Trojan for the Windows platform.

Troj/DownLdr-NM attempts to download and execute files from several servers.

http://www.sophos.com/virusinfo/analyses/trojdownldrnm.html

Type
Trojan

Troj/MisDOM-B is a downloading Trojan for the Windows platform.

Troj/MisDOM-B exploits the Mismatched Document Object Model Objects Memory Corruption vulnerability (MS05-054) in some versions of Internet Explorer.

http://www.sophos.com/virusinfo/analyses/trojmisdomb.html

Type
Trojan

Aliases
Trojan-Downloader.Win32.Agent.acd

Troj/DownLdr-NL is a Windows Metafile (WMF) file which exploits a vulnerability allowing the download and execution of an EXE file from a remote URL.

At the time of writing, the downloaded file was detected as Troj/Bizves-Gen.

http://www.sophos.com/virusinfo/analyses/trojdownldrnl.html

Type
Trojan

Aliases
Trojan-Downloader.Win32.Agent.acd

Troj/DownLdr-NK is a Windows Metafile (WMF) file which exploits a vulnerability allowing the download and execution of an EXE file from a remote URL.

At the time of writing, the downloaded file was detected as Troj/DownLdr-NN.

http://www.sophos.com/virusinfo/analyses/trojdownldrnk.html

Type
Trojan

Aliases
Trojan-Downloader.Win32.Agent.acd

Troj/DownLdr-NJ is a Windows Metafile (WMF) file which exploits a vulnerability allowing the download and execution of an EXE file from a remote URL.

At the time of writing, the downloaded file was detected as Troj/Dloadr-ACT.

http://www.sophos.com/virusinfo/analyses/trojdownldrnj.html