VIRUS ALERTS - December 30, 2005

Type Worm

Aliases Backdoor.Win32.SdBot.ajx
W32/Sdbot.worm.gen.m

W32/Sdbot-ALI is a worm with backdoor functionality for the Windows platform.
W32/Sdbot-ALI spreads through network shares protected by weak passwords and through various operating system vulnerabilities, including ASN.1 (MS04-007).
W32/Sdbot-ALI runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels.

http://www.sophos.com/virusinfo/analyses/w32sdbotali.html

Type Worm

Aliases Backdoor.Win32.SdBot.xd
StartPage-IH
W32.Spybot.Worm
WORM_SDBOT.CQV

W32/Tilebot-CT is a worm for the Windows platform.
W32/Tilebot-CT spreads to other network computers by means of:
- exploiting common buffer overflow vulnerabilities, including: LSASS (MS04-011) and RPC-DCOM (MS04-012)
- copying itself to network shares protected by weak passwords
- copying itself to MSSQL servers protected by weak passwords
W32/Tilebot-CT runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels.
W32/Tilebot-CT includes functionality to:
- set up an FTP server
- set or remove network shares
- port scanning
- packet sniffing
- access the internet and communicate with a remote server via HTTP
- harvest information from clipboard
W32/Tilebot-CT includes functionality to access the internet and communicate with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/w32tilebotct.html

Type Spyware Trojan

Aliases Backdoor.Win32.Hupigon.k

Troj/Hupigon-BQ is a backdoor Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojhupigonbq.html

Type Trojan

Troj/Dloadr-DM is a downloader Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojdloadrdm.html

Type Trojan

Aliases Backdoor-Server/MoSucker.06.S

Troj/Mosuck-S is a backdoor Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojmosucks.html