VIRUS ALERTS - December 6, 2005

Type
Spyware Trojan

Aliases
Trojan-PSW.Win32.Hangame.s
PWS-Lineage
PWSteal.Trojan

Troj/Lineage-BT is an information stealing Trojan for the Windows platform.

Troj/Lineage-BT has the functionality to communicate with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/trojlineagebt.html

Type
Trojan

Aliases
Backdoor.Win32.GrayBird.bh

Troj/GrayBrd-AU is a Trojan for the Windows platform.

Troj/GrayBrd-AU includes functionality to access the internet and communicate with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/trojgraybrdau.html

Type
Worm

W32/Vulgar-A is an over-writing virus for the Windows platform.

W32/Vulgar-A attempts to over-write any files it finds.

W32/Vulgar-A opens the default browser to a pre-specified URL.

http://www.sophos.com/virusinfo/analyses/w32vulgara.html

Type
Trojan

Aliases
Trojan-Downloader.Win32.Small.bwg
Generic Downloader.k

Troj/Badmaca-C is a downloader Trojan for the Windows platform.

Troj/Badmaca-C attempts to download a file via FTP and execute it.

Troj/Badmaca-C also attempts to open a specific website.

http://www.sophos.com/virusinfo/analyses/trojbadmacac.html

Type
Spyware Trojan

Aliases
Backdoor.Win32.Beastdoor.207
BackDoor-AMQ

Troj/PWSDelf-P is a password stealing Trojan for the Windows platform.

Troj/PWSDelf-P can be used by other malware (in particualr by some Troj/BeastDo Trojans) to scan a system for passwords.

http://www.sophos.com/virusinfo/analyses/trojpwsdelfp.html

Type
Spyware Trojan

Aliases
Trojan-Spy.Win32.Banker.ahy

Troj/Bancban-KI is a banking Trojan for the Windows platform.

Troj/Bancban-KI attempts to log information sent to certain websites and online banking applications. The Trojan may display fake user interfaces in order to persuade the user to enter confidential details. Stolen information is sent by email to a remote user.

http://www.sophos.com/virusinfo/analyses/trojbancbanki.html

Type
Trojan

Aliases
Backdoor.Win32.Prosti.p

Troj/Prosti-P is a backdoor Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojprostip.html

Type
Worm

Aliases
Virus.Win32.HLLW.VB.o
W32/Hilin.worm
W32.SillyFDC
WORM_SILLYFDC.C

W32/Hilin-B is a worm for the Windows platform.

W32/Hilin-B spreads by attempting to copy itself to mapped drives on the system.

http://www.sophos.com/virusinfo/analyses/w32hilinb.html

Type
Trojan

Aliases
Trojan-Downloader.Win32.Agent.th

Troj/Agent-TH is a Trojan for the Windows platform.

Troj/Agent-TH includes functionality to access the internet and communicate with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/trojagentth.html

Type
Trojan

Aliases
Trojan.Win32.Favadd.an

Troj/Favadd-AN is a Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojfavaddan.html

Type
Trojan

Aliases
Trojan-Downloader.Win32.VB.ji

Troj/VBDown-JI is a Trojan for the Windows platform.

Troj/VBDown-JI attempts to download and install further code.

http://www.sophos.com/virusinfo/analyses/trojvbdownji.html

Type
Spyware Trojan

Aliases
MultiDropper-PH

Troj/Danmec-G is a Trojan for the Windows platform.

The Trojan opens a port and offers remote attackers the ability to route HTTP traffic through the infected computer. The Trojan may also download and install additional files and retrieve information about an infected system, including network details, and send these to a remote intruder.

Troj/Danmec-G displays a fake error message with the title "Component not found" and the message text "Application can not run because vbrun64.dll not found".

http://www.sophos.com/virusinfo/analyses/trojdanmecg.html

Type
Trojan

Aliases
Trojan.Win32.Mutbot.d

Troj/Mutbot-D is a backdoor Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojmutbotd.html

Type
Spyware Trojan

Aliases
Backdoor.Win32.Delf.jd

Troj/Doorila-B is a backdoor Trojan for the Windows platform.

Troj/Doorila-B allows a remote intruder access to an infected computer, and can steal ICQ passwords.

http://www.sophos.com/virusinfo/analyses/trojdoorilab.html

Type
Worm

Aliases
Net-Worm.Win32.Bobic.z

W32/Bobax-Z is a virus for the Windows platform.

W32/Bobax-Z infects executable files. Infected files are detected as W32/Bobax-S.

W32/Bobax-Z spreads to other network computers by exploiting common buffer overflow vulnerabilities, including PNP (MS05-039) and by copying itself to network shares protected by weak passwords.

W32/Bobax-Z includes functionality to access the internet and communicate with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/w32bobaxz.html

Type
Trojan

Aliases
Trojan-Downloader.Win32.Agent.uj

Troj/RuinDl-F is a downloading Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojruindlf.html

Type
Trojan

Aliases
Trojan-Downloader.Win32.ConHook.m
TROJ_DLOADER.AIK

Troj/ConHook-M is a Trojan for the Windows platform.

Troj/ConHook-M attempts to download and install further software and disable Microsoft Anti-Spyware. Troj/ConHook-M may also monitor user activity.

http://www.sophos.com/virusinfo/analyses/trojconhookm.html

Type
Trojan

Troj/Zapchas-AC is a Trojan for the Windows platform.

Troj/Zapchas-AC runs continuously in the background, providing a backdoor server
which allows a remote intruder to gain access and control over the computer via
IRC channels.

http://www.sophos.com/virusinfo/analyses/trojzapchasac.html

Type
Trojan

Aliases
Trojan.Win32.Spabot.t
TROJ_SPABOT.K
Trojan-Dropper.Win32.Small.aih

Troj/Spabot-E is a Trojan for the Windows platform.

Troj/Spabot-E contacts a remote URL to download configuration data and to report that the computer is infected.

Troj/Spabot-E may be configured to download a file from a remote website to <Temp> \file.exe and execute it.

Troj/Spabot-E may be used to send configurable spam emails.

http://www.sophos.com/virusinfo/analyses/trojspabote.html

Type
Worm

Aliases
Net-Worm.Win32.Incef.b
W32.Falsu.A

W32/Falus-B is a worm for the Windows platform.

W32/Falus-B spreads via file sharing on P2P networks.

http://www.sophos.com/virusinfo/analyses/w32falusb.html

Type
Trojan

Aliases
Trojan-Downloader.Win32.CWS.k
Downloader-AQV

Troj/Krepper-V is a downloader Trojan for the Windows platform.

Troj/Krepper-V includes functionality to access the internet and communicate
with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/trojkrepperv.html

Type
Worm

W32/Rbot-BAL is a worm and IRC backdoor Trojan for the Windows platform.

W32/Rbot-BAL spreads to other network computers by exploiting common buffer overflow vulnerabilites, including: WKS (MS03-049) (CAN-2003-0812) and ASN.1
(MS04-007) and by copying itself to network shares protected by weak passwords.

W32/Rbot-BAL runs continuously in the background, providing a backdoor server
which allows a remote intruder to gain access and control over the computer via
IRC channels.

http://www.sophos.com/virusinfo/analyses/w32rbotbal.html

Type
Trojan

Aliases
Trojan-Downloader.Win32.Small.bsy

Troj/Dloadr-ABG is a Trojan for the Windows platform.

Troj/Dloadr-ABG includes functionality to download, install and run new software.

http://www.sophos.com/virusinfo/analyses/trojdloadrabg.html

Type
Trojan

Aliases
Trojan-Downloader.Win32.Small.asa

Troj/Dloadr-ABF is a Trojan for the Windows platform.

Troj/Dloadr-ABF includes functionality to download, install and run new software.

http://www.sophos.com/virusinfo/analyses/trojdloadrabf.html

Type
Trojan

Aliases
Trojan-Downloader.Win32.Delf.zz

Troj/Dloadr-ABE is a Trojan for the Windows platform.

Troj/Dloadr-ABE includes functionality to download, install and run new software.

http://www.sophos.com/virusinfo/analyses/trojdloadrabe.html

Type
Trojan

Aliases
Trojan-Downloader.Win32.Delf.nz

Troj/Dloadr-ABD is a Trojan for the Windows platform.

Troj/Dloadr-ABD includes functionality to download, install and run new software.

http://www.sophos.com/virusinfo/analyses/trojdloadrabd.html

Type
Trojan

Aliases
Backdoor.Win32.Breplibot.l

Troj/Stinx-G is a backdoor Trojan for the Windows platform.

Troj/Stinx-G runs continuously in the background, providing a backdoor server
which allows a remote intruder to gain access and control over the computer via
IRC channels.

http://www.sophos.com/virusinfo/analyses/trojstinxg.html

Type
Trojan

Aliases
Backdoor.Win32.Hupigon.so
BackDoor-ARR

Troj/Feutel-AV is a Trojan for the Windows platform.

When Troj/Feutel-AV is installed the following files are created without the user's knowledge:

<System> \temp1.exe
<System> \temp2.exe

The file temp1.exe is also detected as Troj/Feutel-AV. The file temp2.exe is a file used to distract the user.

http://www.sophos.com/virusinfo/analyses/trojfeutelav.html

Type
Trojan

Aliases
Backdoor.Win32.VBbot.x

Troj/VBbot-H is a backdoor Trojan for the Windows platform.

Troj/VBbot-H allows a remote user to control the infected computer through
Internet Relay Chat(IRC).

http://www.sophos.com/virusinfo/analyses/trojvbboth.html

Type
Spyware Trojan

Aliases
Trojan-PSW.Win32.Gamania.bf
PWSteal.Gamanlock

Troj/Lineage-BR is a password stealing Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojlineagebr.html