VIRUS ALERTS - December 7, 2005

Type
Spyware Trojan

Aliases
TSPY_BANKER.AEZ
Trojan-Spy.Win32.Banker.add

Troj/Bancban-JY is a Trojan for the Windows platform.

Troj/Bancban-JY includes functionality to send notification messages to remote locations.

http://www.sophos.com/virusinfo/analyses/trojbanbanjy.html

Type Spyware Worm

Aliases Backdoor.Win32.SdBot.aad
W32/Sdbot.worm.gen.l
W32.Spybot.Worm
WORM_AIMDES.E

W32/Tilebot-CB is a worm with backdoor functionality for the Windows platform.
W32/Tilebot-CB spreads to other network computers by exploiting common buffer overflow vulnerabilities, including: WKS (MS03-049) (CAN-2003-0812), PNP (MS05-039) and ASN.1 (MS04-007). The worm also spreads via network shares protected by weak passwords and AOL Instant Messenger.
W32/Tilebot-CB runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels.
W32/Tilebot-CB includes functionality to:
- set up an FTP server
- spread via AOL Instant Messager by sending messages automatically
- change Internet Explorer start page
- set or remove network shares
- port scanning
- packet sniffing
- access the internet and communicate with a remote server via HTTP
- harvest information from clipboard

http://www.sophos.com/virusinfo/analyses/w32tilebotcb.html

Type Spyware Worm

Aliases Backdoor.Win32.Rbot.acd

W32/Sdbot-AGE is a worm with backdoor functionality for the Windows platform.

http://www.sophos.com/virusinfo/analyses/w32sdbotage.html

Type Trojan

Aliases Trojan-Downloader.Win32.Small.awa

Troj/Vixup-R is a downloader Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojvixupr.html

Type Spyware Trojan

Aliases Trojan-Spy.Win32.Banker.ahy
PWS-Banker.gen.b
PWSteal.Banpaes

Troj/Bancban-KT is a Trojan for the Windows platform.
Troj/Bancban-KT attempts to log information sent to certain websites and online banking applications. The Trojan may display fake user interfaces in order to persuade the user to enter confidential details. Stolen information may sent by email to a remote user.

http://www.sophos.com/virusinfo/analyses/trojbancbankt.html

Type Spyware Trojan

Aliases Trojan-Spy.Win32.Banbra.df
PWS-Banker.gen.b

Troj/Bancban-KS is a Trojan for the Windows platform.
Troj/Bancban-KS attempts to log information sent to certain websites and online banking applications. The Trojan may display fake user interfaces in order to persuade the user to enter confidential details. Stolen information may sent by email to a remote user

http://www.sophos.com/virusinfo/analyses/trojbancbanks.html

Type Trojan

Aliases Trojan-Downloader.Win32.IstBar.lq

Troj/Istbar-CF is a Trojan for the Windows platform.
Troj/Istbar-CF includes functionality to download, install and run new software.

http://www.sophos.com/virusinfo/analyses/trojistbarcf.html

Type Spyware Trojan

Troj/Gina-M is a password-stealing Trojan.
Troj/Gina-M is a DLL that is used to replace the functionality of MSGINA.DLL, the authentication library in Windows NT.

http://www.sophos.com/virusinfo/analyses/trojginam.html

Type Trojan

Dial/TlfLic-I is a dialer application.

http://www.sophos.com/virusinfo/analyses/dialtlflici.html

http://www.sophos.com/virusinfo/analyses/dialtlflici.html

Type Worm

Aliases Backdoor.Win32.Agobot.afk
W32/Gaobot.worm.gen.v
WORM_AGOBOT.AYE

W32/Tilebot-BZ is a worm with backdoor functionality for the Windows platform.
W32/Tilebot-BZ spreads to other network computers by exploiting common buffer overflow vulnerabilities, including: LSASS (MS04-011), RPC-DCOM (MS04-012), MSSQL (MS02-039) (CAN-2002-0649), PNP (MS05-039) and ASN.1 (MS04-007) and by copying itself to network shares protected by weak passwords.
W32/Tilebot-BZ runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels.
W32/Tilebot-BZ includes functionality to access the internet and communicate with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/w32tilebotbz.html

Type Spyware Worm

Aliases W32/Opanki.worm

W32/IRCBot-AV is a worm with backdoor functionality for the Windows platform.
W32/IRCBot-AV runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels.

http://www.sophos.com/virusinfo/analyses/w32ircbotav.html

Type Spyware Trojan

Aliases Trojan-PSW.Win32.QQShou.cn
PWS-JB
Trojan.PWS.QQPass

Troj/QQPass-AL is a Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojqqpassal.html

Type Spyware Trojan

Aliases Trojan-PSW.Win32.Sagic.15.c

Troj/PWSSagi-E is a password-stealing Trojan for the Window platform.

http://www.sophos.com/virusinfo/analyses/trojpwssagie.html

Type Trojan

Aliases Trojan-Downloader.Win32.Agent.ip
Generic.Downloader.ab

Troj/Dloadr-C is a Trojan for the Windows platform.
Troj/Dloadr-C includes functionality to access the internet and communicate with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/trojdloadrc.html

Type Spyware Trojan

Aliases Trojan-Spy.Win32.Banker.ahy

Troj/Banker-IA is a Trojan for the Windows platform.
Troj/Banker-IA includes functionality to send notification messages to remote locations.

http://www.sophos.com/virusinfo/analyses/trojbankeria.html

Type Spyware Worm

Aliases Backdoor.Win32.SdBot.aiz

W32/Tilebot-CC is a worm with backdoor functionality for the Windows platform.
W32/Tilebot-CC spreads to other network computers by exploiting common buffer overflow vulnerabilities, including: WKS (MS03-049) (CAN-2003-0812), LSASS (MS04-011) and RPC-DCOM (MS04-012). The worm may also spreads via network shares and MSSQL servers protected by weak passwords.
W32/Tilebot-CC runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels.
W32/Tilebot-CC includes functionality to:
- access the internet and communicate with a remote server via HTTP
- act as an HTTP proxy
- carry out DDoS attacks
- change Internet Explorer start page
- harvest information from clipboard
- packet sniffing
- port scanning
- set or remove network shares
- set up a SOCKS4 proxy server
- set up an FTP server
- spread via AOL Instant Messager by sending messages automatically
- steal information from protected storage areas
- steals POP3 and webmail usernames and passwords

http://www.sophos.com/virusinfo/analyses/w32tilebotcc.html

Type Worm

W32/Attech-D is a worm for the Windows platform. This worm is capable of spreading via AOL Instant Messenger.
W32/Attech-D will disable Task Manager, regedit, Windows Explorer and will prevent Internet Explorer from closing.
W32/Attech-D will attempt to send itself to any contacts listed in AIM. It will send a link with one of the following messages:
LMAO OMG THIS IS HILARIOUS!
INFINITE FREE PICS OF ASIAN HOTTIES!
Lol OMG! Someone posted your picture here!
OMG LOOK IT'S YOU!
Cool hacking programs!
Take my Quiz!
Play the new Aim Online game!
Click to join! Better then myspace and xanga!
Check my Pics Out!
Wanna See My Profile!
Download My Profile.
LOL Check these Pics out.
Have you see this!
Download my mp3 i made.
Check out my music!
Funniest Clip Ever!
Download Dead Aim (5.9+)- NEW!
Check out my webcam.
See my Beach pictures!!
Make your own Profile!
THE KEY TO HAPPINESS IS LAUGHTER!
Join this free music site!
View My BuddyProfile
My Xanga!
LOL Watch this clip!
Free Aim Password Cracker. Use it to hack your friends.
This game is badass! Play now!
Email Hacker Pro 1.5 This is awsome!
Game Hacker program download here.
Aim Hacker 1.3 FREE!
LOLOL *** IS THIS?!
Better then limewire and kazaa put together!
Get X-im Chat! Better then AIM!
Best Aim Password Cracker written by ZeX.
Download Aim Optimized 4.9!
Hack Webcams and Aim accounts with O-Hax! This is the last day it will be out for free!
The link attempts to download more malware from a remote site. At time of writing, the downloaded file is detected as W32/Attech-C.

http://www.sophos.com/virusinfo/analyses/w32attechd.html

Type Trojan

Aliases Trojan-Dropper.Win32.Delf.pb

Troj/Delf-PB is a Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojdelfpb.html

Type Trojan

Aliases Trojan-Dropper.Win32.Small.ahg

Troj/Small-EX is a backdoor Trojan which can be used as a proxy and is capable of downloading and executing arbitrary files.

http://www.sophos.com/virusinfo/analyses/trojsmallex.html

Type Spyware Trojan

Aliases TSPY_DAZHEB.A

Troj/Behz-A is a Trojan for the Windows platform.
The functions of Troj/Behz-A are configurable and can include:
Downloading and executing files
Stealing passwords
Displaying fake error messages
Disabling system functions such as registry editing

http://www.sophos.com/virusinfo/analyses/trojbehza.html

Name Troj/Behz-B

Aliases TSPY_DAZHEB.A

Troj/Behz-B is a Trojan for the Windows platform.
The functions of Troj/Behz-B are configurable and can include:
Downloading and executing files
Stealing passwords
Displaying fake error messages
Disabling system functions such as registry editing

http://www.sophos.com/virusinfo/analyses/trojbehzb.html

Type Trojan

Aliases TSPY_DAZHEB.A

Troj/BehzKit-B is a kit used to create Trojans.
Trojans created using this kit are detected by Sophos's anti-virus products as Troj/Behz-B.

http://www.sophos.com/virusinfo/analyses/trojbehzkitb.html

Type Trojan

Troj/OojKit-A is a Trojan generator for the Windows platform.
The Trojan generates password stealing Trojans (detected by Sophos as Troj/Ooj-A).

http://www.sophos.com/virusinfo/analyses/trojoojkita.html

Type Trojan

Aliases TSPY_DAZHEB.A

Troj/BehzKit-A is a kit used to create Trojans.
Trojans created using this kit are detected by Sophos's anti-virus products as Troj/Behz-A.

http://www.sophos.com/virusinfo/analyses/trojbehzkita.html

Type Spyware Trojan

Troj/Ooj-A is a password stealing Trojan for the Windows platform.
The Trojans harvest passwords from the infected computer and email stolen data to a remote attacker.
The Trojan may also terminate various anti-virus and security related applications.

http://www.sophos.com/virusinfo/analyses/trojooja.html