VIRUS ALERTS - December 9, 2005

Type Spyware Trojan

Aliases Trojan-PSW.Win32.Lmir.ans

Troj/LegMir-BU is a password stealing Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojlegmirbu.html

Type Trojan

Aliases Backdoor.Win32.Delf.aeo

Troj/GrayBrd-AW is a backdoor Trojan for the Windows platform.
Troj/GrayBrd-AW includes functionality to access the internet and communicate with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/trojgraybrdaw.html

Type Trojan

Aliases Backdoor.Win32.Delf.aeo
Backdoor.Graybird

Troj/Feutel-AW is a backdoor Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojfeutelaw.html

Type Spyware Trojan

Aliases Trojan-Spy.Win32.Goldun.fg

Troj/Goldun-AL is a Trojan component providing keylogging functionality.

http://www.sophos.com/virusinfo/analyses/trojgoldunal.html

Type Spyware Trojan

Aliases Constructor.Win32.YSPY.a

Troj/YSpy-A is a contstructor Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojyspya.html

Type Spyware Trojan

Aliases Trojan-Dropper.Win32.Agent.ack
PWS-Banker.ar
Trojan.Bankem

Troj/Bankem-L is a password-stealing Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojbankeml.html

Type Spyware Trojan

Aliases Trojan-Dropper.Win32.Agent.ack
PWS-Banker.ar
Trojan.Bankem

Troj/Bankem-M is a password-stealing Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojbankemm.html

Type Spyware Trojan

Troj/Bankem-N is a password-stealing Trojan for the Windows platform.
Troj/Bankem-N includes functionality to access the internet and communicate with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/trojbankemn.html

Type Spyware Trojan

Aliases Trojan-Spy.Win32.Goldun.fq

Troj/Bankem-O is a password-stealing Trojan for the Windows platform.
Troj/Bankem-O includes functionality to access the internet and communicate with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/trojbankemo.html

Type Worm

Aliases Backdoor.Win32.Alicia.p

W32/Rbot-BBA is a worm and IRC backdoor Trojan for the Windows platform.
W32/Rbot-BBA can spread via network shares, MSSQL when it finds weak passwords, file sharing on P2P networks, or by exploiting common vulnerabilities, including: LSASS (MS04-011), RPC-DCOM (MS04-012), and WINS (MS04-045).
W32/Rbot-BBA runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels.
W32/Rbot-BBA may attempts to disable various security related applications.
The following patches for the operating system vulnerabilities exploited by W32/Rbot-BBA can be obtained from the Microsoft website:
MS04-011
MS04-012
MS04-045

http://www.sophos.com/virusinfo/analyses/w32rbotbba.html

Type Worm

Aliases WORM_GOBOT.H

W32/Gobot-N is a worm and IRC backdoor Trojan for the Windows platform.
W32/Gobot-N spreads to other network computers.
W32/Gobot-N runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels.

http://www.sophos.com/virusinfo/analyses/w32gobotn.html

Type Spyware Trojan

Aliases Trojan-PSW.Win32.QQRob.ao

Troj/QQRob-AC is a Trojan for the Windows platform.
Troj/QQRob-AC includes functionality to access the internet and communicate with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/trojqqrobac.html

Type Trojan

Aliases Trojan-Clicker.Win32.Agent.fv

Troj/AdClick-BG is a Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojadclickbg.html

Type Trojan

Aliases Trojan.Win32.DNSChanger.x

Troj/DNSChan-X is a Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojdnschanx.html

Type Trojan

Aliases Backdoor.Win32.Agent.qz

Troj/Agent-QZ is a Trojan for the Windows platform.
Troj/Agent-QZ may inject code into other processs in order to avoid detection.

http://www.sophos.com/virusinfo/analyses/trojagentqz.html

Type Worm

W32/Sdbot-AGI is a worm and IRC backdoor Trojan for the Windows platform.
W32/Sdbot-AGI runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels.
W32/Sdbot-AGI includes functionality to access the internet and communicate with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/w32sdbotagi.html

Type Trojan

Troj/AdClick-BH is a Trojan for the Windows platform.
Troj/AdClick-BH includes functionality to access the internet and communicate with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/trojadclickbh.html

Type Trojan

Aliases Backdoor.Win32.DarkMoon.ah
BackDoor-CMI

Troj/OptixP-G is a backdoor Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojoptixpg.html

Type Trojan

Aliases Trojan.Win32.Crypt.r

Troj/Dumaru-AA is a Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojdumaruaa.html

Type Trojan

Troj/Dumaru-AB is a Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojdumaruab.html

Type Worm

Aliases Email-Worm.Win32.Locksky.c
WORM_LOCKSKY.B

W32/Loosky-F is a worm for the Windows platform.

http://www.sophos.com/virusinfo/analyses/w32looskyf.html