VIRUS ALERTS - Februar 26, 2005

Type Worm

W32/Sdbot-VP is a network worm with backdoor Trojan functionality for the Windows platform.
The worm spreads through network shares protected by weak passwords, MS-SQL servers and through various operating system vulnerabilities.
W32/Sdbot-VP connects to a predetermined IRC channel and awaits further commands from remote users.

http://www.sophos.com/virusinfo/analyses/w32sdbotvp.html

Type Worm

W32/Rbot-WQ is a network worm with backdoor Trojan functionality for the Windows platform.
W32/Rbot-WQ spreads using a variety of techniques including exploiting weak passwords on computers and SQL servers, exploiting operating system vulnerabilities (including DCOM-RPC, LSASS, WebDAV and UPNP) and using backdoors opened by other worms or Trojans.
W32/Rbot-WQ can be controlled by a remote attacker over IRC channels.

http://www.sophos.com/virusinfo/analyses/w32rbotwq.html

Type Worm

W32/Rbot-WP is a network worm with backdoor Trojan functionality for the Windows platform.
W32/Rbot-WP spreads using a variety of techniques including exploiting weak passwords on computers and SQL servers, exploiting operating system vulnerabilities (including DCOM-RPC, LSASS, WebDAV and UPNP) and using backdoors opened by other worms or Trojans.
W32/Rbot-WP can be controlled by a remote attacker over IRC channels.

http://www.sophos.com/virusinfo/analyses/w32rbotwp.html

Type Worm

W32/Rbot-WR is a network worm with backdoor Trojan functionality for the Windows platform.
W32/Rbot-WR spreads using a variety of techniques including exploiting weak passwords on computers and SQL servers, exploiting operating system vulnerabilities (including DCOM-RPC, LSASS, WebDAV and UPNP) and using backdoors opened by other worms or Trojans.
W32/Rbot-WR can be controlled by a remote attacker over IRC channels.

http://www.sophos.com/virusinfo/analyses/w32rbotwr.html

Aliases WORM_WOOTBOT.GS

Type Worm

W32/Forbot-EI is a network worm with backdoor Trojan functionality for the Windows platform.
W32/Forbot-EI spreads by exploiting poorly protected network shares and the LSASS Windows operating system vulnerability.
W32/Forbot-EI can be controlled by a remote attacker over IRC channels.

http://www.sophos.com/virusinfo/analyses/w32forbotei.html

Aliases Trojan.Win32.Delf.if

Type Virus

W32/Krow-A is a parasitic virus.
W32/Krow-A attaches itself to the front of executable files found on the local computer.

http://www.sophos.com/virusinfo/analyses/w32krowa.html

Aliases TROJ_ISTBAR.CM

Type Trojan

Troj/Istbar-CM is a Trojan for the Windows platform.
The Trojan runs silently in the background repeatedly attempting to download and execute files from a remote site.

http://www.sophos.com/virusinfo/analyses/trojistbarcm.html