VIRUS ALERTS - February 19, 2005

Type Worm

W32/Sdbot-VB is a worm which attempts to spread to remote shares which have weak passwords. The worm also allows unauthorised remote access to the computer via IRC channels.

http://www.sophos.com/virusinfo/analyses/w32sdbotvb.html

Aliases WORM_SDBOT.AOW

Type Worm

W32/Sdbot-VC is a worm which attempts to spread to remote network shares. It also contains backdoor Trojan functionality, allowing unauthorised remote access to the infected computer via IRC channels while running in the background as a service process.
W32/Sdbot-VC spreads to network shares with weak passwords and via network security exploits as a result of the backdoor Trojan element receiving the appropriate command from a remote user (it copies itself to MSYGSY.DAT on the local machine at the same time).

http://www.sophos.com/virusinfo/analyses/w32sdbotvc.html

Aliases Win32.PoeBot.b
WORM_POEBOT.G
WORM_POEBOT.B

Type Worm

W32/Poebot-G is a worm which attempts to spread to remote network shares with weak passwords. It also contains backdoor Trojan functionality allowing unauthorised remote access to the infected computer via IRC channels.

http://www.sophos.com/virusinfo/analyses/w32poebotg.html

Type Trojan

Troj/Borodldr-M is a downloader Trojan.

http://www.sophos.com/virusinfo/analyses/trojborodldrm.html

Aliases Backdoor.Win32.Robobot.m

Type Trojan

Troj/Borobot-M is an IRC backdoor Trojan that modifies Microsoft firewall settings to allow it to connect to the internet.

http://www.sophos.com/virusinfo/analyses/trojborobotm.html

Aliases Trojan-Spy.Win32.Goldun.m

Type Trojan

Troj/Goldun-H is a password-stealing Trojan.
Troj/Goldun-H installs itself as a browser plugin in order to steal internet banking account details.

http://www.sophos.com/virusinfo/analyses/trojgoldunh.html