VIRUS ALERTS - January 11, 2006

Type
Trojan

Aliases
Backdoor.Win32.HacDef.084
BKDR_HACKDEF.F

Troj/HacDef-AL is a rootkit for the Windows platform.

Troj/HacDef-AL contains functionality to subvert the Windows API in order to hide or 'stealth' files, processes and registry entries from the user.

http://www.sophos.com/virusinfo/analyses/trojhacdefal.html

Type
Trojan

Aliases
TSPY_QQROB.CB
Trojan-Spy.Win32.Delf.lw
Trojan.PWS.QQPass

Troj/QQRob-BM is a Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojqqrobbm.html

Type
Worm

W32/Loosky-U is a worm for the Windows platform.

http://www.sophos.com/virusinfo/analyses/w32looskyu.html

Type
Trojan

Aliases
DNSChanger.a

Troj/DNSChan-AM is a Trojan for the Windows platform.

Troj/DNSChan-AM includes functionality to access the internet and communicate with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/trojdnschanam.html

Type
Spyware Trojan

Aliases
Trojan-PSW.Win32.Hukle.v

Troj/LegMir-FA is a password stealing Trojan for the Windows platform.

Troj/LegMir-FA has the functionalities to:

- record keystrokes
- monitor and terminate processes

http://www.sophos.com/virusinfo/analyses/trojlegmirfa.html

Type
Spyware Trojan

Aliases
Trojan-Spy.Win32.Delf.he

Troj/Dropper-DS is a password stealing Trojan for the Windows platform.

Troj/Dropper-DS has the functionalities to:

- communicate with a remote server
- monitor windows and record keystrokes
- steal passwords

http://www.sophos.com/virusinfo/analyses/trojdropperds.html

Type
Trojan

Aliases
Hoax.Win32.Renos.ao
Downloader-AFH

Troj/Spywad-P is a Trojan for the Windows platform.

Troj/Spywad-P includes functionality to access the internet and communicate with a remote server via HTTP

http://www.sophos.com/virusinfo/analyses/trojspywadp.html

Type
Trojan

Troj/Cheuko-C is a Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojcheukoc.html

Type
Trojan

Aliases
Backdoor.Win32.Small.he

Troj/Small-LG is a backdoor Trojan which allows a remote intruder to gain access and control over the computer.

http://www.sophos.com/virusinfo/analyses/trojsmalllg.html

Type
Spyware Worm

Aliases
Backdoor.Win32.Rbot.acl
W32/Sdbot.worm.gen.br
W32.Spybot.Worm
WORM_RBOT.CPH

W32/Rbot-BJW is a worm and IRC backdoor Trojan for the Windows platform.

W32/Rbot-BJW spreads:

- to other network computers infected with: Troj/Kuang, Troj/Sub7, Troj/NetDevil, W32/MyDoom, W32/Bagle and Troj/Optix
- to other network computers by exploiting common buffer overflow vulnerabilities, including: LSASS (MS04-011), RPC-DCOM (MS04-012), WKS (MS03-049) (CAN-2003-0812), WebDav (MS03-007), IIS5SSL (MS04-011) (CAN-2003-0719), UPNP (MS01-059), Veritas (CAN-2004-1172), Dameware (CAN-2003-1030) and ASN.1 (MS04-007)
- by copying itself to network shares protected by weak passwords

W32/Rbot-BJW runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels.

http://www.sophos.com/virusinfo/analyses/w32rbotbjw.html

Type
Trojan

Aliases
Trojan-Downloader.Win32.Banload.rd

Troj/BankDl-AI is a Trojan for the Windows platform.

Troj/BankDl-AI includes functionality to access the internet and communicate with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/trojbankdlai.html

Type
Trojan

Aliases
Backdoor.Win32.Hupigon.wd

Troj/Hupigon-CF is a backdoor Trojan for the Windows platform.

Troj/Hupigon-CF provides unauthorized remote access to the infected computer through the randomly chosen TCP port.

http://www.sophos.com/virusinfo/analyses/trojhupigoncf.html

Type
Trojan

Aliases
Rootkit.Win32.Vanti.ah
the VAnti
TROJ_VANTI.T

Troj/Vanti-K is a Trojan for the Windows platform.

Troj/Vanti-K may attempt to stealth further components installed from other sources.

http://www.sophos.com/virusinfo/analyses/trojvantik.html

Type
Trojan

Aliases
Backdoor.Ryknos

Troj/Stinx-L is a Trojan for the Windows platform.

Troj/Stinx-L runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer.

http://www.sophos.com/virusinfo/analyses/trojstinxl.html

Type
Spyware Trojan

Aliases
Backdoor.Win32.PcClient.dd
Backdoor.Win32.PcClient.cj
BackDoor-CKB
TROJ_CKB.A
BKDR_PCCLIENT.AX
BKDR_PCCLIENT.BA

Troj/PcClient-Y is a backdoor Trojan for the Windows platform that provides unauthorized remote access to the infected computer.

http://www.sophos.com/virusinfo/analyses/trojpcclienty.html

Type
Trojan

Aliases
Trojan-Downloader.Win32.Banload.ql
PWS-Banker.gen.ba

Troj/Banload-IA is a Trojan for the Windows platform.

Troj/Banload-IA includes functionality to download, install and run new software.

http://www.sophos.com/virusinfo/analyses/trojbanloadia.html

Type
Trojan

Aliases
Backdoor.Win32.Bifrose.dc
BackDoor-CEP

Troj/Bifrose-DB is a backdoor Trojan for the Windows platform that provides unauthorized remote access to the infected computer.

Troj/Bifrose-DB includes functionality to access the internet and communicate with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/trojbifrosedb.html

Type
Spyware Trojan

Aliases
Backdoor.Win32.PcClient.dd
Backdoor.Win32.PcClient.dy
Trojan-Downloader.Win32.Small.boh
BackDoor-CKB
BKDR_PCCLIENT.BG
BKDR_PCCLIENT.BJ

Troj/PcClien-N is a backdoor Trojan for the Windows platform that provides unauthorized remote access to the infected computer.

Troj/PcClien-N includes functionality to access the internet and communicate with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/trojpcclienn.html

Type
Trojan

Troj/Spyjack-J is a Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojspyjackj.html

Type
Spyware Trojan

Aliases
Backdoor.Win32.Coldfuson.j

Troj/Fusion-B is a backdoor Trojan for the Windows platform.

Troj/Fusion-B can log keypresses and email the results to a remote attacker. The Trojan includes functionality to access the internet and communicate with a remote server via HTTP

http://www.sophos.com/virusinfo/analyses/trojfusionb.html

Type
Trojan

Aliases
Backdoor.Win32.Prorat.f

Troj/Prorat-BA is a backdoor Trojan which allows a remote intruder to gain access and control over the computer.

Troj/Prorat-BA includes functionality to access the internet and communicate with a remote server via HTTP.

Troj/Prorat-BA will attempt to disable anti-virus and security-related software, including the Windows XP Internet Connection Firewall and System Restore service.

http://www.sophos.com/virusinfo/analyses/trojproratba.html

Type
Trojan

Aliases
Backdoor.Win32.Coldfuson.12

Troj/FusDrop-A is a Trojan for the Windows platform.

Troj/FusDrop-A poses as a serial key generator. However, when executed it installs a backdoor Trojan.

http://www.sophos.com/virusinfo/analyses/trojfusdropa.html

Type Trojan

Aliases Worm.Win32.Feebs.h
JS/Kmax.gen@MM

Troj/FeebDl-A is a downloader Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojfeebdla.html

Type Trojan

Aliases Constructor.Win32.Chindown

Troj/Chindow-A is a virus construction kit for the Windows platform.

Troj/Chindow-A can be used to generate some of the source code necessary for a virus.

http://www.sophos.com/virusinfo/analyses/trojchindowa.html

Type Trojan

Aliases Backdoor.IRC.Small.e
W32/Backdoor.DGU

Troj/MrcBdr-A is a Trojan generator program for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojmrcbdra.html

Type Trojan

Aliases Backdoor.Win32.Delf.yg
W32/Downloader.CFZ

Troj/Bckd-CRV is a backdoor Trojan client for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojbckdcrv.html

Type Spyware Trojan

Troj/Xbot-F is a multicomponent backdoor Trojan for the Windows platform that provides unauthorized remote access to the infected computer through an IRC channels.

Troj/Xbot-F includes functionality to download, install and run new software.

http://www.sophos.com/virusinfo/analyses/trojxbotf.html

Type Trojan

Aliases Backdoor.Win32.Delf.adj
Generic Downloader.c

Troj/Lanxue-K is a backdoor Trojan for the Windows platform.

Troj/Lanxue-K also includes functionality to copy itself to network shares protected by weak passwords.

Troj/Lanxue-K includes functionality to access the internet and communicate with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/trojlanxuek.html

Type Trojan

Troj/Agent-QY is a Trojan for the Windows platform.

Troj/Agent-QY includes functionality to access the internet and communicate with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/trojagentqy.html

Type Trojan

Aliases Trojan-Clicker.Win32.Agent.el
AdClicker-CD

Troj/AdClick-BT is a Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojadclickbt.html