VIRUS ALERTS - January 12, 2006

Type
Spyware Trojan

Aliases
Trojan-Spy.Win32.Bancos.ha

Troj/Bancos-JL is a Internet banking Trojan for the Windows platform.

When run, Troj/Bancos-JL copies itself to <Windows> \kernels32.exe.

http://www.sophos.com/virusinfo/analyses/trojbancosjl.html

Type
Trojan

Aliases
Trojan-Downloader.Win32.Banload.mg

Troj/Banload-MG is a Trojan for the Windows platform.

Troj/Banload-MG includes functionality to access the internet and communicate with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/trojbanloadmg.html

Type
Spyware Trojan

Aliases
Trojan-PSW.Win32.Lmir.amp

Troj/LegMir-FI is a password stealing Trojan for the Windows platform

Troj/LegMir-FI has the functionalities to:

- communicate with a remote server via email
- record keystrokes

http://www.sophos.com/virusinfo/analyses/trojlegmirfi.html

Type
Trojan

Aliases
Trojan-Downloader.Win32.VB.ne

Troj/Dloadr-ACX is a Trojan for the Windows platform.

Troj/Dloadr-ACX has the functionality to silently download, install and run new software.

http://www.sophos.com/virusinfo/analyses/trojdloadracx.html

Type
Trojan

Troj/StartPa-KJ is a Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojstartpakj.html

Type
Worm

Aliases
Email-Worm.Win32.Locksky.y
W32/Loosky.gen

W32/Loosky-V is a mass-mailing worm for the Windows platform.

W32/Loosky-V attempts to send itself to email addresses harvested from the infected computer. Emails sent have the following characteristics:

Subject line: Your Ebay account is Suspended

Message text:

Dear eBay Member,

We regret to inform you that your eBay account could be suspended if you don't re-update your
account information.

To resolve this problem please visit link below and re-enter your account information to the attached form.

Attachment name: ebay_info.exe

http://www.sophos.com/virusinfo/analyses/w32looskyv.html

Type
Trojan

Aliases
Trojan-Downloader.Win32.Banload.je
PWS-Banker.gen.t

Troj/Banload-IB is a Trojan for the Windows platform.

Troj/Banload-IB includes functionality to access the internet and communicate with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/trojbanloadib.html

Type
Trojan

Troj/DownLdr-TD is a downloader Trojan for the Windows platform.

Troj/DownLdr-TD has functionality to download and run further software from pre-specified URLs.

http://www.sophos.com/virusinfo/analyses/trojdownldrtd.html

Type
Trojan

Aliases
Backdoor.Ryknos

Troj/Stinx-K is a backdoor Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojstinxk.html

Type
Trojan

Aliases
Email-Worm.Win32.Locksky.m

Troj/Loosky-R is a downloading Trojan and proxy server.

Troj/Loosky-R downloads and executes files from a preconfigured URL and provides a proxy server, allowing a remote attacker to route TCP traffic through the infected computer.

http://www.sophos.com/virusinfo/analyses/trojlooskyr.html

Type
Trojan

Aliases
Trojan-PSW.Win32.VB.ho

Troj/Aolps-Q is a Trojan for the Windows platform.

Troj/Aolps-Q includes functionality to access the internet and communicate with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/trojaolpsq.html

Type
Trojan

Aliases
Trojan-Downloader.Win32.Small.bzt

Troj/Small-IM is a downloader Trojan for the Windows platform.

Troj/Small-IM includes functionality to download, install and run new software.

http://www.sophos.com/virusinfo/analyses/trojsmallim.html

Type
Trojan

Aliases
not-a-virus:AdWare.Win32.Lop.ag
Swizzor.gen

Troj/Swizzor-AG is a Trojan for the Windows platform.

Troj/Swizzor-AG includes functionality to access the internet and communicate with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/trojswizzorag.html

Type
Trojan

Aliases
Backdoor.Win32.Hupigon.he

Troj/Feutel-CD is a backdoor Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojfeutelcd.html

Type
Trojan

Aliases
VAnti
Rootkit.Win32.Vanti.ah

Troj/Hackvan-D is a Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojhackvand.html

Type
Spyware Trojan

Aliases
Trojan-Spy.Win32.Banbra.df

Troj/Banker-TP is a password stealing Trojan for the Windows platform.

The Trojan monitors Internet Explorer sessions and captures keypresses when certain banking sites are visited by displaying fake login windows. The harvested information is then sent to a remote user via email.

http://www.sophos.com/virusinfo/analyses/trojbankertp.html

Type
Spyware Worm

Aliases
JS/Kmax.gen@MM
JS_FEEBS.A
Worm.Win32.Feebs.h

W32/Feebs-H is a worm for the Windows platform.

The worm may arrive as an attachment to an email claiming to be sent via "Protected E-Mail service" with bogus credentials. The message may lure the recipient into entering the supplied credentials into an attached HTML document.

W32/Feebs-H spreads via file sharing on peer-to-peer networks.

W32/Feebs-H may also harvest information from the infected computer and send stolen data to a remote user via FTP.

http://www.sophos.com/virusinfo/analyses/w32feebsh.html

Type
Worm

W32/Sdbot-ALZ is a worm and IRC backdoor Trojan for the Windows platform.

W32/Sdbot-ALZ runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels.

When first run W32/Sdbot-ALZ copies itself to <System> \svchosts.exe.

http://www.sophos.com/virusinfo/analyses/w32sdbotalz.html

Type
Trojan

Troj/DownLdr-SI is a downloader Trojan for the Windows platform.

Troj/DownLdr-SI attempts to terminate Anti-virus and firewall applications.

http://www.sophos.com/virusinfo/analyses/trojdownldrsi.html

Type
Worm

W32/Rbot-BKV is a worm and IRC backdoor Trojan for the Windows platform.

W32/Rbot-BKV runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels.

When first run W32/Rbot-BKV copies itself to <System> \winupdatexx.exe.

http://www.sophos.com/virusinfo/analyses/w32rbotbkv.html

Type
Trojan

Aliases
Trojan.Win32.Crypt.o
Trojan.Vundo
Trojan.Win32.Agent.cs

Troj/Agent-PQ is a Trojan for the Windows platform.

Troj/Agent-PQ will attempt to contact remote URLs to download files.

http://www.sophos.com/virusinfo/analyses/trojagentpq.html

Type
Trojan

Aliases
Trojan-Downloader.Win32.Zlob.dn
Downloader-AQW

Troj/LewDl-I is a Trojan for the Windows platform.

Troj/LewDl-I will attempt to download files from remote URLs.

http://www.sophos.com/virusinfo/analyses/trojlewdli.html

Type
Spyware Trojan

Aliases
Trojan-Spy.Win32.Banker.ahy

Troj/Banker-VE is a password stealing Trojan targeted at customers of Brazilian banks.

Troj/Banker-VE attempts to log keypresses entered into certain websites and online banking applications. The Trojan may display fake user interfaces in order to persuade the user to enter confidential details. Stolen information is sent by email to a remote user.

http://www.sophos.com/virusinfo/analyses/trojbankerve.html

Type
Worm

W32/Tilebot-CW is a worm and IRC backdoor Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/w32tilebotcw.html

Type
Worm

Aliases
Backdoor.Win32.IRCBot.mf

W32/Sdbot-ALY is a worm and IRC backdoor Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/w32sdbotaly.html

Type
Trojan

Troj/Zlob-CK is a Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojzlobck.html

Type
Trojan

Aliases
Trojan-Downloader.Win32.Delf.qz

Troj/Shredl-G is a downloader Trojan for the Windows platform.

Troj/Shredl-G includes functionality to access the internet and communicate with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/trojshredlg.html

Type
Trojan

Aliases
Trojan-Downloader.Win32.Banload.pt

Troj/Banload-HZ is a Trojan for the Windows platform.

Troj/Banload-HZ includes functionality to access the internet and communicate with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/trojbanloadhz.html

Type
Spyware Trojan

Aliases
Trojan-Spy.Win32.Banker.apk
PWS-Banker.gen.bb

Troj/Bancban-NN is a Trojan for the Windows platform.

Troj/Bancban-NN includes functionality to:

- access the internet and communicate with a remote server via HTTP
- send notification messages to remote locations

http://www.sophos.com/virusinfo/analyses/trojbancbannn.html

Type
Trojan

Aliases
Trojan-Downloader.Win32.Zlob.ed

Troj/LewDl-J is a downloader Trojan for the Windows platform.

Troj/LewDl-J has functionality to access and download code from remote sites.

http://www.sophos.com/virusinfo/analyses/trojlewdlj.html