VIRUS ALERTS - January 2, 2006

Type Trojan

Aliases PWSteal.Trojan

Troj/Dloadr-DP is a Trojan for the Windows platform.
The Trojan downloads and installs additional files.

http://www.sophos.com/virusinfo/analyses/trojdloadrdp.html

Type Trojan

Aliases Exploit.Win32.IMG-WMF.m

Troj/DownLdr-QC is a Microsoft Windows Metafile (WMF) which exploits a vulnerability in Windows Picture and Fax Viewer handler to download and execute Troj/DownLdr-QD.

http://www.sophos.com/virusinfo/analyses/trojdownldrqc.html

Type Trojan

Aliases Trojan.Win32.Agent.nh


Troj/DownLdr-QD is a Trojan for the Windows platform.
Troj/DownLdr-QD has functionality to access the internet to download and execute files.

http://www.sophos.com/virusinfo/analyses/trojdownldrqd.html

Type Trojan

Troj/DownLdr-QF is a Windows Metafile (WMF) file which exploits a vulnerability allowing the download and execution of an EXE file from a remote URL.

http://www.sophos.com/virusinfo/analyses/trojdownldrqf.html

Type Trojan

Troj/Whim-A is a Trojan which exploits the WMF vulnerability.
The Trojan spawns calc.exe when run.

http://www.sophos.com/virusinfo/analyses/trojwhima.html

Type Trojan

Troj/YMob-A is a Trojan for the Windows platform.
The Trojan sends messages through the Yahoo Messenger client and through email.

http://www.sophos.com/virusinfo/analyses/trojymoba.html

Type Spyware Worm

Aliases W32/Spybot.worm.gen.o

W32/Spybot-ET is a worm and IRC backdoor Trojan for the Windows platform.
W32/Spybot-ET spreads via file sharing on P2P networks and to other network computers infected with: Troj/Kuang and Troj/Sub7.
W32/Spybot-ET runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels.

http://www.sophos.com/virusinfo/analyses/w32spybotet.html

Type Spyware Worm

W32/Rbot-BHR is a worm and IRC backdoor Trojan for the Windows platform.
W32/Rbot-BHR spreads to other network computers by exploiting common buffer overflow vulnerabilities, including: LSASS (MS04-011), RPC-DCOM (MS04-012), WKS (MS03-049) (CAN-2003-0812), Veritas (CAN-2004-1172), PNP (MS05-039) and ASN.1 (MS04-007) and by copying itself to network shares protected by weak passwords.
W32/Rbot-BHR runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels.

http://www.sophos.com/virusinfo/analyses/w32rbotbhr.html

Type Trojan

Troj/Borobot-W is a backdoor Trojan which allows a remote intruder to gain
access and control over the computer via IRC channels.

http://www.sophos.com/virusinfo/analyses/trojborobotw.html

Type Worm

Aliases W32/Gaobot.worm.gen.t
Backdoor.Win32.Agobot.agh

W32/Agobot-UX is a worm and backdoor Trojan for the Windows platform.
W32/Agobot-UX runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer.

http://www.sophos.com/virusinfo/analyses/w32agobotux.html

Type Trojan

Aliases Trojan-Clicker.Win32.Delf.eb

Troj/Delf-MO is a Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojdelfmo.html

Type Worm

Aliases Backdoor.Win32.SdBot.xd
W32/Sdbot.worm.gen.l

W32/Tilebot-CV is a worm and IRC backdoor Trojan for the Windows platform.
W32/Tilebot-CV spreads to other network computers by exploiting common buffer overflow vulnerabilities, including: LSASS (MS04-011), RPC-DCOM (MS04-012), PNP (MS05-039) and ASN.1 (MS04-007), by copying itself to network shares protected by weak passwords and by AOL Instant Messenger.
W32/Tilebot-CV runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels.

http://www.sophos.com/virusinfo/analyses/w32tilebotcv.html

Type Trojan

Aliases Trojan-Spy.Win32.Goldun.fv

Troj/Bankem-R is a Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojbankemr.html

Type Spyware Trojan

Aliases Trojan-Spy.Win32.VB.kw

Troj/Keylog-BM is a keylogger Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojkeylogbm.html

Type Trojan

Troj/DownLdr-QE is a Trojan downloader for the Windows platform.
Troj/DownLdr-QE includes functionality to access the internet and communicate with a remote server via HTTP.
Troj/DownLdr-QE changes settings for Microsoft Internet Explorer, including the Start Page and Search Page, by modifying values under:
HKCU\Software\Microsoft\Internet Explorer\Main\Search Bar
HKCU\Software\Microsoft\Internet Explorer\Main\Search Page
HKCU\Software\Microsoft\Internet Explorer\Main\Start Page
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\Default_Page_URL
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\Default_Search_URL
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\Search Bar
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page

http://www.sophos.com/virusinfo/analyses/trojdownldrqe.html

Type Trojan

Aliases Trojan-Downloader.Win32.Tibs.ai
BackDoor-AZV

Troj/Vixup-V is a Trojan for the Windows platform.
Troj/Vixup-V includes functionality to download, install and run new software.

http://www.sophos.com/virusinfo/analyses/trojvixupv.html