VIRUS ALERTS - January 4, 2005

Type
Trojan

Aliases
Trojan-Proxy.Win32.Xorpix.h

Troj/Agent-IE is a Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojagentie.html

Type
Trojan

Troj/Stinx-J is a backdoor Trojan for the Windows platform.

Troj/Stinx-J allows a remote attacker to gain access and control over the computer via IRC channels.

http://www.sophos.com/virusinfo/analyses/trojstinxj.html

Type
Trojan

Aliases
Trojan.Win32.LowZones.df
W32/Downloader.KFR

Troj/LowZone-BI is a Trojan for the Windows platform.

Troj/LowZone-BI includes functionality to access the internet and communicate with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/trojlowzonebi.html

Type
Spyware Trojan

Aliases
Trojan-Spy.Win32.Banbra.ex

Troj/Bancos-IQ is a Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojbancosiq.html

Type
Trojan

Aliases
Backdoor.Win32.MSNMaker.l
BackDoor-CRS
Download.Trojan

Troj/Pisaboy-B is a backdoor Trojan targeted at users of MSN Messenger.

The backdoor functionality of the Trojan allows a remote user to perform a number of operations related to Messenger, such as spying on messages sent and received or sending messages in the infected user's name. The Trojan may also connect to arbitrary websites or restart the computer.

The Trojan may display a message such as the following:

"People in your MSNlist have been messing around with you... Also wanna be a MSNhacker?"

http://www.sophos.com/virusinfo/analyses/trojpisaboyb.html

Type
Worm

Aliases
Backdoor.Win32.Aimbot.bs

W32/Rbot-BHU is a worm and IRC backdoor Trojan for the Windows platform.

W32/Rbot-BHU runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels.

http://www.sophos.com/virusinfo/analyses/w32rbotbhu.html

Type
Trojan

Aliases
Hacktool.Rootkit

Troj/RKProc-D is a kernel-mode driver rootkit.

Troj/RKProc-D is capable of hiding information about certain running processes, providing stealthing by patching the kernel service descriptor table.

http://www.sophos.com/virusinfo/analyses/trojrkprocd.html

Type
Worm

W32/IRCbot-BO is a worm and IRC backdoor Trojan for the Windows platform.

W32/IRCbot-BO runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels.

http://www.sophos.com/virusinfo/analyses/w32ircbotbo.html

Type
Trojan

Troj/QQRob-AX is a Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojqqrobax.html

Type
Spyware Trojan

Aliases
Backdoor.Win32.Hupigon.lq

Troj/Hupigon-BS is a backdoor Trojan for the Windows platform.

Troj/Hupigon-BS includes functionality to access the internet and communicate with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/trojhupigonbs.html

Type
Worm

Aliases
IRC-Worm.Win32.Delf.b
W32/Generic.Delphi.a

W32/Crutle-B is a worm for the Windows platform.

W32/Crutle-B spreads via file sharing on P2P networks.

http://www.sophos.com/virusinfo/analyses/w32crutleb.html

Type
Trojan

Troj/Spray-A exploits a browser vulnerability in order to download and execute a file from a remote location.

http://www.sophos.com/virusinfo/analyses/trojspraya.html

Type Worm

Aliases W32/Sdbot.worm.gen.bq

W32/Rbot-BIA is a worm and IRC backdoor Trojan for the Windows platform.
W32/Rbot-BIA spreads to other network computers by exploiting common buffer overflow vulnerabilities, including: LSASS (MS04-011), RPC-DCOM (MS04-012), WKS (MS03-049) (CAN-2003-0812),MSSQL (MS02-039)and ASN.1 (MS04-007).
W32/Rbot-BIA runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels.

http://www.sophos.com/virusinfo/analyses/w32rbotbia.html

Type Worm

Aliases Backdoor.Win32.SdBot.xd
W32/Sdbot.worm.gen.g
W32.Spybot.Worm
WORM_SDBOT.CTE

W32/Tilebot-CY is a worm and IRC backdoor Trojan for the Windows platform.
W32/Tilebot-CY spreads to other network computers by exploiting common buffer overflow vulnerabilities, including: LSASS (MS04-011), RPC-DCOM (MS04-012), WKS (MS03-049) (CAN-2003-0812), PNP (MS05-039) and ASN.1 (MS04-007) and by copying itself to network shares protected by weak passwords.
W32/Tilebot-CY runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels.
W32/Tilebot-CY includes functionality to access the internet and communicate with a remote server via HTTP.


http://www.sophos.com/virusinfo/analyses/w32tilebotcy.html

Type Spyware Worm

Aliases Worm.Win32.Brontok.a
W32.Rontokbro@mm
WORM_RONTKBR.GEN

W32/Brontok-N is a worm for the Windows platform.

http://www.sophos.com/virusinfo/analyses/w32brontokn.html

Type Trojan

Aliases Trojan-Downloader.Win32.Delf.abk

Troj/SmDown-C is a downloading Trojan for the Windows platform.
Troj/SmDown-C includes functionality to access the internet and communicate with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/trojsmdownc.html

Type Spyware Trojan

Aliases Trojan-Spy.Win32.Banker.ahy

Troj/Banker-TG is a Trojan for the Windows platform.
Troj/Banker-TG includes functionality to send notification messages to remote locations.

http://www.sophos.com/virusinfo/analyses/trojbankertg.html

Type Trojan

Aliases Trojan-Downloader.Win32.Banload.je
Downloader-VX

Troj/Banload-HL is a Trojan for the Windows platform.
Troj/Banload-HL includes functionality to download further malicious code.

http://www.sophos.com/virusinfo/analyses/trojbanloadhl.html

Type Trojan

Aliases Trojan-Downloader.Win32.Banload.os
Downloader-ACK

Troj/Banload-HK is a Trojan for the Windows platform.
Troj/Banload-HK includes functionality to download further malicious code.

http://www.sophos.com/virusinfo/analyses/trojbanloadhk.html

Type Trojan

Aliases Trojan-Downloader.Win32.Banload.ap
Downloader-ABU

Troj/Banload-HM is a downloading Trojan for the Windows platform.
Troj/Banload-HM includes functionality to access the internet and communicate with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/trojbanloadhm.html

Type Trojan

Aliases Trojan-Downloader.Win32.Small.axc

Troj/DownLdr-QO is a downloading Trojan for the Windows platform.
Troj/DownLdr-QO includes functionality to download, install and run new software.

http://www.sophos.com/virusinfo/analyses/trojdownldrqo.html

Type Trojan

Aliases Trojan-Downloader.Win32.VB.nl

Troj/DownLdr-QN is a Trojan for the Windows platform.
Troj/DownLdr-QN includes functionality to download, install and run new software.

http://www.sophos.com/virusinfo/analyses/trojdownldrqn.html

Type Trojan

Aliases Trojan-Dropper.Win32.Agent.afj
Downloader-AST

Troj/Agent-AFJ is a downloading Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojagentafj.html

Type Trojan

Troj/Scripdog-A is a Trojan for the Windows platform.
The Trojan is capable of the following:
- creating/listing/terminating processes
- creating/deleting user accounts
- injecting code into running processes
- modifying the system registry
- creating/deleting files and directories
- downloading files from remote sites
- shutting down the computer
- listing open ports
- manipulating EXE files

http://www.sophos.com/virusinfo/analyses/trojscripdoga.html

Type Spyware Trojan

Aliases Backdoor.Win32.HacDef.ae

Troj/HacDef-AM is a backdoor Trojan for the Windows platform.
As well as allowing remote attackers unauthorized access to the infected computer, the Trojan is able to hide its presence by hijacking operating system calls and preventing the user from viewing files, folders, processes, services, registry entries and/or network connections.

http://www.sophos.com/virusinfo/analyses/trojhacdefam.html

Type Trojan

Aliases Backdoor.Win32.ServU-based

Troj/ServU-BX is a hacked version of a commercial FTP application.
By default, the Trojan runs an ftp server on TCP port 43958. This can be overriden by configuration data read from a file called SystemSpool.ocx in the current folder.

http://www.sophos.com/virusinfo/analyses/trojservubx.html

Type Worm

Aliases Trojan-Dropper.Win32.Agent.afj

W32/Loosky-M is a worm for the Windows platform.

http://www.sophos.com/virusinfo/analyses/w32looskym.html

Type Trojan

Aliases Trojan-Downloader.Win32.Zlob.dl

Troj/Zlob-AL is a Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojzlobal.html

Type Trojan

Aliases Trojan.Zlob
Trojan-Downloader.Win32.Zlob.dl

Troj/Puper-AD is a Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojpuperad.html

Type Worm

Aliases Email-Worm.Win32.Brontok.c
W32.Rontokbro@mm

W32/Brontok-K is an email worm that sends itself to addresses gathered from the infected computer by searching files with the following extensions:
ASP, CFM, CSV, DOC, EML, HTML, PHP, TXT, WAB

http://www.sophos.com/virusinfo/analyses/w32brontokk.html