VIRUS ALERTS - January 4, 2005

Type Worm

W32/Sdranck-W is a multi-component network worm for the Windows platform.

http://www.sophos.com/virusinfo/analyses/w32sdranckw.html

Type Trojan

Exp/WMF-A detects Windows Metafiles (WMF) which exploit a vulnerability in the image rendering functionality of the DLL GDI32.DLL, which allows the execution of arbitrary code.
The exploit runs on several Windows platforms including Windows XP SP2 and affects several image-rendering applications which use GDI32.DLL directly or via the DLL SHIMGVW.DLL, eg Windows Picture and Fax Viewer (and other applications which depend on it, like Windows Explorer when it displays thumbnails).
Microsoft do not have a patch for this vulnerability yet.
For more information please see the following Microsoft advisory:
http://www.microsoft.com/technet/security/advisory/912840.mspx

http://www.sophos.com/virusinfo/analyses/expwmfa.html

Type Trojan

Troj/IRCBot-CX is a Trojan for the Windows platform.
The Trojan connects to an IRC server and awaits commands from remote attackers.

http://www.sophos.com/virusinfo/analyses/trojircbotcx.html

Type Worm

Aliases Backdoor.Win32.Rbot.ald

W32/Rbot-BIW is a worm and IRC backdoor Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/w32rbotbiw.html

Type Trojan

Aliases Trojan-Proxy.Win32.Agent.df

Troj/Spygal-F is a backdoor Trojan with downloader capabilities.

http://www.sophos.com/virusinfo/analyses/trojspygalf.html

Type Spyware Trojan

Aliases Trojan-Spy.Win32.Delf.la
PWS-QQPass.dll

Troj/LegMir-DW is a password-stealing Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojlegmirdw.html

Type Trojan

Aliases BackDoor-AZV

Troj/DownLdr-QZ is a Trojan for the Windows platform.
The Trojan modifies the Windows firewall settings, downloads and executes files from a remote site. At the time of writing, the downloaded file is detected by Sophos's anti-virus products as Troj/IRCBot-CX.

http://www.sophos.com/virusinfo/analyses/trojdownldrqz.html

Type Trojan

Troj/Dloadr-DQ is a downloader Trojan for the Windows platform.
The Trojan contains functionality to download files from a predefined URL.

http://www.sophos.com/virusinfo/analyses/trojdloadrdq.html

Type Trojan

Aliases Backdoor.Win32.Agent.ri

Troj/Agent-RI is a Trojan for the Windows platform.
The Trojan contains functionality to access the Internet and download files.

http://www.sophos.com/virusinfo/analyses/trojagentri.html

Type Worm

Aliases Net-Worm.Win32.AllocUp.g

W32/Allocu-C is a worm for the Windows platform.
W32/Allocu-C spreads to other network computers by exploiting common buffer over
flow vulnerabilites, including LSASS (MS04-011).

http://www.sophos.com/virusinfo/analyses/w32allocuc.html

Type Spyware Trojan

Aliases Trojan-Spy.Win32.Agent.iu

Troj/LegMir-DX is an information stealing Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojlegmirdx.html

Type Spyware Trojan

Troj/Lineage-DV is a password stealing Trojan for the Windows platform.
Troj/Lineage-DV has the functionalities to:
- record keystrokes
- communicate with a remote server via email

http://www.sophos.com/virusinfo/analyses/trojlineagedv.html