VIRUS ALERTS - January 5, 2006

Type
Trojan

Aliases
Trojan-Dropper.Win32.Small.akq

Troj/Dropper-DJ is a dropper Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojdropperdj.html

Type
Trojan

Aliases
Trojan-Downloader.Win32.Zlob.dq

Troj/Dropper-DK is a dropper Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojdropperdk.html

Type
Trojan

Troj/GrayBrd-V is a backdoor Trojan for the Windows platform.

Troj/GrayBrd-V includes functionality to access the internet and communicate with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/trojgraybrdv.html

Type
Trojan

Aliases
Backdoor.Win32.Delf.ahy

Troj/Bugspr-A is a backdoor Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojbugspra.html

Type
Trojan

Aliases
BackDoor.bf

Troj/Ciadoor-AA is a Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojciadooraa.html

Type
Spyware Trojan

Aliases
Trojan-Spy.Win32.Banker.ahy
PWS-Banker.gen.b

Troj/Bancban-NG is a Trojan for the Windows platform

http://www.sophos.com/virusinfo/analyses/trojbancbanng.html

Type
Trojan

Aliases
Trojan-Downloader.Win32.Banload.oj

Troj/BankDl-AH is a Trojan for the Windows platform.

Troj/BankDl-AH has the functionality to silently download, install and run new software.

http://www.sophos.com/virusinfo/analyses/trojbankdlah.html

Type
Spyware Trojan

Aliases
Backdoor.Win32.Prorat.am
BackDoor-AVW

Troj/Prorat-AZ is a Trojan for the Windows platform.

Troj/Prorat-AZ has the functionalities to:

- allows a remote intruder to gain access and control over the infected computer
- log keystroke

http://www.sophos.com/virusinfo/analyses/trojprorataz.html

Type
Trojan

Aliases
DNSChanger.a

Troj/DNSBust-E is a Trojan for the Windows platform.

Troj/DNSBust-E includes functionality to access the internet and communicate with a remote server via HTTP.

Troj/DNSBust-E may also attempt to modify DNS settings on the computer.

http://www.sophos.com/virusinfo/analyses/trojdnsbuste.html

Type
Spyware Trojan

Aliases
Trojan-Spy.Win32.Bancos.ha
trojan

Troj/Bancos-IU is an internet banking Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojbancosiu.html

Type
Trojan

Aliases
Trojan-Downloader.Win32.Banload.jt
trojan

Troj/Banload-HN is a Trojan for the Windows platform.

Troj/Banload-HN includes functionality to access the internet and communicate with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/trojbanloadhn.html

Type
Trojan

Aliases
Trojan-Downloader.Win32.Delf.yj

Troj/DownLdr-QP is a Trojan for the Windows platform.

Troj/DownLdr-QP includes functionality to access the internet and communicate
with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/trojdownldrqp.html

Type
Worm

Aliases
StartPage-IH

W32/Rbot-BIS is a worm and IRC backdoor Trojan for the Windows platform.

W32/Rbot-BIS spreads to other network computers by exploiting common buffer overflow vulnerabilities, including: LSASS (MS04-011), RPC-DCOM (MS04-012), WKS(MS03-049) (CAN-2003-0812), MSSQL (MS02-039) (CAN-2002-0649) and ASN.1 (MS04-007) and by copying itself to network shares protected by weak passwords.

http://www.sophos.com/virusinfo/analyses/w32rbotbis.html

Type
Worm

Aliases
Backdoor.Win32.Rbot.aie

W32/Rbot-BIT is a worm and IRC backdoor Trojan for the Windows platform.

W32/Rbot-BIT spreads to other network computers by exploiting common buffer
overflow vulnerabilities, including IIS5SSL (MS04-011) (CAN-2003-0719).

W32/Rbot-BIT runs continuously in the background, providing a backdoor server
which allows a remote intruder to gain access and control over the computer via
IRC channels.

http://www.sophos.com/virusinfo/analyses/w32rbotbit.html

Type
Trojan

Troj/Dloader-WO is a downloader Trojan for the Windows platform.

The Trojan attempts to download and install further software and disable Microsoft Anti-Spyware. Troj/Dloader-WO may also monitor user activity.

http://www.sophos.com/virusinfo/analyses/trojdloaderwo.html

Type
Trojan

Aliases
Trojan.Win32.StartPage.aed
StartPage-HP

Troj/StartPa-HN is a Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojstartpahn.html

Type
Trojan

Aliases
Trojan-Downloader.Win32.Small.bsj

Troj/Dloader-WP is a Trojan for the Windows platform.

Troj/Dloader-WP includes functionality to download, install and run new software.

http://www.sophos.com/virusinfo/analyses/trojdloaderwp.html

Type
Trojan

Aliases
Backdoor.Win32.Delf.xf

Troj/Subot-D is a backdoor Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojsubotd.html

Type
Worm

W32/Rbot-ASW is an IRC worm and backdoor Trojan for the Windows platform.

W32/Rbot-ASW may spread by copying itself to network shares or by exploiting the vulnerabilities LSASS (MS04-011), RPC-DCOM (MS04-012), WKS (MS03-049), WebDav (MS03-007), IIS5SSL (MS04-011), UPNP (MS01-059), Veritas (CAN-2004-1172), Dameware (CAN-2003-1030) or ASN.1 (MS04-007).

W32/Rbot-ASW runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels.

http://www.sophos.com/virusinfo/analyses/w32rbotasw.html

Type
Worm

Aliases
W32/Sdbot.worm.gen.l

W32/Rbot-ASU is a worm and IRC backdoor Trojan for the Windows platform.

W32/Rbot-ASU spreads by copying itself to network shares protected by weak passwords and to other network computers by exploiting common buffer overflow vulnerabilities, including: RPC-DCOM (MS04-012), PNP (MS05-039) and ASN.1 (MS04-007).

W32/Rbot-ASU runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels.

http://www.sophos.com/virusinfo/analyses/w32rbotasu.html

Type
Spyware Trojan

Aliases
Trojan-Spy.Win32.Banbra.ek

Troj/Banker-FZ is a password stealing Trojan for the Windows platform.

Troj/Banker-FZ targets the customers of certain Brazilian online banking websites, by logging any keystrokes entered into any forms at those websites as well as creating screen grabs.

http://www.sophos.com/virusinfo/analyses/trojbankerfz.html

Type
Trojan

Aliases
Trojan-Spy.Win32.Banbra.ej

Troj/BankDl-O is a downloader Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojbankdlo.html

Type
Spyware Trojan

Aliases
Trojan-Spy.Win32.Banbra.ej

Troj/Banker-FY is an internet banking Trojan.

http://www.sophos.com/virusinfo/analyses/trojbankerfy.html

Type
Spyware Worm

W32/Feebs-A is a worm for the Windows platform.

The worm may arrive as an attachment to an email claiming to be sent via "Protected E-Mail service" with bogus credentials. The message may lure the recipient into entering the supplied credentials into an attached HTML document.

W32/Feebs-A also creates several copies of itself in ZIP format in paths containing "share".

W32/Feebs-A may also harvest information from the infected computer and send stolen data to a remote user via FTP.

http://www.sophos.com/virusinfo/analyses/w32feebsa.html

Type
Trojan

Troj/Bifrose-R is a Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojbifroser.html

Type
Trojan

Aliases
JS/Exploit-BO.gen

Troj/Dloadr-ACP is a downloader Trojan for the Windows platform.

Troj/Dloadr-ACP attempts to download and execute a file from the internet.

http://www.sophos.com/virusinfo/analyses/trojdloadracp.html

Type
Trojan

Aliases
Exploit-ByteVerify

Troj/Bizves-C is a Trojan for the Windows platform.

Troj/Bizves-C creates a file named loadclean.exe in the Windows folder.
Loadclean.exe is detected by Sophos's anti-virus products as Troj/Bizves-Gen.

http://www.sophos.com/virusinfo/analyses/trojbizvesc.html

Type
Trojan

Aliases
Trojan-Downloader.Win32.Adload.j

Troj/Dloadr-ACQ is a downloader Trojan for the Windows platform.
The Trojan downloads a file to C:\drsmartload.exe and runs the downloaded file.

At the time of writing drsmartload.exe is detected by Sophos's anti-virus products as Troj/Drsmartl-C.

http://www.sophos.com/virusinfo/analyses/trojdloadracq.html

Type
Trojan

Aliases
Trojan-Downloader.Win32.Delf.xq

Troj/Banload-CA is a Trojan for the Windows platform.

The Trojan downloads and runs additional files from a remote site.

http://www.sophos.com/virusinfo/analyses/trojbanloadca.html

Type
Trojan

Aliases
Trojan-Downloader.Win32.Banload.ls

Troj/Banload-CC is a Trojan for the Windows platform.

The Trojan downloads and runs additional files from a remote site.

http://www.sophos.com/virusinfo/analyses/trojbanloadcc.html