VIRUS ALERTS - January 5, 2006

Type
Spyware Trojan

Aliases
Trojan-Spy.Win32.Bancos.lo

Troj/VBanker-C is a Trojan for the Windows platform.

The Trojan monitors Internet Explorer windows for sessions with online banking web sites. The Trojan captures login credentials and sends stolen information to a remote attacker.

http://www.sophos.com/virusinfo/analyses/trojvbankerc.html

Type
Trojan

Aliases
Trojan-Downloader.Win32.Dadobra.jz

Troj/Banload-CB is a Trojan for the Windows platform.

The Trojan downloads and runs additional files from a remote site.

http://www.sophos.com/virusinfo/analyses/trojbanloadcb.html

Type
Spyware Trojan

Aliases
Trojan-Spy.Win32.Bancos.jl

Troj/VBanker-B is a Trojan for the Windows platform.

The Trojan monitors Internet Explorer windows for sessions with online banking web sites. The Trojan captures login credentials and sends stolen information to a remote attacker.

http://www.sophos.com/virusinfo/analyses/trojvbankerb.html

Type
Spyware Trojan

Aliases
Trojan-Spy.Win32.ProAgent.t
PWS-Progent
Trojan.Progent

Troj/Progent-P is a backdoor Trojan for the Windows platform.

Troj/Progent-P includes functionality to:

- access the internet and communicate with a remote server via HTTP
- steal information and passwords from a number of games and applications
- send notification messages to remote locations
- log key presses

http://www.sophos.com/virusinfo/analyses/trojprogentp.html

Type
Trojan

Aliases
Trojan-Dropper.Win32.Juntador.e
trojan

Troj/Mdrop-IX is a multidropper Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojmdropix.html

Type
Worm

W32/Rbot-BIR is a worm for the Windows platform.

W32/Rbot-BIR spreads:

- to other network computers infected with: Troj/Kuang, Troj/Sub7, Troj/NetDevil, W32/MyDoom, W32/Bagle and Troj/Optix
- to other network computers by exploiting common buffer overflow vulnerabilities, including: LSASS (MS04-011), RPC-DCOM (MS04-012), WebDav (MS03-007) and Dameware (CAN-2003-1030)
- by copying itself to network shares protected by weak passwords

http://www.sophos.com/virusinfo/analyses/w32rbotbir.html

Type
Trojan

Aliases
Backdoor.Win32.VBbot.e

Troj/VBbot-Q is a backdoor Trojan for the Windows platform that allows access to the infected computer via an IRC channel.

http://www.sophos.com/virusinfo/analyses/trojvbbotq.html

Type
Worm

W32/Rbot-BIU is a worm and IRC backdoor Trojan for the Windows platform.

W32/Rbot-BIU spreads:

- to other network computers infected with Troj/Kuang
- to other network computers by exploiting common buffer overflow vulnerabilities, including: LSASS (MS04-011) and RPC-DCOM (MS04-012)
- by copying itself to network shares protected by weak passwords

W32/Rbot-BIU runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels.

http://www.sophos.com/virusinfo/analyses/w32rbotbiu.html

Type
Trojan

Aliases
Trojan-Downloader.Win32.Femad.aa

Troj/DownLdr-QQ is a Trojan for the Windows platform.

Troj/DownLdr-QQ includes functionality to access the internet and communicate with a remote server via HTTP.

Type
Trojan

Aliases
Trojan-Downloader.Win32.VB.ui

Troj/DownLdr-QR is a Trojan for the Windows platform.

Troj/DownLdr-QR includes functionality to download, install and run new software.

http://www.sophos.com/virusinfo/analyses/trojdownldrqr.html

Type
Spyware Trojan

Aliases
Trojan-Spy.Win32.Banker.zp
PWS-Banker.gen.b
PWSteal.Banpaes
Troj/Bandler-J is an information stealing Trojan for the Windows platform.

Troj/Bandler-J includes functionality to:

-access the internet and communicate with a remote server via HTTP
-download, install and run new software
-log keypresses

Troj/Bandler-J will also attempt to terminate Anti-virus and security related applications.

http://www.sophos.com/virusinfo/analyses/trojbandlerj.html

Type
Trojan

Troj/DownLdr-QT is a Trojan for the Windows platform.

Troj/DownLdr-QT includes functionality to download, install and run new software

http://www.sophos.com/virusinfo/analyses/trojdownldrqt.html

Type
Spyware Trojan

Aliases
Backdoor.Win32.Zdemon.126
BackDoor-APT
Backdoor.Zdemon.10
BKDR_ZDEMON.1

Troj/Antilam-H is a backdoor Trojan for the Windows platform that provides unauthorized remote access to the infected computer.

Troj/Antilam-H includes functionality to:

-download files using its own SMTP engine or FTP server
-log keypresses
-steal confidential information
-provide access to the available network drives
-terminate AV and security related applications

http://www.sophos.com/virusinfo/analyses/trojantilamh.html

Type
Trojan

Aliases
Trojan-Dropper.Win32.VB.cn

Troj/Multidr-FC is a dropper Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojmultidrfc.html

Type
Trojan

Troj/Small-IL is a Trojan component for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojsmallil.html

Type
Trojan

Aliases
Trojan-Downloader.Win32.Agent.wd

Troj/Agent-MS is a Trojan for the Windows platform.

Troj/Agent-MS includes functionality to access the internet and communicate with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/trojagentms.html

Type
Trojan

Aliases
Backdoor.Win32.Prosti.s

Troj/Prosti-S is a backdoor Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojprostis.html

Type
Trojan

Aliases
Trojan-Downloader.Win32.QQHelper.e

Troj/QQHelp-E is a Trojan for the Windows platform.

Troj/QQHelp-E includes functionality to access the internet and to download, install and run new software.

http://www.sophos.com/virusinfo/analyses/trojqqhelpe.html

Type
Trojan

Aliases
Trojan-PSW.Win32.Lineage.rn

Troj/Lineage-DW is a password stealing Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojlineagedw.html

Type Trojan

Aliases Backdoor.Ryknos

Troj/Stinx-K is a backdoor Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojstinxk.html

Type Trojan

Aliases Email-Worm.Win32.Locksky.m

Troj/Loosky-R is a downloading Trojan and proxy server.
Troj/Loosky-R downloads and executes files from a preconfigured URL and provides a proxy server, allowing a remote attacker to route TCP traffic through the infected computer.

http://www.sophos.com/virusinfo/analyses/trojlooskyr.html

Type Trojan

Aliases Trojan-PSW.Win32.VB.ho

Troj/Aolps-Q is a Trojan for the Windows platform.
Troj/Aolps-Q includes functionality to access the internet and communicate with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/trojaolpsq.html

Type Trojan

Aliases Trojan-Downloader.Win32.Small.bzt

Troj/Small-IM is a downloader Trojan for the Windows platform.
Troj/Small-IM includes functionality to download, install and run new software.

http://www.sophos.com/virusinfo/analyses/trojsmallim.html

Type Trojan

Aliases not-a-virus:AdWare.Win32.Lop.ag
Swizzor.gen

Troj/Swizzor-AG is a Trojan for the Windows platform.
Troj/Swizzor-AG includes functionality to access the internet and communicate with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/trojswizzorag.html

Type Trojan

Aliases Backdoor.Win32.Hupigon.he

Troj/Feutel-CD is a backdoor Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojfeutelcd.html

Type Trojan

Aliases VAnti
Rootkit.Win32.Vanti.ah

Troj/Hackvan-D is a Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojhackvand.html

Type Spyware Trojan

Aliases Trojan-Spy.Win32.Banbra.df

Troj/Banker-TP is a password stealing Trojan for the Windows platform.
The Trojan monitors Internet Explorer sessions and captures keypresses when certain banking sites are visited by displaying fake login windows. The harvested information is then sent to a remote user via email.

http://www.sophos.com/virusinfo/analyses/trojbankertp.html

Type Spyware Worm

Aliases JS/Kmax.gen@MM
JS_FEEBS.A
Worm.Win32.Feebs.h

W32/Feebs-H is a worm for the Windows platform.
The worm may arrive as an attachment to an email claiming to be sent via "Protected E-Mail service" with bogus credentials. The message may lure the recipient into entering the supplied credentials into an attached HTML document.
W32/Feebs-H spreads via file sharing on P2P networks.
W32/Feebs-H may also harvest information from the infected computer and send stolen data to a remote user via FTP.

http://www.sophos.com/virusinfo/analyses/w32feebsh.html

Type Worm

Aliases Backdoor.Win32.IRCBot.jm

W32/IRCBot-BR is a worm and IRC backdoor Trojan for the Windows platform.
W32/IRCBot-BR spreads to other network computers by exploiting common buffer overflow vulnerabilities, including ASN.1 (MS04-007).
W32/IRCBot-BR runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels.
W32/IRCBot-BR includes functionality to download, install and run new software.
The following patches for the operating system vulnerabilities exploited by W32/IRCBot-BR can be obtained from the Microsoft website:
MS04-007

http://www.sophos.com/virusinfo/analyses/w32ircbotbr.html

Type Trojan

Aliases Trojan.Servu.1

Troj/ServU-BV is a modified version of a commercial FTP server application.

http://www.sophos.com/virusinfo/analyses/trojservubv.html