VIRUS ALERTS - January 6, 2006

Type
Trojan

Troj/ServU-BO is a Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojservubo.html

Type
Spyware Trojan

Aliases
Trojan-PSW.Win32.QQShou.ci
PWS-JB

Troj/LegMir-DZ is an information stealing Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojlegmirdz.html

Type
Spyware Trojan

Aliases
Trojan-Spy.Win32.Banker.aom

Troj/Bancban-NH is an internet banking Trojan for the Windows platform.

Troj/Bancban-NH includes functionality to send notification messages to remote locations.

http://www.sophos.com/virusinfo/analyses/trojbancbannh.html

Type
Worm

Aliases
Backdoor.Win32.Virkel.d
W32/Backdoor.HJJ

W32/Chode-R is an instant messaging worm for the Windows platform with IRC backdoor functionality.

W32/Chode-R attempts to spread via MSN Instant Messenger and AOL Instant Messenger by sending users a link to a copy of the worm.

http://www.sophos.com/virusinfo/analyses/w32choder.html

Type
Worm

Aliases
Backdoor.Win32.Rbot.alt
W32/Sdbot.worm.gen.bh
W32.Spybot.Worm
WORM_SDBOT.CTV

W32/Rbot-BHT is a worm with backdoor functionality for the Windows platform.

W32/Rbot-BHT attempts to spread by copying itself to network shares protected by weak passwords.

W32/Rbot-BHT runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels.

The worm contains functionality to modify the system hosts file and to terminate certain processes.

http://www.sophos.com/virusinfo/analyses/w32rbotbht.html

Type
Spyware Worm

Aliases
JS/Kmax.gen@MM
JS_FEEBS.A
Worm.Win32.Feebs.g

W32/Feebs-C is a worm for the Windows platform.

The worm may arrive as an attachment to an email claiming to be sent via "Protected E-Mail service" with bogus credentials. The message may lure the recipient into entering the supplied credentials into an attached HTML document.

W32/Feebs-C spreads via file sharing on P2P networks.

http://www.sophos.com/virusinfo/analyses/w32feebsc.html

Type
Trojan

Aliases
Trojan-Downloader.Win32.VB.ji

Troj/VB-QD is a Trojan for the Windows platform.

Troj/VB-QD includes functionality to download further malicious code.

http://www.sophos.com/virusinfo/analyses/trojvbqd.html

Type
Spyware Trojan

Troj/PWS-HU is a password stealing Trojan for the Windows platform.

The Trojan steals usernames, passwords and email addresses from the infected computer.

Troj/PWS-HU may also attempt to download and install additional files.

http://www.sophos.com/virusinfo/analyses/trojpwshu.html

Type
Trojan

Aliases
Trojan-Downloader.Win32.Small.gen

Troj/Small-IE is a Trojan for the Windows platform.

Troj/Small-IE includes functionality to download, install and run new software.

http://www.sophos.com/virusinfo/analyses/trojsmallie.html

Type
Trojan

Aliases
Trojan-Downloader.Win32.Banload.o

Troj/SmDown-A is a Trojan for the Windows platform.

Troj/SmDown-A includes functionality to download further malicious code.

http://www.sophos.com/virusinfo/analyses/trojsmdowna.html

Type
Trojan

Aliases
PWS-Banker.gen.w

Troj/SmDown-B is a Trojan for the Windows platform.

Troj/SmDown-B contains functionality to download further malicious code.

Troj/SmDown-B attempts to terminate certain anti-virus processes.

http://www.sophos.com/virusinfo/analyses/trojsmdownb.html

Type
Spyware Trojan

Aliases
Trojan-Spy.Win32.Banker.ahy
PWS-Banker.gen.b
PWSteal.Bancos

Troj/Banker-SV is a Trojan for the Windows platform which attempts to capture confidential information related to Internet Banking, such as usernames and logon passwords.

Troj/Banker-SV includes functionality to send notification messages to remote locations.

Troj/Banker-SV may display fake login interfaces for certain Brazilian banking websites in order to steal login details. Any information retrieved in this manner is submitted to the author by email.

http://www.sophos.com/virusinfo/analyses/trojbankersv.html

Type
Trojan

Aliases
Trojan-Downloader.Win32.Small.gen

Troj/Small-IC is a Trojan for the Windows platform.

Troj/Small-IC includes functionality to download, install and run new software.

http://www.sophos.com/virusinfo/analyses/trojsmallic.html

Type
Trojan

Aliases
Trojan-Downloader.Win32.Banload.je

Troj/Banload-JE is a Trojan for the Windows platform.

Troj/Banload-JE includes functionality to access the internet and communicate with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/trojbanloadje.html

Type
Trojan

Aliases
TROJ_SMALL.AWE
Trojan-Downloader.Win32.Small.asa

Troj/Clicker-AZ is a Trojan for the Windows platform.

Troj/Clicker-AZ opens an Internet Explorer window on a preconfigured URL.

http://www.sophos.com/virusinfo/analyses/trojclickeraz.html

Type
Trojan

Aliases
Trojan-Downloader.Win32.Banload.fc
PWS-Banker.gen.ba

Troj/Banload-HG is a Trojan for the Windows platform.

Troj/Banload-HG includes functionality to download, install and run new software.

http://www.sophos.com/virusinfo/analyses/trojbanloadhg.html

Type
Trojan

Aliases
Trojan-Downloader.Win32.Small.cds

Troj/Vixup-W is a downloading Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojvixupw.html

Type
Trojan

Aliases
Trojan-Downloader.Win32.Banload.oa

Troj/Banload-HF is a Trojan for the Windows platform.

Troj/Banload-HF includes functionality to download further malicious code.

http://www.sophos.com/virusinfo/analyses/trojbanloadhf.html

Type
Trojan

Aliases
Trojan-Downloader.Win32.Delf.abi
Downloader-ACH
Download.Trojan

Troj/Downldr-GX is a Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojdownldrgx.html

Type
Spyware Trojan

Aliases
Trojan-Spy.Win32.Banker.anv
PWS-Banker.gen.ba

http://www.sophos.com/virusinfo/analyses/trojbankersw.html

Type
Trojan

Troj/BagleDl-AO is a Trojan for the Windows platform.

When first run, Troj/BagleDl-AO opens a graphics file named ntimage.gif with the default image viewer.

The latest Bagle Trojan horse open a graphics file when first run.

Troj/BagleDl-AO attempts to download files from a number of pre-specified URLs to a file <Windows folder\exefld\ <random number>.exe and run it.

http://www.sophos.com/virusinfo/analyses/trojbagledlao.html

Type
Trojan

Aliases
Trojan-Downloader.Java.OpenConnection.ah
Trojan.ByteVerify
JAVA_BYTEVER.AE
Java/ByteEver.B.4

Troj/Jadown-A is a downloader Trojan.

http://www.sophos.com/virusinfo/analyses/trojjadowna.html

Type
Trojan

Aliases
Trojan-Proxy.Win32.Delf.aa

Troj/ConycSp-I is a Trojan for the Windows platform.

Troj/ConycSp-I includes functionality to access the internet and communicate with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/trojconycspi.html

Type
Trojan

Aliases
Backdoor.Win32.PPdoor.bm
BackDoor-CHC

Troj/PPdoor-Q is a backdoor Trojan for the Windows platform.

Troj/PPdoor-Q includes functionality to access the internet and communicate with a remote server via HTTP.

Troj/PPdoor-Q attempts to disable some security related processes.

http://www.sophos.com/virusinfo/analyses/trojppdoorq.html

Type
Trojan

Aliases
Trojan-Downloader.Win32.Mediket.at

Troj/Dloadr-ABS is a downloader Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojdloadrabs.html

Type
Trojan

Aliases
Trojan-PSW.Win32.Kapod.n

Troj/Kapod-N is a backdoor Trojan for the Windows platform.

Troj/Kapod-N includes functionality to access the internet and communicate with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/trojkapodn.html

Type
Trojan

Aliases
Backdoor.Win32.Hupigon.oy
BackDoor-AWQ.b

Troj/GrayBrd-K is a Trojan for the Windows platform.

Troj/GrayBrd-K includes functionality to access the internet and communicate with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/trojgraybrdk.html

Type
Trojan

Troj/Feutel-AZ is a Trojan for the Windows platform.

Troj/Feutel-AZ includes functionality to access the internet and communicate with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/trojfeutelaz.html

Type
Trojan

Aliases
Trojan-Spy.Win32.WinSpy.h

Troj/WinSpy-D is a Trojan for the Windows platform.

Registry entries are created under:

HKLM\SOFTWARE\MSN\
HKLM\SOFTWARE\Mail\
HKLM\SOFTWARE\NAVUpdater\
HKLM\SOFTWARE\Network\
HKLM\SOFTWARE\Out\
HKLM\SOFTWARE\SSET\
HKLM\SOFTWARE\SoundMaxDriver\
HKLM\SOFTWARE\VideoDriver\
HKLM\SOFTWARE\YahooMessenger\
HKLM\SOFTWARE\ZoneClient\

http://www.sophos.com/virusinfo/analyses/trojwinspyd.html

Type
Trojan

Aliases
W32/Downloader.UU
TROJ_DELF.FAB

Troj/DownLdr-FI is a Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojdownldrfi.html