VIRUS ALERTS - January 6, 2006

Type
Spyware Trojan

Troj/Sdbot-AGX is a backdoor Trojan for the Windows platform.

Troj/Sdbot-AGX enables a remote user to perform such actions as:

Record keystrokes and screenshots.
Use the infected computer as a proxy for mail or internet traffic.
Launch DDOS attacks.
Download new files.

http://www.sophos.com/virusinfo/analyses/trojsdbotagx.html

Type
Spyware Trojan

Aliases
Trojan-Spy.Win32.Banbra.df

Troj/Bancj-D is a Trojan for the Windows platform.

Troj/Bancj-D includes functionality to:

- access the internet and communicate with a remote server via HTTP
- send notification messages to remote locations

The Trojan monitors Internet Explorer windows for sessions with online banking web sites. The Trojan captures login credentials and sends stolen information to a remote attacker.

http://www.sophos.com/virusinfo/analyses/trojbancjd.html

Type
Spyware Trojan

Aliases
Trojan-Spy.Win32.Banbra.df

Troj/Bancban-MA is a Trojan for the Windows platform.

Troj/Bancban-MA includes functionality to:

- access the internet and communicate with a remote server via HTTP
- send notification messages to remote locations

The Trojan monitors Internet Explorer windows for sessions with online banking web sites. The Trojan captures login credentials and sends stolen information to a remote attacker.

http://www.sophos.com/virusinfo/analyses/trojbancbanma.html

Type
Spyware Trojan

Aliases
TSPY_BANBRA.CB
Trojan-Spy.Win32.Banbra.df

Troj/Bancban-MB is a Trojan for the Windows platform.

Troj/Bancban-MB includes functionality to:

- access the internet and communicate with a remote server via HTTP
- send notification messages to remote locations

The Trojan monitors Internet Explorer windows for sessions with online banking web sites. The Trojan captures login credentials and sends stolen information to a remote attacker.

http://www.sophos.com/virusinfo/analyses/trojbancbanmb.html

Type
Trojan

Aliases
Trojan-Downloader.Win32.Zlob.cu

Troj/LewDl-E is a Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojlewdle.html

Type
Worm

Aliases
Net-Worm.Win32.Reporter
W32/Dasher.worm

W32/Dasher-B is a worm for the Windows platform.

W32/Dasher-B spreads by exploiting the MSDTC (MS05-051) vulnerability.

When run the worm creates the following files :
<Windows system folder> \wins\sqlexp.exe
<Windows system folder> \wins\sqlscan.exe
<Windows system folder> \wins\svchost.exe

Sqlscan.exe is a port scanner, used to search networks for open ports.
Sqlexp.exe and svchost.exe are detected as W32/Dasher-B.

W32/Dasher-B searches a set of pre-defined networks for open ports and attempts to exploit and vulnerable computers it finds. The exploit opens a backdoor on the vulnerable computer and causes it to connect to a remote server for further instructions.

At the time of writing the instructions supplied by the remote server cause the exploited computer to download and execute two further programs.

A patch for the operating system vulnerabilty exploited by W32/Dasher-B is available from Microsoft:

http://www.microsoft.com/technet/security/bulletin/MS05-051.mspx

http://www.sophos.com/virusinfo/analyses/w32dasherb.html

Type
Spyware Worm

Aliases
Backdoor.Win32.SdBot.xd

W32/Tilebot-CP is a worm and IRC backdoor Trojan for the Windows platform.

W32/Tilebot-CP spreads to other network computers by exploiting common buffer overflow vulnerabilities, including: WKS (MS03-049) (CAN-2003-0812), PNP (MS05-039) and ASN.1 (MS04-007) and by copying itself to network shares protected by weak passwords.

W32/Tilebot-CP runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels.

http://www.sophos.com/virusinfo/analyses/w32tilebotcp.html

Type
Spyware Worm

Aliases
Backdoor.Win32.IRCBot.gv

W32/Spybot-EM is a worm and backdoor Trojan for the Windows platform.

A remote intruder may use W32/Spybot-EM to download and execute further code, and to steal information by (for example) logging keystrokes and taking screenshots.

http://www.sophos.com/virusinfo/analyses/w32spybotem.html

Type
Worm

Aliases
Backdoor.Win32.IRCBot.ko

W32/Spybot-EN is a worm for the Windows platform.

W32/Spybot-EN includes functionality to access the internet and communicate with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/w32spyboten.html

Type
Spyware Worm

Aliases
PWS-Banker.gen.p
TSPY_BANCOS.BIA

W32/Antiman-G is an email worm for the Windows platform.

W32/Antiman-G includes functionality to access the internet and communicate with a remote server via HTTP, and may attempt to download a file from a remote website.

W32/Antiman-G may attempt to terminate processes, delete files and close windows related to certain anti-virus and security programs.

W32/Antiman-G logs user information and keystrokes, in particular those related to certain Brazilian banking websites.

W32/Antiman-G may send itself by email to addresses it harvests from the infected computer.

http://www.sophos.com/virusinfo/analyses/w32antimang.html

Type
Trojan

Aliases
Trojan-Downloader.Win32.Zlob.dy
Trojan-Downloader.Win32.Zlob.dz
Puper.dll

Troj/Zlob-CD is a Trojan for the Windows platform.

Troj/Zlob-CD contains functionality to download further malicious code.

http://www.sophos.com/virusinfo/analyses/trojzlobcd.html

Type
Spyware Trojan

Aliases
Trojan-Spy.Win32.Bancos.oa

Troj/Bancos-IW is a Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojbancosiw.html

Type
Trojan

Aliases
Trojan.Win32.Small.gt
BackDoor-CEP

Troj/Bifrose-CU is a backdoor Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojbifrosecu.html

Type
Trojan

Aliases
BackDoor-AWQ.b

Troj/Bckdr-E is a Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojbckdre.html

Type
Trojan

Aliases
Backdoor.Win32.ByShell.b
Backdoor.ByShell.a
W32/Byshell.A

Troj/ByShell-A is an NT rootkit which intercepts various system APIs.

Troj/ByShell-A comprises the number of files and includes the functionality to hide processes, insert itself into other applications process space and bypass security applications including firewall.

Troj/ByShell-A allows an unauthorized remote access to the infected computer

http://www.sophos.com/virusinfo/analyses/trojbyshella.html

Type
Trojan

Aliases
Exploit.Win32.MS05-039.ac
Exploit-DcomRpc.g.gen

Troj/ExpBdoor-A is a Trojan for the Windows platform.

Troj/ExpBdoor-A exploits an operating system vulnerability to open a backdoor
on a remote computer.

A patch for the operating system vulnerability exploited by Troj/ExpBdoor-A is available from Microsoft:
MS05-039

http://www.sophos.com/virusinfo/analyses/trojexpbdoora.html

Type
Worm

Aliases
Email-Worm.Win32.NetSky.ak
W32/Netsky.am
W32.Netsky@mm
WORM_NETSKY.AP

W32/Netsky-W is a variant of the W32/Netsky worms for the Windows platform that attempts to spread via email.

http://www.sophos.com/virusinfo/analyses/w32netskyw.html

Type
Trojan

Aliases
Trojan-Downloader.Win32.PassAlert.d
StartPage-IC

Troj/Dloadr-ACO is a downloader Trojan for the Windows platform.

Troj/Dloadr-ACO includes functionality to download and run programs from the internet and bypass personal firewall software.

http://www.sophos.com/virusinfo/analyses/trojdloadraco.html

Type
Worm

Aliases
Backdoor.Win32.SdBot.ajs

W32/Sdbot-AJS is a network worm and IRC backdoor Trojan for the Windows platform.

W32/Sdbot-AJS runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels.

W32/Sdbot-AJS includes functionality to access the internet and communicate with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/w32sdbotajs.html

Type
Spyware Worm

Aliases
Email-Worm.Win32.Locksky.l
W32/Loosky.gen@MM

W32/Loosky-L is an email worm for the Windows platform.

W32/Loosky-L spreads by sending email with the following characteristics:

Subject line:
Your mail Account is Suspended

Message text:
We regret to inform you that your account has been suspended due to the violation of our site policy, more info is attached.

Attached file:
acc_inf01.exe

The worm also installs a proxy server and opens a backdoor allowing a remote user to take control of the infected computer.

W32/Loosky-L records a user's keystrokes and attemtps to steal and stored passwords.

http://www.sophos.com/virusinfo/analyses/w32looskyl.html

Type
Trojan

Aliases
Trojan-Clicker.Win32.Small.jf

Troj/AdClick-BJ is a Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojadclickbj.html

Type
Spyware Trojan

Aliases
Trojan-Spy.Win32.Banker.ahy
PWS-Banker.gen.bb

Troj/Bancban-MD is a Trojan for the Windows platform.

Troj/Bancban-MD includes functionality to send notification messages to remote locations.

http://www.sophos.com/virusinfo/analyses/trojbancbanmd.html

Type Trojan

Aliases Trojan-Downloader.Win32.Zlob.du
Trojan-Downloader.Win32.Zlob.dq
Trojan-Downloader.Win32.Zlob.dx
Trojan-Downloader.Win32.Zlob.dk
Downloader-AQW
Trojan.Zlob

Troj/Zlob-CE is a Trojan for the Windows platform.
Troj/Zlob-CE may download further malicious code.

http://www.sophos.com/virusinfo/analyses/trojzlobce.html

Type Trojan

Aliases Backdoor.Win32.Hupigon.pm
BKDR_HUPIGON.SC
Generic.cc

Troj/GrayBrd-Y is a backdoor Trojan for the Windows platform.
Troj/GrayBrd-Y includes functionality to access the internet and communicate with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/trojgraybrdy.html

Type Worm

Aliases Virus.Win32.VB.ad

W32/Style-B is a worm for the Windows platform.
W32/Style-B spreads via file sharing on P2P networks.

http://www.sophos.com/virusinfo/analyses/w32styleb.html

Type Trojan

Aliases DNSChanger.a

Troj/DNSBust-G is a Trojan for the Windows platform.
Troj/DNSBust-G includes functionality to access the internet and communicate with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/trojdnsbustg.html

Type Trojan

Aliases Trojan-PSW.Win32.Lineage.sk

Troj/Lineage-DX is a Trojan for the Windows platform.
Troj/Lineage-DX can be used by other malicious programs to create and send email messages.


http://www.sophos.com/virusinfo/analyses/trojlineagedx.html

Type Trojan

Aliases BackDoor-AZV

Troj/Vixup-Z is a Trojan for the Windows platform.
Troj/Vixup-Z includes functionality to download, install and run new software.

http://www.sophos.com/virusinfo/analyses/trojvixupz.html

Type Trojan

Aliases Trojan-Downloader.Win32.Small.bvy

Troj/Small-IO is a Trojan for the Windows platform.
Troj/Small-IO includes functionality to download, install and run new software.
Troj/Small-IO attempts to inject code into the Internet Explorer process.

http://www.sophos.com/virusinfo/analyses/trojsmallio.html

Type Trojan

Aliases Trojan-Dropper.Win32.Agent.qz

Troj/Agent-MZ is a backdoor Trojan for the Windows platform.
Troj/Agent-MZ installs several legitimate utilities, including a remote administration tool. The Trojan then runs the remote administration tool in such a way as to provide unauthorized access to the infected computer.
Troj/Agent-MZ comes as a self-extracting archive, labelled as a crack or key generator for a commercial application.

http://www.sophos.com/virusinfo/analyses/trojagentmz.html