VIRUS ALERTS - January 9, 2006

Type
Trojan

Aliases
TROJ_DROPPER.XS

Troj/QQRob-BA is a Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojqqrobba.html

Type
Spyware Trojan

Aliases
Trojan-Spy.Win32.Bancos.ha

Troj/Bancos-IY is a Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojbancosiy.html

Type
Worm

Aliases
Virus.Win32.Bube.e

W32/Bube-E is a downloader worm for Windows operating systems.

Once fully installed, the worm contacts a pre-specified website to report its presence on the computer, and periodically tries to download a file that will specify further commands for the worm to execute. W32/Bube-E can be instructed to:

Install software to the registry
Set and delete registry entries
Open Internet Explorer to a specific web page
Run Explorer with specified parameters
Download and execute files

http://www.sophos.com/virusinfo/analyses/w32bubee.html

Type
Trojan

Aliases
Trojan.Win32.Dialer.hz

Dial/Chivio-S is a dialer application.

http://www.sophos.com/virusinfo/analyses/dialchivios.html

Type
Trojan

Aliases
Trojan-Proxy.Win32.Agent.fs

Troj/Meteor-E is a backdoor Trojan which allows a remote intruder to gain access and control over the computer.

http://www.sophos.com/virusinfo/analyses/trojmeteore.html

Type
Worm

W32/Rbot-BJA is a worm and IRC backdoor Trojan for the Windows platform.

W32/Rbot-BJA runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels.

http://www.sophos.com/virusinfo/analyses/w32rbotbja.html

Type
Trojan

Aliases
Trojan.Win32.StartPage.aha
Generic

Troj/StartPa-KN is a Trojan for the Windows platform.

Troj/StartPa-KN includes functionality to access the internet and communicate with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/trojstartpakn.html

Type
Spyware Trojan

Aliases
Trojan-Spy.Win32.Banker.zp

Troj/Bandler-K is a password stealing Trojan for the Windows platform.

Troj/Bandler-K targets the customers of certain Brazilian online banking websites by displaying fake user interfaces and recording any entered details.

http://www.sophos.com/virusinfo/analyses/trojbandlerk.html

Type
Trojan

Troj/GwGhost-W is a Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojgwghostw.html

Type
Worm

Aliases
Backdoor.Win32.Rbot.adf

W32/Rbot-BJM is a worm and IRC backdoor Trojan for the Windows platform.

W32/Rbot-BJM spreads:

- to other network computers infected with: Troj/Kuang, Troj/Sub7, Troj/NetDevil, W32/MyDoom, W32/Bagle and Troj/Optix
- to other network computers by exploiting common buffer overflow vulnerabilities, including: LSASS (MS04-011), RPC-DCOM (MS04-012), WKS (MS03-049) (CAN-2003-0812), WebDav (MS03-007), IIS5SSL (MS04-011) (CAN-2003-0719), UPNP (MS01-059), Veritas (CAN-2004-1172), Dameware (CAN-2003-1030) and ASN.1 (MS04-007)
- by copying itself to network shares protected by weak passwords

W32/Rbot-BJM runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels.

http://www.sophos.com/virusinfo/analyses/w32rbotbjm.html

Type
Trojan

Aliases
Trojan-PSW.Win32.Delf.jd

Troj/QQRob-BD is a Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojqqrobbd.html

Type
Worm

W32/Rbot-BJN is network worm and backdoor Trojan for the Windows platform.

W32/Rbot-BJN can spread via the RPC-DCOM (MS04-012) and LSASS (MS04-011) buffer overflow vulnerabilities.

W32/Rbot-BJN runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels.

http://www.sophos.com/virusinfo/analyses/w32rbotbjn.html

Type
Trojan

Aliases
IRC/Flood.b.dr

Troj/Flood-EV is a backdoor Trojan for the Windows platform.

Troj/Flood-EV allows unauthenticated access for remote intruders to the infected computer.

http://www.sophos.com/virusinfo/analyses/trojfloodev.html

Type
Trojan

Aliases
Trojan-Clicker.Win32.VB.kc

Troj/Clicker-BL is a Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojclickerbl.html

Type
Trojan

Aliases
Virus.Win32.Nsag.b
W32/Alemod.f.dll
Trojan.Alemod
TROJ_DHIJACK.A

Troj/AleSpy-O is a Windows Trojan that attempts to spy on web traffic.

http://www.sophos.com/virusinfo/analyses/trojalesspyo.html

Type
Trojan

Dial/Dialer-X is a dialer for the Windows platform.

When executed the dialer displays a message box as 'Please Confirm'. The dialer then opens Internet Explorer to a predefined page.

http://www.sophos.com/virusinfo/analyses/dialdialerx.html

Type
Trojan

Dial/Dialer-N is a premium rate porn dialer application.

http://www.sophos.com/virusinfo/analyses/dialdialern.html

Type
Trojan

Aliases
Download.Trojan

Troj/Jupdrop-A is a dropper Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojjupdropa.html

Type
Trojan

Aliases
Trojan-Proxy.Win32.Delf.al

Troj/Jupdow-A is a Trojan for the Windows platform.

Troj/Jupdow-A attempts to download configuration files from a remote website to the Windows temp folder, and may then attempt to download files from further websites.

http://www.sophos.com/virusinfo/analyses/trojjupdowa.html

Type
Trojan

Troj/Jupdow-B is a Trojan for the Windows platform.

Troj/Jupdow-B attempts to download configuration files from a remote website to the Windows temp folder, and may then attempt to download files from further websites.

http://www.sophos.com/virusinfo/analyses/trojjupdowb.html

Type
Trojan

Aliases
Backdoor.Win32.Hupigon.mk

Troj/GrayBrd-AL is a component of a backdoor Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojgraybrdal.html

Type
Spyware Trojan

Aliases
Trojan-Spy.Win32.Banker.ahy

Troj/Bancban-IR is a password-stealing Trojan for the Windows platform.

Troj/Bancban-IR includes functionality to send notification messages to remote locations.

http://www.sophos.com/virusinfo/analyses/trojbancbanir.html

Type
Worm

Aliases
W32/Spybot.NLU
W32/Sdbot.worm.gen.bh

W32/Rbot-AYC is a worm with IRC backdoor functionality for the Windows platform.

W32/Rbot-AYC can spread via network shares or MSSQL when it finds weak passwords. It may also spread to systems compromised by other malware, or by exploiting common vulnerabilities, including: LSASS (MS04-011), RPC-DCOM (MS04-012), WKS (MS03-049) (CAN-2003-0812), WebDav (MS03-007), IIS5SSL (MS04-011) (CAN-2003-0719), UPNP (MS01-059), Veritas (CAN-2004-1172), Dameware (CAN-2003-1030), PNP (MS05-039), and ASN.1 (MS04-007).

W32/Rbot-AYC runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels.

http://www.sophos.com/virusinfo/analyses/w32rbotayc.html

Type
Trojan

Aliases
Backdoor.Win32.Dumador.ez

Troj/Dumaru-BR is a password-stealing backdoor Trojan which allows a remote intruder to gain access and control over the computer.

Troj/Dumaru-BR includes functionality to access the internet and communicate with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/trojdumarubr.html

Type
Trojan

Aliases
Backdoor.Win32.Agent.km BackDoor-CPX

Troj/Agent-KM is a backdoor Trojan for the Windows platform.

Troj/Agent-KM allows a remote user to use a gain access and control over the computer using a command prompt.

Troj/Agent-KM includes functionality to access the internet and communicate with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/trojagentkm.html

Type
Trojan

Aliases
Trojan-Downloader.Win32.VB.tc

Troj/Gatto-A is a downloading Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojgattoa.html

Type
Spyware Trojan

Troj/Hazif-B is a password-stealing Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojhazifb.html

Type Worm

Aliases Backdoor.Win32.PPdoor.bq

W32/PPdoor-R is a worm with backdoor functionality for the Windows platform.

http://www.sophos.com/virusinfo/analyses/w32ppdoorr.html

Type Trojan

Aliases Backdoor.Win32.WinShell.50

Troj/WinShel-A is a backdoor Trojan which allows a remote intruder to gain access and control over the computer.

http://www.sophos.com/virusinfo/analyses/trojwinshela.html

Type Trojan

Troj/DownLdr-SL is a Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojdownldrsl.html