VIRUS ALERTS - October 26, 2005

Type Spyware Trojan

Troj/Bancos-FH is an internet banking Trojan.

http://www.sophos.com/virusinfo/analyses/trojbancosfh.html

Type Trojan

Aliases
Trojan-Dropper.Win32.Agent.xc
StartPage.g

Troj/Multidr-ER is a Trojan for the Windows platform.
Troj/Multidr-ER includes functionality to access the internet and communicate
with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/trojmultidrer.html

Type Trojan

Aliases Trojan-Downloader.Win32.Banload.at

Troj/Dloader-XA is a Trojan for the Windows platform.
Troj/Dloader-XA will download, install and run new software without notification that it is doing so.
When first run Troj/Dloader-XA copies itself to <System> \smcfg32.exe.

http://www.sophos.com/virusinfo/analyses/trojdloaderxa.html

Type Trojan

Aliases HackerDefender.sys

Troj/HacDef-Y is a system driver used by backdoor Trojans in order to hide their processes, files and registry entries from detection.

http://www.sophos.com/virusinfo/analyses/trojhacdefy.html

Type Spyware Trojan

Aliases
Trojan-Spy.Win32.Banker.vr
PWS-Banker.gen.b
PWSteal.Bancos

Troj/Banker-GA is a backdoor Trojan which allows a remote intruder to gain access and control over the computer.
When run Troj/Banker-GA displays a fake banking interfaces with the aim of harvesting account details.

http://www.sophos.com/virusinfo/analyses/trojbankerga.html

Type Worm

Aliases Backdoor.Win32.Rbot.gen

W32/Rbot-ATF is a worm and IRC backdoor Trojan for the Windows platform.
W32/Rbot-ATF spreads:
- to other network computers infected with: Troj/Kuang, Troj/Sub7, Troj/NetDevil, W32/MyDoom, W32/Bagle and Troj/Optix
- to other network computers by exploiting common buffer overflow vulnerabilities, including: LSASS (MS04-011), RPC-DCOM (MS04-012), WebDav (MS03-007), IIS5SSL (MS04-011) (CAN-2003-0719), UPNP (MS01-059) and Dameware (CAN-2003-1030)
- by copying itself to network shares protected by weak passwords
W32/Rbot-ATF runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels.

http://www.sophos.com/virusinfo/analyses/w32rbotatf.html

Type Worm

W32/Spybot-DZ is a worm and IRC backdoor Trojan for the Windows platform.
W32/Spybot-DZ includes functionality to:
- terminate system related processes
- silently download, install and run new software
Sophos's anti-virus products include Genotype? detection technology, which can proactively protect against new threats without requiring an update. Sophos customers have been protected against W32/Spybot-DZ (detected as W32/Spybot-Gen) since version 3.98.

http://www.sophos.com/virusinfo/analyses/w32spybotdz.html

Type Trojan

Aliases
Trojan-Downloader.Win32.Small.bon
TROJ_DLOADER.AGJ

Troj/Small-BON is a downloader Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojsmallbon.html

Type Trojan

Aliases
Trojan-Downloader.Win32.Delf.uq
TROJ_DLOADER.AHK

Troj/QQRob-R is a downloader Trojan for the Windows platform.
Troj/QQRob-R includes functionality to access the internet and communicate with a remote server via HTTP

http://www.sophos.com/virusinfo/analyses/trojqqrobr.html

Type Spyware Trojan

Aliases
Trojan-PSW.Win32.Lmir.amn
PWS-Legmir
TSPY_LMIR.BL

Troj/LegMir-BG is a keylogger Trojan for the Windows platform.
Troj/LegMir-BG also includes functionality to download files from the internet.

http://www.sophos.com/virusinfo/analyses/trojlegmirbg.html

Type Spyware Worm

Aliases
Backdoor.Win32.Rbot.adf
WORM_RBOT.CFP

W32/Rbot-ATI is a worm and IRC backdoor Trojan for the Windows platform.
W32/Rbot-ATI spreads to other network computers by exploiting common buffer overflow
vulnerabilities, including: LSASS (MS04-011), RPC-DCOM (MS04-012), WKS (MS03-049)
(CAN-2003-0812), MSSQL (MS02-039) (CAN-2002-0649), PNP (MS05-039) and ASN.1 (MS04-007) and by copying itself to network shares protected by weak passwords.
W32/Rbot-ATI runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels.

http://www.sophos.com/virusinfo/analyses/w32rbotati.html

Type Worm

W32/Agobot-TW is a worm and backdoor Trojan for the Windows platform.
W32/Agobot-TW runs continuously in the background, providing a backdoor server
which allows a remote intruder to gain access and control over the computer.
W32/Agobot-TW spreads via common buffer overflow exploits, including LSASS (MS04-011), RPC-DCOM (MS04-012), and PNP (MS05-039), as well as to weakly protected network shares.

http://www.sophos.com/virusinfo/analyses/w32agobottw.html

Type Spyware Trojan

Aliases Trojan-Spy.Win32.Banker.aec

Troj/Banker-GB is an internet banking Trojan.

http://www.sophos.com/virusinfo/analyses/trojbankergb.html

Type Spyware Trojan

Aliases
Trojan-Spy.Win32.Banker.ahy
PWS-Banker.gen.bb
PWSteal.Banpaes

Troj/Bancban-GO is a Trojan for the Windows platform.
Troj/Bancban-GO targets the users of certain Brazilian banking websites, displaying fake interfaces with the aim of harvesting account details.
Troj/Bancban-GO includes functionality to send notification messages to remote locations.

http://www.sophos.com/virusinfo/analyses/trojbancbango.html

Type Spyware Trojan

Aliases Backdoor.Win32.MoSucker.bl

Troj/Mosuck-B is a backdoor Trojan for Windows that allows unauthorized remote access to an infected computer.
Troj/Mosuck-B can be configured to copy itself using any filename into various folders. There are also various registry entries that can be configured to run Troj/Mosuck-B on system startup.
Troj/Mosuck-B can be used by an intruder to access the file system and terminate processes.
Troj/Mosuck-B has keylogging, downloading and screen capture capabilites.

http://www.sophos.com/virusinfo/analyses/trojmosuckb.html

Type Trojan

Aliases Backdoor.Win32.Webdor.ad

Troj/Bdoor-JQ is a Trojan for the Windows platform.
Troj/Bdoor-JQ includes functionality to access the internet and communicate with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/trojbdoorjq.html

Type Trojan

Aliases
rojan-Clicker.Win32.Agent.ex
TROJ_PUPER.AL

Troj/AdClick-BB is a Trojan for the Windows platform.
Troj/AdClick-BB includes functionality to access the internet and communicate with a remote server via HTTP.
Troj/AdClick-BB displays different security alerts and warnings in an attempt to trick the user into downloading files from predefined locations.

http://www.sophos.com/virusinfo/analyses/trojadclickbb.html

Type Trojan

Aliases Trojan-Proxy.Win32.Ranky.bp

Troj/Ranck-DB is a proxy Trojan that allows a remote attacker to route internet traffic through the infected computer.

http://www.sophos.com/virusinfo/analyses/trojranckdb.html

Type Trojan

Aliases Backdoor.Win32.Lecna.g

Troj/Lecna-E is a Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojlecnae.html

Type Trojan

Aliases Backdoor.Win32.Small.hu

Troj/Dloader-WT is a Trojan for the Windows platform.
When first run Troj/Dloader-WT copies itself to <System> \grpmnt32.exe and creates the file <Temp> \0020010.bat.
Troj/Dloader-WT includes functionality to silently download, install and run new software.

http://www.sophos.com/virusinfo/analyses/trojdloaderwt.html

Type Trojan

Aliases Backdoor.Win32.Small.gv

Troj/Bdoor-JR is a backdoor and downloader Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojbdoorjr.html

Type Worm

Aliases Backdoor.Win32.Virkel.a

W32/Chode-J is a worm with IRC backdoor Trojan functionality.
W32/Chode-J attempts to spread via MSN Instant Messenger and AOL Instant Messenger, by sending users a link to a copy of the worm.
W32/Chode-J includes functionality to:
- carry out DDoS flooder attacks
- provide a proxy server
- silently download, install and run new software
- modify the HOSTS file
- disable other software, including anti-virus, firewall and security related application
- update itself
W32/Chode-J attempts to disable a number of AV and security related processes.
W32/Chode-J modifies the HOSTS file, changing the URL-to-IP mappings for selected websites.

http://www.sophos.com/virusinfo/analyses/w32chodej.html

Type Spyware Trojan

Aliases
PWS-Banker.gen.r
Trojan.Bancos-121

Troj/Bancos-FG is an internet banking Trojan for the Windows platform

http://www.sophos.com/virusinfo/analyses/trojbancosfg.html

Type Trojan

Aliases Generic

Troj/BankDl-R is a downloading Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojbankdlr.html

Type Trojan

Aliases
BackDoor-CKB
W97M_EMBED.A

Troj/Protux-D is a backdoor Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojprotuxd.html

Type Worm

W32/Rbot-ATJ is a worm and IRC backdoor Trojan for the Windows platform.
W32/Rbot-ATJ spreads:
- to other network computers by exploiting common buffer overflow vulnerabilities, including: PNP (MS05-039)
- by sending itself via AIM Instant Messenger
W32/Rbot-ATJ runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels.

http://www.sophos.com/virusinfo/analyses/w32rbotatj.html

Type Spyware Trojan

Aliases Trojan-Spy.Win32.Banker.aho

Troj/Bancban-GQ is a password stealing Trojan for the Windows platform.
Troj/Bancban-GQ targets customers of certain Brazilian online banking websites by displaying fake interfaces, and recording any details that are entered.

http://www.sophos.com/virusinfo/analyses/trojbancbangq.html

Type Trojan

Aliases Trojan-Downloader.Win32.VB.of

Troj/Dloader-XB is a Trojan for the Windows platform.
Troj/Dloader-XB includes functionality to access the internet and communicate with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/trojdloaderxb.html

Type Trojan

Aliases Trojan.Win32.Dialer.eg

Dial/Carped-H is a premium rate dialer application.

http://www.sophos.com/virusinfo/analyses/dialcarpedh.html

Type Spyware Trojan

Aliases Trojan-Spy.Win32.Banker.ahy
TSPY_BANCOS.BAZ

Troj/Bancban-GR is a banking Trojan for the Windows platform.
The Trojan steals login credentials from Internet sessions with certain banking sites. Stolen information is sent to a remote user.

http://www.sophos.com/virusinfo/analyses/trojbancbangr.html