VIRUS ALERTS - October 29, 2005

Type Spyware Trojan

Aliases
* Trojan-Spy.Win32.Banker.add
* PWS-Banker.gen.bb
* PWSteal.Banpaes

Troj/Bancban-GY is a password-stealing Trojan that attempts to steal information related to certain banks.

Troj/Bancban-GY may display fake login screens when certain banking websites are visited, in order to trick the user into entering confidential details. Stolen information is sent by email to a remote user.

http://www.sophos.com/virusinfo/analyses/trojbancbangy.html

Type Virus

Aliases

* W97M.Nometz.B

WM97/Nometz-B is a macro virus for Microsoft Word.

http://www.sophos.com/virusinfo/analyses/wm97nometzb.html

Type Spyware Worm

W32/Rbot-AWA is a network worm with backdoor Trojan functionality for the Windows platform.

W32/Rbot-AWA spreads using a variety of techniques including:
-exploiting weak passwords on computers and SQL servers
-exploiting operating system vulnerabilities such as LSASS (MS04-011), RPC-DCOM (MS04-012), WKS (MS03-049) (CAN-2003-0812), Veritas (CAN-2004-1172), MSSQL (MS02-039) (CAN-2002-0649),PNP (MS05-039), ASN.1 (MS04-007)
-using backdoors opened by other worms or Trojans.

W32/Rbot-AWA can be controlled by a remote attacker over IRC channels. The backdoor component of W32/Rbot-AWA can be instructed by a remote user to perform various functions.

http://www.sophos.com/virusinfo/analyses/w32rbotawa.html

Type Trojan

Aliases

* Trojan-Downloader.JS.Psyme.ak
* VBS/Psyme
* CHM_PSYME.AK

Troj/Psyme-CN is a downloader Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojpsymecn.html

Type Trojan

Aliases

* Trojan-Dropper.VBS.Inor.cz

Troj/Inor-W is a dropper Trojan written in VB Script.

http://www.sophos.com/virusinfo/analyses/trojinorw.html

Type Trojan

Troj/HacDef-Z is a Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojhacdefz.html