VIRUS \ Spyware ALERTS - December 30, 2008

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojmdropbuy.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Troj/AdClick-FH is a Trojan for the Windows platform.

Troj/AdClick-FH copies itself to the system folder as prunnet.exe and adds registry entries under
HKLM\Software\Microsoft\CurrentVersion\Run\prunnet
HKCU\Software\Microsoft\CurrentVersion\Run\prunnet
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\prunnet

http://www.sophos.com/security/analyses/viruses-and-spyware/trojadclickfh.html?_log_from=rss

Category Adware or PUA

Type Unspecified PUA

PlayMp3 is a potentially unwanted application that attempts to perform downloads.

http://www.sophos.com/security/analyses/adware-and-puas/playmp3.html?_log_from=rss

Category Adware or PUA

Type Adware

Hotbar is advertising supported software from www.hotbar.com, www.wowpapers.com and www.easyscreensavers.com.

Hotbar consists of plugins for Microsoft Internet Explorer and Microsoft Outlook or Outlook Express.

When the browser is active Hotbar delivers advertisements (specific to the sites visited) in the form of links and popup ads.

Advertising links are added to outgoing email messages.

Hotbar may download and install updates of its software at any time without notification that it is doing so.

When Hotbar is installed the following files and folders are typically created:

http://www.sophos.com/security/analyses/adware-and-puas/hotbar.html?_log_from=rss

Discovered: December 29, 2008
Updated: December 29, 2008 6:32:29 PM
Type: Trojan

Trojan.Downexec.C!inf is a detection for files infected by Trojan.Downexec.C.


http://www.symantec.com/business/security_response/writeup.jsp?docid=2008-122918-1446-99

Type Virus SubType Internet Worm

Characteristics -

System Changes

These are general defaults for typical path variables. (Although they may differ, these examples are common.):
%WinDir% = \WINDOWS (Windows 9x/ME/XP/Vista), \WINNT (Windows NT/2000)
%SystemDir% = \WINDOWS\SYSTEM (Windows 98/ME), \WINDOWS\SYSTEM32 (Windows XP/Vista), \WINNT\SYSTEM32 (Windows NT/2000)
%ProgramFiles% = \Program Files

The following exploits may be used for this worms spread:

http://vil.mcafeesecurity.com/vil/content/v_153691.htm

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojmdropbvn.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojmdropbvb.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojdocdropf.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojdloadrcds.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojdloades.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojbckdrqqu.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojbckdrqqt.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojagentimn.html?_log_from=rss

Category Viruses and Spyware

Type Trojan


Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojagentimm.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojagentiml.html?_log_from=rss

Category Adware or PUA

Type Adware

Affected operating systems Windows
Characteristics Installs itself in the registry
Monitors browser activity

http://www.sophos.com/security/analyses/adware-and-puas/superjuan.html?_log_from=rss

Discovered: December 30, 2008
Updated: December 30, 2008 2:48:09 PM
Type: Trojan, Virus

Trojan.Downexec.C is a Trojan horse that may download files and steal information from the compromised computer.

http://www.symantec.com/business/security_response/writeup.jsp?docid=2008-123013-0635-99

Name : Email-Worm:W32/Waledac.A
Aliases : Trojan:W32/Waledac.A (Microsoft)

Size: 387072
Type: Email-Worm
Category: Malware
Platform: W32

Summary
This type of worm is embedded in an e-mail attachment, and spreads using the infected computer's e-mailing networks.

http://www.f-secure.com/v-descs/email-worm_w32_waledac_a.shtml

Category Viruses and Spyware

Type Worm

W32/SdBot-DKH is a worm for the Windows platform.

When first run W32/SdBot-DKH copies itself to <System>\msddll.exe.

The file msddll.exe is registered as a new system driver service named "msddll", with a display name of "msddll" and a startup type of automatic, so that it is started automatically during system startup. Registry entries are created under:

HKLM\SYSTEM\CurrentControlSet\Services\msddll

The following registry entry is set:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions
GON
<pathname of the Trojan executable>

W32/SdBot-DKH may attempt to spread over weakly protected network shares and via exploiting MS04-011.

http://www.sophos.com/security/analyses/viruses-and-spyware/w32sdbotdkh.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojfakevirix.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojdloadrcdt.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojagentimc.html?_log_from=rss

Discovered: December 30, 2008
Updated: December 30, 2008 3:59:21 PM
Type: Worm

Symantec Security Response is currently investigating this threat and will post more information as it becomes available.

http://www.symantec.com/business/security_response/writeup.jsp?docid=2008-123015-3826-99

Name : Exploit:SymbOS/SMSCurse.A
Detection Names : Exploit:SymbOS/SMSCurse.A

Type: Exploit
Category: Malware
Platform: SymbOS

Summary
Exploit:/SymbOS/SMSCurse.A is a Denial-of-Service (DoS) exploit that affects messaging components of phones that use Symbian Series 60 versions 2.6, 2.8, 3.0, 3.1, and Sony Ericsson UiQ devices.

When the exploit crashes SMS messaging on a phone, the phone remains otherwise completely functional. The only effect is that it cannot receive any new SMS/MMS messages.

http://www.f-secure.com/v-descs/exploit_symbos_smscurse_a.shtml

Category Viruses and Spyware

Type Worm

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/w32confickc.html?_log_from=rss

Category Viruses and Spyware

Type Trojan


Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojagentimp.html?_log_from=rss