VIRUS \ Spyware ALERTS - January 3, 2008

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojfakeavhz.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojfakealekl.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojfakealekk.html?_log_from=rss

Aliases Rootkit.Win32.Agent.fwt
Trojan:Win32/Daonol.A
Trojan:Win32/Daonol.B

Category Viruses and Spyware

Type Trojan

Troj/Daonol-Fam is a family of Trojans for the Windows platform.

Members of Troj/Daonol-Fam typically copy themselves to the Root folder and create some of the following files

<Root&gt<random filename>.bat (clean batch file)
<System>\sysaudio.sys

The file sysaudio.sys is also a member of Troj/Daonol-Fam.

A registry entry is usually set similar to the following:

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32
aux
sysaudio.sys

Troj/Daonol-Fam attempts to redirect internet traffic from a number of websites.

http://www.sophos.com/security/analyses/viruses-and-spyware/trojdaonolfam.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojbhoiz.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojpwsaxk.html?_log_from=rss

Category Viruses and Spyware

Type Worm

W32/IRCBot-AAY is a worm with IRC backdoor functionality for the Windows platform.

W32/IRCBot-AAY runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels.

When first run W32/IRCBot-AAY copies itself to <System>\msddll.exe.

The file msddll.exe is registered as a new system driver service named "msddll", with a display name of "msddll" and a startup type of automatic, so that it is started automatically during system startup. Registry entries are created under:

HKLM\SYSTEM\CurrentControlSet\Services\msddll

http://www.sophos.com/security/analyses/viruses-and-spyware/w32ircbotaay.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Troj/Renos-CG is a Trojan.

Troj/Renos-CG creates registry entries under

HKCR\videosoft

http://www.sophos.com/security/analyses/viruses-and-spyware/trojrenoscg.html?_log_from=rss

Aliases Generic Downloader.x
not-a-virus:AdWare.Win32.BHO.dtl
Win32/TrojanDownloader.FakeAlert.OG

Category Viruses and Spyware

Type Trojan

Troj/FakeAV-IA is a Trojan for the Windows platform.

The Troj/FakeAV-IA is registered as a COM object, creating registry entries under:

HKCR\CLSID\{32FD16DC-537C-4186-9BD6-C718A308342B}
HKCR\Interface\{268706F0-841C-446A-B757-8C1EF84527DC}
HKCR\TypeLib\{A0442DFA-1F7E-4DCE-B75C-A90993D6E7FC}

The following registry entry is set:

HKCR\getsn32.msiesn\Clsid
(default)
{32FD16DC-537C-4186-9BD6-C718A308342B}

Registry entries are created under:

HKCR\getsn32.msiesn

http://www.sophos.com/security/analyses/viruses-and-spyware/trojfakeavia.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojagentinb.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Troj/CryptBox-A is a Trojan for the Windows platform.

When run Troj/CryptBox-A will decrypt and inject other components stored in the resource section.

http://www.sophos.com/security/analyses/viruses-and-spyware/trojcryptboxa.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojadclikgen.html?_log_from=rss

Aliases Trojan-Downloader.Win32.Injecter.bca

Category Viruses and Spyware

Type Malicious Behavior

Mal/CryptBox-A is a malicious executable for the Windows platform.

When run Mal/CryptBox-A will decrypt and inject other components stored in the resource section.

http://www.sophos.com/security/analyses/viruses-and-spyware/malcryptboxa.html?_log_from=rss