VIRUS \ Spyware ALERTS - November 6, 2008

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojfakeavft.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojdloadrbyn.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojdloadrbym.html?_log_from=rss

Aliases Win32/Agent.CQ

Category Viruses and Spyware

Type Trojan

Troj/Agent-IDR is a Trojan for the Windows platform.

When first run, Troj/Agent-IDR copies itself to:
<Program Files>\Bifrost\Server.exe

and creates the following registry entries:
HKLM\Software\Microsoft\Active Setup\Installed Components\{9b71D88C-C598-4935-C5D1-43AA4DB90836}\stubpath
<Program Files>\Bifrost\Server.exe s

HKLM\Software\Bifrost

http://www.sophos.com/security/analyses/viruses-and-spyware/trojagentidr.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojdloadrbyo.html?_log_from=rss

Category Adware or PUA

Type Unspecified PUA

Affected operating systems Windows

http://www.sophos.com/security/analyses/adware-and-puas/mycentriainstall_ob2fZkB6.html?_log_from=rss

Category Adware or PUA

Type Unspecified PUA

Affected operating systems Windows

http://www.sophos.com/security/analyses/adware-and-puas/mycentria.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojagentidt.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojagentids.html?_log_from=rss

Category Viruses and Spyware

Type Malicious Behavior

Mal/FakeAV-L is a program which exhibits characteristics unique to malware which pretend to be Anti-Virus programs that display fake threat alerts on the user's computer.

http://www.sophos.com/security/analyses/viruses-and-spyware/malfakeavl.html?_log_from=rss

Aliases Trojan-Downloader.Win32.Agent.anuq
Win32/TrojanDownloader.Agent.OLF

Category Viruses and Spyware

Type Worm

W32/Agent-IDV is a worm for the Windows platform.

W32/Agent-IDV spreads by copying itself to network shares protected by weak passwords.

http://www.sophos.com/security/analyses/viruses-and-spyware/w32agentidv.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Troj/JSRedir-C is a malicious script embedded within a web page that attempts to redirect the user to a remote site.

http://www.sophos.com/security/analyses/viruses-and-spyware/trojjsredirc.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Troj/JSRedir-B is a script embedded within web pages that redirects the user to another malicious web page.

http://www.sophos.com/security/analyses/viruses-and-spyware/trojjsredirb.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojdloadrbjq.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Troj/Dload-EG is a Trojan for the Windows platform.

Troj/Dload-EG includes functionality to access the internet and communicate with a remote server via HTTP.

When first run Troj/Dload-EG copies itself to <User>\Application Data\Microsoft\Windows\lsass.exe and creates the following files:

<User>\Application Data\Microsoft\Network\Downloader\qmgr0.dat
<User>\Application Data\Microsoft\Network\Downloader\qmgr1.dat

The DAT files are harmless and may be deleted.

The following registry entry is created to run lsass.exe on startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run
Lsass Service
<User>\Application Data\Microsoft\Windows\lsass.exe

Troj/Dload-EG changes settings for Microsoft Internet Explorer by modifying values under:

HKCU\Software\Microsoft\Internet Explorer\Main\

http://www.sophos.com/security/analyses/viruses-and-spyware/trojdloadeg.html?_log_from=rss

Aliases Trojan-Banker.Win32.Banker.ylj
PWS-Banker trojan

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojbancbanrb.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojagentidw.html?_log_from=rss

Aliases AdWare.Win32.MyWebSearch

Category Adware or PUA

Type Unspecified PUA


MyWebSearch is an adware application.


http://www.sophos.com/security/analyses/adware-and-puas/mywebsearch.html?_log_from=rss

Thursday, November 6, 2008

Not Windows Defender ? WinDefender.

WinDefender 2009 is a supposed update of the WinDefender 2008 rogue.

Version 2009 promises to Get rid of mailware now!

More: http://www.f-secure.com/weblog/

added November 6, 2008 at 09:26 am

US-CERT is aware of public reports of email attacks circulating that are related to the recent U.S. presidential election. The email messages appear to be coming from a seemingly legitimate source and contain a message indicating that additional news coverage of the election is available by following a link. The link directs users to a website that appears to contain a video of the president elect. The website will instruct the user to update to a new version of Adobe Flash Player in order to view the video. This update is not a legitimate Adobe Flash Player update; it is malicious code. If the user downloads this executable file, malicious code may be installed on the system.

More: http://www.us-cert.gov/current/current_activity.html#united_states_presidential_election_email

6 November 2008

After yesterday?s Barack themed malware spam attack, it was no surprise this morning to find BarackOb.exe first in the queue for analysis. President Elect Obama is definitely the hottest name in malware right now, one of the unfortunate side effects of success. With his historic victory over Senator McCain still fresh in everyone?s mind, how many people would find themselves tempted to open a file this morning bearing his name and flying the US flag?

More: http://www.sophos.com/security/blog/2008/11/1945.html

Category Viruses and Spyware

Type Trojan

Troj/FakeAV-GB is fraudulent anti-spyware software.


http://www.sophos.com/security/analyses/viruses-and-spyware/trojfakeavgb.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojdwnldrhkc.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojagentidx.html?_log_from=rss

Category Viruses and Spyware

Type Malicious Behavior

Mal/FakeAV-L is a program which exhibits characteristics unique to malware which pretend to be Anti-Virus programs that display fake threat alerts on the user's computer.

http://www.sophos.com/security/analyses/viruses-and-spyware/malfakeavl.html?_log_from=rss

Alert ID : FrSIRT/ALRT-2008-06787
Aliases : N/A
Size : N/A
Rated as : Low Risk
Release Date : 2008-11-06


Description

This is a Trojan detection. Unlike viruses, Trojans do not self-replicate. They are spread manually, often under the premise that they are beneficial or wanted.

References

http://vil.nai.com/vil/content/v_153291.htm

Credits

Reported by McAfee

Alert ID : FrSIRT/ALRT-2008-06788
Aliases : N/A
Size : N/A
Rated as : Low Risk
Release Date : 2008-11-06


Description

This is a Trojan detection. Unlike viruses, Trojans do not self-replicate. They are spread manually, often under the premise that they are beneficial or wanted.

References

http://vil.nai.com/vil/content/v_153289.htm

Credits

Reported by McAfee

Alert ID : FrSIRT/ALRT-2008-06789
Aliases : N/A
Size : N/A
Rated as : Low Risk
Release Date : 2008-11-06


Description

This is a Trojan detection. Unlike viruses, Trojans do not self-replicate. They are spread manually, often under the premise that they are beneficial or wanted.

References

http://vil.nai.com/vil/content/v_153287.htm

Credits

Reported by McAfee

Alert ID : FrSIRT/ALRT-2008-06790
Aliases : N/A
Size : N/A
Rated as : Low Risk
Release Date : 2008-11-06


Description

This is a Trojan detection. Unlike viruses, Trojans do not self-replicate. They are spread manually, often under the premise that they are beneficial or wanted.

References

http://vil.nai.com/vil/content/v_153285.htm

Credits

Reported by McAfee

Alert ID : FrSIRT/ALRT-2008-06791
Aliases : N/A
Size : N/A
Rated as : Low Risk
Release Date : 2008-11-06


Description

Characteristics File Property Property Value FileName new11e~1.exe McAfee Detection PWS-Mmorpg.gen Length 22,219 bytes CRC 02214058 MD5 EC47FE94C168389A0DDF0CE4959EC3E2, SHA1 5971FC68D95392AB9294D7D6D32494DC0E0B1343,.

References

http://vil.nai.com/vil/content/v_153284.htm

Credits

Reported by McAfee