VIRUS \ Spyware ALERTS - October 12, 2008

Aliases Rootkit.Win32.Protector.bd
Cutwail.gen.a trojan
Trojan.Pandex
VirTool:WinNT/Cutwail.K

Category Viruses and Spyware

Type Trojan

Troj/Pushdo-Y is a rootkit Trojan for the Windows platform.

Troj/Pushdo-Y is installed by other malware (typically downloader Trojans) to provide stealthing.

Troj/Pushdo-Y will typically be installed to:

<System>\drivers\<variable>.sys

and the file <variable>.sys registered as a new system driver service named <variable> (the filename of the SYS driver minus its extension).

http://www.sophos.com/security/analyses/viruses-and-spyware/trojpushdoy.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojfakevirgj.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Troj/Dloadr-BVM is a downloader Trojan for the Windows platform.

Troj/Dloadr-BVM typically arrives as an attatchment to a spam email message. An example message text is as follows:

Good morning, dear.
Watch my sweety *****!
Best Regards.

When first run Troj/Dloadr-BVM copies itself to:

<System>\rs32net.exe

http://www.sophos.com/security/analyses/viruses-and-spyware/trojdloadrbvm.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojdloadrbvl.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojbankerens.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojagenthwx.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojagenthww.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojagenthwv.html?_log_from=rss

Category Viruses and Spyware

Type Worm

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/w32autorunlj.html?_log_from=rss

Aliases Trojan:Win32/Helpud.A
Trojan-PSW.Win32.OnLineGames.ajlf
PWS-OnlineGames.y.dll trojan

Category Viruses and Spyware

Type Trojan

Troj/PWS-AUF is a password stealing Trojan for the Windows platform.

When Troj/PWS-AUF is installed the following files are created:

<Windows>\Help\<variable>.dll
<Windows>\Help\<variable>.exe

where <variable> is a filename consisting of upper-case letters and digits. Both files have the hidden and system attributes set.

The file <variable>.dll is registered as a COM object and shell extension, creating registry entries under:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
HKCR\CLSID\{1DBD6574-D6D0-4782-94C3-69619E719765}

http://www.sophos.com/security/analyses/viruses-and-spyware/trojpwsauf.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojmdropbwf.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojkeygencm.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

When first run, Troj/Dwnldr-HIZ silently starts a copy of Internet Explorer, and injects malicious code into this process.

The hijacked Internet Explorer then attempts to download code from the internet.

http://www.sophos.com/security/analyses/viruses-and-spyware/trojdwnldrhiz.html?_log_from=rss

Aliases Win32/Agent.OBH trojan
Generic.dx trojan

Category Viruses and Spyware

Type Trojan

Troj/Crack-O is a crack tool which can be used to patch RegCure v1.5.0.0 (a legitimate commercial application), in order to circumvent its license-protection mechanism.

http://www.sophos.com/security/analyses/viruses-and-spyware/trojcracko.html?_log_from=rss