VIRUS \ Spyware ALERTS - October 15, 2008

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojbckdrqpw.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojagenthxj.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Troj/PSW-FV is a Trojan for the Windows platform.

http://www.sophos.com/security/analyses/viruses-and-spyware/trojpswfv.html?_log_from=rss

Aliases DR/Delphi.Gen
VirTool:Win32/DelfInject.gen!AM

Category Viruses and Spyware

Type Trojan

Troj/Merein-Gen is a Trojan for the Windows platform.


http://www.sophos.com/security/analyses/viruses-and-spyware/trojmereingen.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojmdropbwh.html?_log_from=rss

Category Viruses and Spyware

Type Worm

W32/AutoRun-LT is a worm for the Windows platform.

When run W32/AutoRun-LT copies itself to <System>\vistaupgrade.exe and sets the following registry entry:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
VistaUpgrade
<System>\vistaupgrade.exe

W32/AutoRun-LT spreads via removable shared drives by copying itself to <Root&gt<worm executable>.exe and creating the file <Root>\autorun.inf (detected as W32/Autorun-KQ).

http://www.sophos.com/security/analyses/viruses-and-spyware/w32autorunlt.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Troj/Agent-HXM is a Trojan for the Windows platform.

http://www.sophos.com/security/analyses/viruses-and-spyware/trojagenthxm.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojagenthxl.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Troj/Agent-HXK is a Trojan for the Windows platform.

When run Troj/Agent-HXK creates the file <Current Folder>\1.exe - detected as Troj/PWS-AUJ.

http://www.sophos.com/security/analyses/viruses-and-spyware/trojagenthxk.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/jsdloaddy.html?_log_from=rss

Category Viruses and Spyware

Type Worm

W32/AutoRun-LU is a worm for the Windows platform.

W32/AutoRun-LU spreads via removable shared drives by copying itself to <Root>\Resycled\boot.com and creating the file <Root>\autorun.inf (detected as W32/Autorun-KO).


http://www.sophos.com/security/analyses/viruses-and-spyware/w32autorunlu.html?_log_from=rss

Aliases HTML/Rce.Gen
Exploit:JS/Mult.AC

Category Viruses and Spyware

Type Trojan

Troj/Psyme-KG is a malicious script embedded in web pages that attempts to exploit browser vulnerabilities in order to download and run other malware.

http://www.sophos.com/security/analyses/viruses-and-spyware/trojpsymekg.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojpdfexu.html?_log_from=rss

Aliases Downloader-BKK trojan

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojagenthxo.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojagenthxn.html?_log_from=rss

Name : Net-Worm:W32/Koobface.BM
Detection Names : Net-Worm.Win32.Koobface.bm

Type: Net-Worm
Category: Malware

Summary
A type of worm that replicates by sending complete, independent copies of itself over a network.

Details


Registry Modifications
Creates these keys:


HKEY_LOCAL_MACHINE\Microsoft\Windows\CurrentVersion\Run
sysftray32 = c:\windows\bolivar19.exe


http://www.f-secure.com/v-descs/net-worm_w32_koobface_bm.shtml

Also Known As: W32/Chuzy-A [Sophos]
Type: Virus

W32.Chuzy is a virus that infects executable files on the compromised computer.


http://www.symantec.com/business/security_response/writeup.jsp?docid=2008-101502-5133-99

Discovered: October 15, 2008
Updated: October 15, 2008 11:35:47 AM
Type: Trojan

Trojan.Konov.A is a Trojan horse that sends premium rate SMS messages to a predetermined number.

Symantec Security Response is currently investigating this threat and will post more information as it becomes available.

http://www.symantec.com/business/security_response/writeup.jsp?docid=2008-101511-1938-99

Category Viruses and Spyware

Type Trojan

Troj/Zlob-Gen detects members of the Zlob family of Trojan downloaders.

The Troj/Zlob-Gen family of Trojans usually attempt to stealth themselves by injecting themselves into another system process or by registering themselves as a service process.

The typical Troj/Zlob-Gen Trojan may create folders in the <System> folder and store downloaded files in these folders and set the following registry entries to run on user startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\run
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

http://www.sophos.com/security/analyses/viruses-and-spyware/trojzlobgen.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojmejdhogen.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojhupigogen.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojfarfligen.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojfakealeil.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojdwnldrgen.html?_log_from=rss

Aliases Worm.Win32.Delf.av

Category Viruses and Spyware

Type Trojan

Troj/Delf-FBG is a Trojan for the Windows platform.

When first run Troj/Delf-FBG copies itself to:

<Root>\Trik Bercinta yg Bener.exe
<System>\inet.exe

http://www.sophos.com/security/analyses/viruses-and-spyware/trojdelffbg.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojagenthxp.html?_log_from=rss

Category Viruses and Spyware

Type Malicious Behavior

Mal/ObfJS-BD is an obfuscated JavaScript within a web page that is likely to exploit vulnerabilities in the browser.

http://www.sophos.com/security/analyses/viruses-and-spyware/malobfjsbd.html?_log_from=rss

Category Viruses and Spyware

Type Exploit

Exp/MS04-028 detects Jpeg files which exploit a vulnerability in
"GDIPLUS.DLL" used for Jpeg parsing in many Windows applications.

When vulnerable applications read the Jpeg file they will crash and may
execute malicious code. A full list of vulnerable applications is available
from Microsoft MS04-028.

http://www.sophos.com/security/analyses/viruses-and-spyware/expms04028.html?_log_from=rss

October 15, 2008

In the past weeks we have blogged about the scam related to faked bank certificates for Wachovia, Bradesco and Merrill Lynch.
All those attacks attempted to play with fear regarding online security, in good combination with the international bank crisis.
Yesterday we?ve noticed that this kind of spam arrived German mailboxes ? and of course in German language.

More: http://blog.trendmicro.com/

Discovered: October 15, 2008
Updated: October 15, 2008 5:44:46 PM
Type: Trojan

Backdoor.Bifrose.M is a Trojan horse that opens a back door on the compromised computer.

http://www.symantec.com/business/security_response/writeup.jsp?docid=2008-101515-3450-99