VIRUS \ Spyware ALERTS - October 15, 2008

Aliases Win32/Antinny worm
Worm.Win32.Antinny.ai
virus
W32/Antinny.BH

Category Viruses and Spyware

Type Worm

W32/Antinny-BH is a worm for the Windows platform.

When first run W32/Antinny-BH copies itself to:

<Program Files>\Messenger\spoolsv.exe
<Program Files>\bearshare\bearshare965.exe

The following registry entries are created to run W32/Antinny-BH on startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
spoolsv
<Program Files>\Messenger\spoolsv.exe" /start

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
ara-key
<Program Files>\bearshare\bearshare965.exe" /startup

http://www.sophos.com/security/analyses/viruses-and-spyware/w32antinnybh.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Troj/Zlob-APH is a Trojan for the Windows platform.

Troj/Zlob-APH includes functionality to access the internet and communicate with a remote server via HTTP.

Registry entries are created under:

HKCU\Software\Applications
HKCR\multimediaControls.chl\CLSID

http://www.sophos.com/security/analyses/viruses-and-spyware/trojzlobaph.html?_log_from=rss

Aliases WORM_SPYBOT.BQZ
Trojan-Downloader.Win32.Small.aexy

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojsmallemm.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojiframebf.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojfakeaver.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojdownldaa.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojdloadrbvu.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

When Troj/CHMDrop-C is run, it drops the following files:

- <Windows>\Downloaded Program Files\svchost.exe
- <Temporary internet files>\svchost.exe
- <Application data>\Adobe\reader_sl.exe

All the above files are detected as Troj/CHMDrop-C.

The following registry entry is created:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\
Adobe Reader Speed Launcher
<path to executable>\reader_sl.exe


http://www.sophos.com/security/analyses/viruses-and-spyware/trojchmdropc.html?_log_from=rss

Aliases Trojan.Java.ClassLoader.ap
JAVA_BYTEVER.BQ
TROJ_JAVA.AT
Exploit:Java/ByteVerify.E

Category Viruses and Spyware

Type Trojan

Troj/ByteV-B is a Trojan for the Windows platform.

Troj/ByteV-B may drop files during execution that are detected as Troj/ByteV-AC and Troj/ByteV-AD.

http://www.sophos.com/security/analyses/viruses-and-spyware/trojbytevb.html?_log_from=rss

Aliases PWS:Win32/Yahoopass.H

Category Viruses and Spyware

Type Trojan

Troj/Agent-HXQ is a Trojan for the Windows platform.

When Troj/Agent-HXQ is installed the following files are created:

<System>\googlejd.dll
<System>\sys.dat

Both these files are also detected as Troj/Agent-HXQ. The file googlejd.dll is registered as a COM object and Browser Helper Object (BHO) for Microsoft Internet Explorer, creating registry entries under:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2DA58FB5-AADE-4E31-8E63-BCB33D59E8E2}
HKCR\CLSID\{2DA58FB5-AADE-4E31-8E63-BCB33D59E8E2}

Troj/Agent-HXQ changes settings for Microsoft Internet Explorer by modifying values under:

HKCU\Software\Microsoft\Internet Explorer\Main\

http://www.sophos.com/security/analyses/viruses-and-spyware/trojagenthxq.html?_log_from=rss

Category Adware or PUA

Type Adware

Alot Toolbar Installer is an installer for Alot Toolbar.

http://www.sophos.com/security/analyses/adware-and-puas/alottoolbarinsta_iZs9N50s.html?_log_from=rss

Category Suspicious behavior and files

Type Suspicious behavior

What's been detected Sus/Sality-A exhibits characteristics commonly, but not exclusively, found in malware.

Sus/Sality-A is a file that displays characteristics or behavior typically associated with malware.

Sus/Sality-A is a file that may have been infected by W32/Sality-AM.

Please send a sample to Sophos support to assist in improving our technology.

http://www.sophos.com/security/analyses/suspicious-behavior-and-files/sussalitya.html?_log_from=rss

Category Suspicious behavior and files

Type Suspicious behavior

What's been detected Sus/ObfJS-BD exhibits characteristics commonly, but not exclusively, found in malware.

Sus/ObfJS-BD is an obfuscated JavaScript within a web page that is likely to exploit vulnerabilities in the browser.

http://www.sophos.com/security/analyses/suspicious-behavior-and-files/susobfjsbd.html?_log_from=rss

Alert ID : FrSIRT/ALRT-2008-06105
Aliases : N/A
Size : 40960 bytes
Rated as : Low Risk
Release Date : 2008-10-15


Description

This worm drops copies of itself in all removable drives. It drops an AUTORUN.INF file to automatically execute dropped copies when the drives are accessed.

References

http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_AUTORUN.CTO

Credits

Reported by Trend Micro

Alert ID : FrSIRT/ALRT-2008-06106
Aliases : N/A
Size : 184832 bytes
Rated as : Low Risk
Release Date : 2008-10-15


Description

This worm drops copies of itself in all removable drives. It drops an AUTORUN.INF file to automatically execute dropped copies when the drives are accessed.

References

http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=TROJ_RENOS.AMC

Credits

Reported by Trend Micro

Alert ID : FrSIRT/ALRT-2008-06107
Aliases : N/A
Size : 8704 bytes
Rated as : Low Risk
Release Date : 2008-10-15


Description

This Trojan may be dropped by other malware. It may arrive bundled with malware packages as a malware component.

References

http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=TROJ_ROOTKIT.BI

Credits

Reported by Trend Micro

Alert ID : FrSIRT/ALRT-2008-06064
Aliases : N/A
Size : 274380 bytes
Rated as : Low Risk
Release Date : 2008-10-15


Description

This type of worm is embedded in an e-mail attachment, and spreads using the infected computer's e-mailing networks.

References

http://www.f-secure.com/v-descs/email-worm_vbs_gedza_b.shtml

Credits

Reported by F-Secure

Alert ID : FrSIRT/ALRT-2008-06094
Aliases : TROJ_DELREG.Y - TR/Vundo.Gen
Size : N/A
Rated as : Low Risk
Release Date : 2008-10-15


Description

Troj/DelReg-D is a a Trojan for the Windows platform that attempts to delete the following registry entry: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows AppInit_DLLs.

References

http://www.sophos.com/security/analyses/viruses-and-spyware/trojdelregd.html

Credits

Reported by Sophos

Alert ID : FrSIRT/ALRT-2008-06093
Aliases : AdClicker-GO.dll
Size : N/A
Rated as : Low Risk
Release Date : 2008-10-15


Description

Troj/Clckr-LH is a Trojan for the Windows platform. Troj/Clckr-LH includes functionality to access the internet and communicate with a remote server via HTTP.

References

http://www.sophos.com/security/analyses/viruses-and-spyware/trojclckrlh.html

Credits

Reported by Sophos

Alert ID : FrSIRT/ALRT-2008-06092
Aliases : Trojan.Win32.Agent.aguj
Size : N/A
Rated as : Low Risk
Release Date : 2008-10-15


Description

Troj/BHO-HI is a Trojan for the Windows platform. The Troj/BHO-HI is registered as a COM object and Browser Helper Object (BHO) for Microsoft Internet Explorer, creating registry entries under: HKCR\CLSID\{500BCA15-57A7-4eaf-8143-8C619470B13D} HKCR\TypeLib\{9233C3C0-1472-4091-A505-5580A23BB4AC} HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{500BCA15-57A7-4eaf-8143-8C619470B13D} Registry entries are set as follows: HKCR\XML.XML.1\CLSID (default) {500BCA15-57A7-4eaf-8143-8C619470B13D} HKCR\XML.XML\CLSID (default) {500BCA15-57A7-4eaf-8143-8C619470B13D} Registry entries are created under: HKCR\XML.XML.

References

http://www.sophos.com/security/analyses/viruses-and-spyware/trojbhohi.html

Credits

Reported by Sophos