VIRUS \ Spyware ALERTS - October 17, 2008

Alert ID : FrSIRT/ALRT-2008-06181
Aliases : N/A
Size : 37376 bytes
Rated as : Low Risk
Release Date : 2008-10-17


Description

This worm may be downloaded from remote sites by other malware. It may be dropped by other malware. It may be downloaded unknowingly by a user when visiting malicious Web sites.

References

http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_OTORUN.AM

Credits

Reported by Trend Micro

Alert ID : FrSIRT/ALRT-2008-06182
Aliases : N/A
Size : Varies
Rated as : Low Risk
Release Date : 2008-10-17


Description

This Trojan may be dropped by other malware. It may arrive bundled with malware packages as a malware component. It creates registry entries to enable its automatic execution at every system startup. It also creates registry key(s)/entry(ies) as part of its installation routine. It requires a file to be installed on the system in order for it to execute its routines.

References

http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=TROJ_AGENT.BRQ

Credits

Reported by Trend Micro

Alert ID : FrSIRT/ALRT-2008-06183
Aliases : Trojan-PSW.Win32.OnLineGames.zwl (Kaspersky) - Packed.Generic.61 (Symantec) - TR/Crypt.XPACK.Gen (Avira) - Mal/EncPk-DH (Sophos)
Size : 102499 bytes
Rated as : Low Risk
Release Date : 2008-10-17


Description

This worm may be downloaded from remote sites by other malware. It may be dropped by other malware. It may be downloaded unknowingly by a user when visiting malicious Web sites.

References

http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_AUTORUN.ASL

Credits

Reported by Trend Micro

Virus Alerts [Panda Security's weekly report on viruses and intruders - 10/17/0

- Panda Security's weekly report on viruses and intruders -

Virus Alerts, by Panda Security (http://www.pandasecurity.com)

The Banbra.GBQ banker Trojan, the APop.A malicious Java Script and the Spammer.AJR Trojan are the focus of this week?s PandaLabs report.

Banbra.GBQ is designed to obtain bank information from the user. This malicious code is distributed through email. To fools users, the executable file passes itself off as a Word document, and when run it opens a document in Portuguese in which users are asked to appear in the regional electoral committee (see image: http://www.flickr.com/photos/panda_security/2947407316).

The idea is to distract users while the Trojan is infecting their computers.

APop.A is a Java Script file that opens a series of Internet Explorer windows when run. One of these opens a page which claims to offer downloads of eMule, the well-known P2P file-sharing application.

Both the Web page and the program are very similar to the originals, however, if users read the installation license carefully, they will see a text warning that the Navipromo adware will also be installed on their computer.

The Spammer.AJR Trojan is designed to send spam from infected computers. These emails have interesting sounding subjects and include a link to a fake YouTube page (see image: http://www.flickr.com/photos/panda_security/2946552395/). If users visit the page, a fake antivirus program will be installed on their system.

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojagenthyc.html?_log_from=rss

Aliases Downloader-BKK trojan

Category Viruses and Spyware

Type Trojan

Troj/FakeAV-EW is a Trojan for the Windows platform.

When Troj/FakeAV-EW is installed the following files are created:

<Current Folder>\delself.bat
<System>\brastk.exe
<System>\dllcache\beep.sys
<System>\dllcache\figaro.sys

The files beep.sys and figaro.sys are detected as Mal/FakeAle-C.

http://www.sophos.com/security/analyses/viruses-and-spyware/trojfakeavew.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojemoldb.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Troj/Dloadr-BVZ is a Trojan for the Windows platform.

Troj/Dloadr-BVZ includes functionality to access the internet and communicate with a remote server via HTTP.

When Troj/Dloadr-BVZ is installed it creates the file <Temp>\a..bat.

http://www.sophos.com/security/analyses/viruses-and-spyware/trojdloadrbvz.html?_log_from=rss

Aliases trojan

Category Viruses and Spyware

Type Trojan

Troj/BHO-HK is a Trojan for the Windows platform.

When Troj/BHO-HK is installed the following files are created:

<System>\hl.dat
<System>\mp7arc.dat
<System>\mrcmgr.exe
<System>\mshpc.dll
<System>\scerpt.dll

The file mshpc.dll is registered as a COM object and Browser Helper Object (BHO) for Microsoft Internet Explorer, creating registry entries under:

HKCR\CLSID\{161B953B-95F9-4af3-B071-D5FF5EA132EF}
HKCR\Interface\{30989926-2D37-4561-B76F-65D0F89A3560}
HKCR\Interface\{ECEE577A-5B6F-4BDC-9210-DB603D6BEF78}
HKCR\TypeLib\{2D51E439-3AE8-4BF7-8FB2-45F768554DEC}
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{161B953B-95F9-4af3-B071-D5FF5EA132EF}

http://www.sophos.com/security/analyses/viruses-and-spyware/trojbhohk.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojbckdoora.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojagenthye.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojagenthyd.html?_log_from=rss

Aliases TROJ_FAKEALRT.DG
Trojan.Win32.Agent.agwm
trojan

Category Viruses and Spyware

Type Trojan

Troj/Agent-HYB is a Trojan for the Windows platform.

When Troj/Agent-HYB is installed it creates the file <Temp>\1.tmp.bat.

http://www.sophos.com/security/analyses/viruses-and-spyware/trojagenthyb.html?_log_from=rss

Aliases TROJ_AGENT.ATJH

Category Viruses and Spyware

Type Trojan

Troj/Agent-HYA is a Trojan for the Windows platform.

Troj/Agent-HYA may install a new version of the file <System>\msxml71.dll.

Registry entries are created under:

HKCR\XML.XML

http://www.sophos.com/security/analyses/viruses-and-spyware/trojagenthya.html?_log_from=rss

Category Viruses and Spyware

Type Malicious Behavior

Mal/Pushdo-C is a family of Trojans for the Windows platform.

Members of Mal/Pushdo-C typically attempt to drop files and to load other files directly into memory that are detected as Troj/Pushu-Gen.

http://www.sophos.com/security/analyses/viruses-and-spyware/malpushdoc.html?_log_from=rss

First detected in 2007, the WORM_VOTERAI family, which turned up during the presidential election season in Kenya that year, seems to be making a comeback in time for the US elections this year via WORM_VOTERAI.N. This worm, notable for dropping the following incomplete image file of Raila Odinga, has registered several infection counts in North America:

More:http://blog.trendmicro.com/

Category Viruses and Spyware

Type Virus

W32/Acespade-A is a shortcut file overwriting virus.

W32/Acespade-A searches for files in the same folder with an LNK extension and replaces them with the file "[ ace of spades ].lnk", usually a copy of itself.

http://www.sophos.com/security/analyses/viruses-and-spyware/w32acespadea.html?_log_from=rss

Aliases Trojan-GameThief.Win32.OnLineGames.jtz
TR/ATRAPS.Gen
PWS:Win32/Gamania.gen!B

Category Viruses and Spyware

Type Trojan

Troj/Bancban-RA is a Trojan for the Windows platform.

When Troj/Bancban-RA is installed the following files are created:

<Program Files>\winrar\14m.exe - detected as Troj/Lineag-CU
<Program Files>\winrar\14m.txt - garbage data file
<Program Files>\winrar\2.bat - clean text file
<Windows>\help\F3C74E3FA248.dll - detected as Troj/Lineag-CU
<Windows>\help\F3C74E3FA248.exe - detected as Troj/Lineag-CU

The file F3C74E3FA248.dll is registered as a COM object and shell extension, creating registry entries under:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\
{1DBD6574-D6D0-4782-94C3-69619E719765}

HKCR\CLSID\{1DBD6574-D6D0-4782-94C3-69619E719765}

Registry entries are created under:

HKCU\Software\WinRAR SFX


http://www.sophos.com/security/analyses/viruses-and-spyware/trojbancbanra.html?_log_from=rss