VIRUS \ Spyware ALERTS - October 20, 2008

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojdloadrbwh.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojagenthyq.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojagenthyp.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojpdfexy.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojpdfexx.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojfakeavex.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojfakealeip.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Window

http://www.sophos.com/security/analyses/viruses-and-spyware/trojdloadrbwj.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojagenthyv.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojagenthyu.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojagenthyt.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojagenthys.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Troj/Agent-HYR is a driver containing technology used by rootkits to hide malicious files and other operating system objects used by malware.

http://www.sophos.com/security/analyses/viruses-and-spyware/trojagenthyr.html?_log_from=rss

Name : Trojan-Downloader:W32/Renos.GEN
Type: Trojan-Downloader
Category: Malware

Summary
This type of trojan secretly downloads malicious files from a remote server, then installs and executes the files.

Additional Details
This trojan downloads rogueware, which attempts to persuade the user to buy a particular rogue antispyware application by pretending that the system is infected with spyware.

http://www.f-secure.com/v-descs/trojan-downloader_w32_renos_gen.shtml

Name : Trojan-Downloader:W32/FakeAlert.BG
Detection Names : Backdoor.Win32.UltimateDefender.tt

Type: Trojan-Downloader
Category: Malware

Summary
This type of trojan secretly downloads malicious files from a remote server, then installs and executes the files.

http://www.f-secure.com/v-descs/trojan-downloader_w32_fakealert_bg.shtml

Type: Trojan

Infostealer.Bancos.AC is a Trojan horse that steals information from the compromised computer.

http://www.symantec.com/business/security_response/writeup.jsp?docid=2008-102004-0042-99

Discovered: October 20, 2008
Updated: October 20, 2008 12:01:25 PM
Type: Worm

W32.Harakit is a worm that spreads by copying itself to network shares and removable drives. It may also spread through instant messaging applications.

Symantec Security Response is currently investigating this threat and will post more information as it becomes available.

http://www.symantec.com/business/security_response/writeup.jsp?docid=2008-102011-5014-99

Category Viruses and Spyware

Type Worm

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/w32autorunmg.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojbifrosewl.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojagenthyy.html?_log_from=rss

Category Viruses and Spyware

Type Trojan


Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojagenthyx.html?_log_from=rss

October 20, 1008

Planning your fall holiday? Be careful when booking flights online or opening emails about your ?online flight ticket??or you could crash-land on a heap of malware trouble.

TrendLabs researchers caught spammed email messages featuring bogus eTickets supposedly from Continental Airlines, the fourth-largest airline in the U.S. The message thanks the recipient for availing of a new service called ?Buy flight ticket Online? and provides account details (even a password). Then it makes the recipient simply print out the attached ?purchase invoice and plane ticket? before they use these, and they?re off! How convenient!

Here?s a screenshot:

More: http://blog.trendmicro.com/

There?s another wave of malware-bearing spam. This time, the spam claims that ?new clauses? have been added to the legislation regulating your online activities.

More: http://blog.trendmicro.com/

Alert ID : FrSIRT/ALRT-2008-06243
Aliases : N/A
Size : 553348 bytes
Rated as : Low Risk
Release Date : 2008-10-20


Description

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious Web sites. Upon execution, it drops a copy of itself in the system. It modifies the system registry to enable its automatic execution at every system startup. It tracks the Web browsing activities on the affected system, specifically monitoring the title and address bars. It displays a spoofed login page if a user visits certain legitimate banking sites. This routine tricks the user into giving sensitive account-related information. This Trojan logs keystrokes entered by the user in the user name and password fields of the spoofed login page.

References

http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=TROJ_BANKER.FPF

Credits

Reported by Trend Micro

Alert ID : FrSIRT/ALRT-2008-06244
Aliases : N/A
Size : 150854 bytes
Rated as : Low Risk
Release Date : 2008-10-20


Description

This Trojan arrives on a system as a file dropped by other Trojan or as a file downloaded unknowingly by users when visiting malicious sites.

References

http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=TROJ_QHOST.YC

Credits

Reported by Trend Micro

Alert ID : FrSIRT/ALRT-2008-06245
Aliases : N/A
Size : 387848 bytes
Rated as : Low Risk
Release Date : 2008-10-20


Description

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

References

http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=TROJ_BANLOAD.EXQ

Credits

Reported by Trend Micro

Alert ID : FrSIRT/ALRT-2008-06246
Aliases : N/A
Size : 44032 bytes
Rated as : Low Risk
Release Date : 2008-10-20


Description

This Trojan arrives as a file downloaded from a remote URL.

References

http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=TROJ_ZBOT.AJC

Credits

Reported by Trend Micro

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojgidaa.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojdwnldrhjk.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojdropbc.html?_log_from=rss