Thank you for being a valued part of the CNET community. As of December 1, 2020, the forums are in read-only format. In early 2021, CNET Forums will no longer be available. We are grateful for the participation and advice you have provided to one another over the years.

Thanks,

CNET Support

General discussion

VIRUS \ Spyware ALERTS - October 23, 2008

by Marianna Schmudlach Oct 22, 2008 2:36PM PDT

Discussion is locked

31 - 60 of 56 Posts
- Collapse + Expand Details
- Collapse -
Troj/AutoIT-AB
by Marianna Schmudlach Oct 23, 2008 5:56AM PDT
- Collapse -
Troj/Agent-IAH
by Marianna Schmudlach Oct 23, 2008 5:57AM PDT
- Collapse -
Mal/Autorun-D
by Marianna Schmudlach Oct 23, 2008 5:58AM PDT
- Collapse -
TROJ_DLOADR.HR
by Marianna Schmudlach Oct 23, 2008 6:16AM PDT

Alert ID : FrSIRT/ALRT-2008-06372
Aliases : N/A
Size : 3320 bytes
Rated as : Low Risk
Release Date : 2008-10-23


Description

This Trojan's infection routine starts from an email message spammed by another malware or a malicious user. Clicking a link in the spammed message leads a user to download this Trojan into the system. It connects to a certain URL to download a file. The downloaded file is detected by Trend Micro as TSPY_SNIFF.KAX. It then executes the downloaded file. As a result, malicious routines of the downloaded file are exhibited on the affected system.

References

http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=TROJ_DLOADR.HR

Credits

Reported by Trend Micro

- Collapse -
TROJ_DLOADR.HD
by Marianna Schmudlach Oct 23, 2008 6:17AM PDT
- Collapse -
TROJ_FAKEAV.KX
by Marianna Schmudlach Oct 23, 2008 6:18AM PDT
- Collapse -
WORM_RUNAUTO.AF
by Marianna Schmudlach Oct 23, 2008 6:19AM PDT
- Collapse -
TROJ_ZBOT.OU
by Marianna Schmudlach Oct 23, 2008 6:21AM PDT

Alert ID : FrSIRT/ALRT-2008-06376
Aliases : N/A
Size : 50688 bytes
Rated as : Low Risk
Release Date : 2008-10-23


Description

This Trojan arrives as a file downloaded from a certain URL. Upon execution, it drops a copy of itself and its components on the system. It modifies the system registry to enable its automatic execution at every system startup. It then attempts to access a certain Web site to download its configuration file. The said file contains information on where the malware can download an updated copy of itself, and on where it can send its stolen data. This configuration file also contains a list of targeted bank-related Web sites to monitor from which it steals information.

References

http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=TROJ_ZBOT.OU

Credits

Reported by Trend Micro

- Collapse -
TROJ_VB.JBG
by Marianna Schmudlach Oct 23, 2008 6:22AM PDT

Alert ID : FrSIRT/ALRT-2008-06377
Aliases : N/A
Size : 36954 bytes
Rated as : Low Risk
Release Date : 2008-10-23


Description

This Trojan arrives as a file downloaded from a certain URL. Upon execution, it drops a copy of itself and its components on the system. It modifies the system registry to enable its automatic execution at every system startup. It then attempts to access a certain Web site to download its configuration file. The said file contains information on where the malware can download an updated copy of itself, and on where it can send its stolen data. This configuration file also contains a list of targeted bank-related Web sites to monitor from which it steals information.

References

http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=TROJ_VB.JBG

Credits

Reported by Trend Micro

- Collapse -
TROJ_ZBOT.US
by Marianna Schmudlach Oct 23, 2008 6:23AM PDT
- Collapse -
Troj/Ifgif-A
by Marianna Schmudlach Oct 23, 2008 6:24AM PDT
- Collapse -
Troj/Nettroj-B
by Marianna Schmudlach Oct 23, 2008 6:25AM PDT

Alert ID : FrSIRT/ALRT-2008-06363
Aliases : N/A
Size : N/A
Rated as : Low Risk
Release Date : 2008-10-23


Description

Troj/Nettroj-B copies itself as <UserProfile>\Temp\WinUpdter.exe Troj/Nettroj-B creates following registry entries to run itself on the startup: HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ WindowsUpdater <UserProfile>\Temp\WinUpdter.exe .

References

http://www.sophos.com/security/analyses/viruses-and-spyware/trojnettrojb.html

Credits

Reported by Sophos

- Collapse -
Troj/Bank-E
by Marianna Schmudlach Oct 23, 2008 6:27AM PDT

Alert ID : FrSIRT/ALRT-2008-06366
Aliases : Infostealer.Bancos - TrojanSpy:Win32/Banker - PWS-Banker.gen.q - TR/Spy.Banker.acn
Size : N/A
Rated as : Low Risk
Release Date : 2008-10-23


Description

Troj/Bank-E is a password stealing Trojan for the Windows platform that targets internet banking usernames and passwords.

References

http://www.sophos.com/security/analyses/viruses-and-spyware/trojbanke.html

Credits

Reported by Sophos

- Collapse -
Troj/Bank-F
by Marianna Schmudlach Oct 23, 2008 6:27AM PDT

Alert ID : FrSIRT/ALRT-2008-06367
Aliases : Trojan-Banker.Win32.Banker.oi - TrojanSpy:Win32/Banker - Infostealer.Bancos - Infostealer.Banpaes
Size : N/A
Rated as : Low Risk
Release Date : 2008-10-23


Description

Troj/Bank-F is a password stealing Trojan for the Windows platform that targets internet banking usernames and passwords.

References

http://www.sophos.com/security/analyses/viruses-and-spyware/trojbankf.html

Credits

Reported by Sophos

- Collapse -
W32/AutoRun-MP
by Marianna Schmudlach Oct 23, 2008 6:28AM PDT
- Collapse -
BackDoor-AWQ.b!B43EA972
by Marianna Schmudlach Oct 23, 2008 6:30AM PDT

Alert ID : FrSIRT/ALRT-2008-06322
Aliases : N/A
Size : N/A
Rated as : Low Risk
Release Date : 2008-10-23


Description

This is a Trojan detection. Unlike viruses, Trojans do not self-replicate. They are spread manually, often under the premise that they are beneficial or wanted.

References

http://vil.nai.com/vil/content/v_152886.htm

Credits

Reported by McAfee

- Collapse -
BackDoor-CEP!93331E5A
by Marianna Schmudlach Oct 23, 2008 6:30AM PDT

Alert ID : FrSIRT/ALRT-2008-06323
Aliases : N/A
Size : N/A
Rated as : Low Risk
Release Date : 2008-10-23


Description

This is a Trojan detection. Unlike viruses, Trojans do not self-replicate. They are spread manually, often under the premise that they are beneficial or wanted.

References

http://vil.nai.com/vil/content/v_152858.htm

Credits

Reported by McAfee

- Collapse -
Puper!D2601E20
by Marianna Schmudlach Oct 23, 2008 6:31AM PDT

Alert ID : FrSIRT/ALRT-2008-06325
Aliases : N/A
Size : N/A
Rated as : Low Risk
Release Date : 2008-10-23


Description

This is a Trojan detection. Unlike viruses, Trojans do not self-replicate. They are spread manually, often under the premise that they are beneficial or wanted.

References

http://vil.nai.com/vil/content/v_152842.htm

Credits

Reported by McAfee

- Collapse -
Troj/Sub7-Gen
by Marianna Schmudlach Oct 23, 2008 8:36AM PDT
- Collapse -
Troj/PWS-AVA
by Marianna Schmudlach Oct 23, 2008 8:37AM PDT
- Collapse -
Troj/Inject-DB
by Marianna Schmudlach Oct 23, 2008 8:38AM PDT
- Collapse -
Troj/FakeVir-GP
by Marianna Schmudlach Oct 23, 2008 8:39AM PDT
- Collapse -
Mal/AutoInf-A
by Marianna Schmudlach Oct 23, 2008 8:40AM PDT
- Collapse -
McAfee Avert Labs Low-Profiled Threat Notice: Spy-Agent.da
by Marianna Schmudlach Oct 23, 2008 11:38AM PDT

Notice
This is a Low-Profiled Threat Notice for Spy-Agent.da

Justification
Spy-Agent.da has been deemed a Low-Profiled threat due to it's association with a Critical Microsoft Windows vulnerability. Spy-Agent.da has been observed as a payload to active exploits of the MS08-067 vulnerability.

Read About It
Information about Spy-Agent.da is located on VIL at: http://vil.mcafeesecurity.com/vil/content/v_152898.htm
See Also: http://vil.nai.com/vil/content/v_vul40728.htm (MS08-067 vulnerability)

Detection
Spy-Agent.da was first discovered on October 23, 2008 and detection will be added to the 5414 Dat files (Release Date: October 23, 200Cool.

Though we consider this Low Profiled threat assessment, users can obtain an extra.dat for protection and cleaning via the following site:
https://www.webimmune.net/extra/getextra.aspx

If you suspect you have Spy-Agent.da, please submit a sample to <http://www.webimmune.net>

- Collapse -
Trojan-Spy:W32/Gimmiv.A
by Marianna Schmudlach Oct 23, 2008 11:56AM PDT

Name : Trojan-Spy:W32/Gimmiv.A
Type: Trojan-Spy
Category: Malware
Platform: W32

Summary
This type of trojan secretly installs spy programs and/or keylogger programs.

Registry Modifications
Creates these keys:


HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sysmgr
DisplayName = System Maintenance Service ErrorControl = 0
ImagePath = [System Folder]\svchost.exe -k sysmgr
ObjectName = LocalSystem
Start = 0x00000002(2)
type = 0x00000110(272)

http://www.f-secure.com/v-descs/trojan-spy_w32_gimmiv_a.shtml

- Collapse -
Bloodhound.Exploit.212
by Marianna Schmudlach Oct 23, 2008 11:59AM PDT
Back to Spyware, Viruses, & Security forum

CNET Forums

Operating Systems
Software
Electronics & Gadgets
Hardware
Tablets & Mobile Devices
General Help
Brand Forums
Roadshow Autos
Off Topic

Other Forums

Forum Info