VIRUS \ Spyware ALERTS - October 28, 2008

Category Viruses and Spyware

Type Trojan

Troj/Invo-Zip is a family of zip files that contain malware.

Members of Troj/Invo-Zip are usually sent in spam pretending to relate to an invoice or receipt, often one related to a UPS transaction or to tax.

http://www.sophos.com/security/analyses/viruses-and-spyware/trojinvozip.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Troj/FakeAV-FN is a Trojan for the Windows platform.

When Troj/FakeAV-FN is installed the following files are created:

<Current Folder>\delself.bat
<System>\brastk.exe
<System>\dllcache\beep.sys
<System>\dllcache\figaro.sys

The files beep.sys and figaro.sys are detected as Mal/FakeAle-C.

The file delself.bat only deletes malware components and itself.
If it has remained on the system, it can safely be deleted.

The file brastk.exe is detected as Troj/FakeAV-FM.

http://www.sophos.com/security/analyses/viruses-and-spyware/trojfakeavfn.html?_log_from=rss

Aliases Win32/Wantvi.I
HASH(0xb766c0c)

Category Viruses and Spyware

Type Trojan

Troj/FakeAV-FM is a Trojan for the Windows platform.

Troj/FakeAV-FM is a fraudulent security product that bombards the user with fake alerts in an attempt to pester the user into purchasing their software, if for no other reason, than to stop the barrage of popups.

Troj/FakeAV-FM alters the following registry entries to run itself at startup:

HKLM\SOFTWARE\Microsoft\CurrentVersion\Run
brastk

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
brastk

http://www.sophos.com/security/analyses/viruses-and-spyware/trojfakeavfm.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojagentibm.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojbckdrqqd.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojagentibn.html?_log_from=rss

Category Viruses and Spyware

Type Worm

W32/Autorun-MZ is a worm for the Windows platform.

When the worm is run, the following files are created.

\Administrator.exe
\autorun.inf
\Untitled.exe
\xz.exe
<Windows>\cetix.exe
<Windows>\racun.exe
<System>\poison.exe
<System>\toxic.exe

These files are detected as W32/Autorun-MZ

The following files are also created and they can be safely removed:

\aboutCetix.html
\infoBali.txt

http://www.sophos.com/security/analyses/viruses-and-spyware/w32autorunmz.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojmdropbwl.html?_log_from=rss

Category Viruses and Spyware

Type Worm

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/w32drefaw.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojzlobapv.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Troj/Freezo-D is a Trojan for the Windows platform.

Troj/Freezo-D includes functionality to access the internet and communicate with a remote server via HTTP.

When first run Troj/Freezo-D copies itself to <System>\CbEvtSvc.exe.

The file CbEvtSvc.exe is registered as a new system driver service named "CbEvtSvc", with a display name of "CbEvtSvc" and a startup type of automatic, so that it is started automatically during system startup. Registry entries are created under:

HKLM\SYSTEM\CurrentControlSet\Services\CbEvtSvc

http://www.sophos.com/security/analyses/viruses-and-spyware/trojfreezod.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Troj/Deca-B is a Trojan for the Windows platform.

Troj/Deca-B includes functionality to access the internet and communicate with a remote server via HTTP.

When first run Troj/Deca-B copies itself to <Program Files>\Microsoft Common\wuauclt.exe.

The following registry entry is changed to run wuauclt.exe on startup:

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe
Debugger
<Program Files>\Microsoft Common\wuauclt.exe

http://www.sophos.com/security/analyses/viruses-and-spyware/trojdecab.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Window

http://www.sophos.com/security/analyses/viruses-and-spyware/trojagentibp.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojagentibo.html?_log_from=rss

Discovered: October 28, 2008
Updated: October 28, 2008 3:44:15 PM
Type: Trojan

Trojan.Mournor is a Trojan horse that may perform malicious activities on the compromised computer.

Symantec Security Response is currently investigating this threat and will post more information as it becomes available.


http://www.symantec.com/business/security_response/writeup.jsp?docid=2008-102815-1752-99

Aliases IM-Worm.Win32.Sohanad.hp
W32/Autorun.worm.bz
Win32/Autoit.CW worm

Category Viruses and Spyware

Type Worm

W32/Sdbot-DNH is a worm for the Windows platform.

When first run W32/Sdbot-DNH copies itself to the Windows folder and creates the file <Windows>\pc-off.bat.

The file pc-off.bat is detected as W32/Autoit-H.

http://www.sophos.com/security/analyses/viruses-and-spyware/w32sdbotdnh.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Troj/ZipCard-A is an attachment sent out in spam pretending to contain an e-card. In reality it contains a malicious executable.


http://www.sophos.com/security/analyses/viruses-and-spyware/trojzipcarda.html?_log_from=rss

Aliases W32/Yahlover.worm.gen.f

Category Viruses and Spyware

Type Trojan

Troj/Tiotua-V is a Trojan for the Windows platform.

When first run Troj/Tiotua-V copies itself to <System>\csrcs.exe and creates the file <Temp>\suicide.bat.

The following registry entry is created to run csrcs.exe on startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run
csrcs
<System>\csrcs.exe

The following registry entry is changed to run csrcs.exe on startup:

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Shell
Explorer.exe csrcs.exe

http://www.sophos.com/security/analyses/viruses-and-spyware/trojtiotuav.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Troj/Small-EMP is a Trojan for the Windows platform.

Troj/Small-EMP includes functionality to access the internet and communicate with a remote server via HTTP.


http://www.sophos.com/security/analyses/viruses-and-spyware/trojsmallemp.html?_log_from=rss

Aliases Trojan.Win32.Qhost.knj

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojqhostz.html?_log_from=rss

Aliases Generic.dx

Category Viruses and Spyware

Type Trojan

Troj/Keygen-CP is a Trojan for the Windows platform.

When Troj/Keygen-CP is installed the following files are created:

<Temp>\bassmod.dll
bassmod.dll is a legitimate library file.


http://www.sophos.com/security/analyses/viruses-and-spyware/trojkeygencp.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Window

http://www.sophos.com/security/analyses/viruses-and-spyware/trojjsdloada.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojdloaded.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows
Characteristics Drops more malware

http://www.sophos.com/security/analyses/viruses-and-spyware/trojagentibq.html?_log_from=rss

28 October 2008 10:30 GMT

Voulez vous devenir un mule de spam?
Voulez vous devenir un mule de spam? Would you like to be a spam mule? Anatoly Nikolayev would like you to become one. SophosLabs is currently tracking a large French based mule campaign.


Now my French doesn?t normally get me beyond ordering a meal but this looking very phishy to me.


http://www.sophos.com/security/blog/2008/10/1888.html

28 October 2008


Return of Email Malware
Regular readers of this blog will know that I?m keen on measuring the effectiveness of the SophosLabs response to the changing threats. I use a host of metrics to measure proactive detection, response times, spam catch rates and so on. In fact the labs internal ?dashboard? (a live web based system that shows many of these metrics etc) is one of the first places I visit each morning.

As our latest report shows, there has been a significant return to malware attached to spam emails.

More: http://www.sophos.com/security/blog/2008/10/1889.html

Alert ID : FrSIRT/ALRT-2008-06468
Aliases : N/A
Size : N/A
Rated as : Low Risk
Release Date : 2008-10-28


Description

This is a Trojan detection. Unlike viruses, Trojans do not self-replicate. They are spread manually, often under the premise that they are beneficial or wanted.

References

http://vil.nai.com/vil/content/v_152987.htm

Credits

Reported by McAfee

Alert ID : FrSIRT/ALRT-2008-06469
Aliases : N/A
Size : N/A
Rated as : Low Risk
Release Date : 2008-10-28


Description

This is a Trojan detection. Unlike viruses, Trojans do not self-replicate. They are spread manually, often under the premise that they are beneficial or wanted.

References

http://vil.nai.com/vil/content/v_152984.htm

Credits

Reported by McAfee

Alert ID : FrSIRT/ALRT-2008-06470
Aliases : N/A
Size : N/A
Rated as : Low Risk
Release Date : 2008-10-28


Description

This is a Trojan detection. Unlike viruses, Trojans do not self-replicate. They are spread manually, often under the premise that they are beneficial or wanted.

References

http://vil.nai.com/vil/content/v_152980.htm

Credits

Reported by McAfee

Alert ID : FrSIRT/ALRT-2008-06471
Aliases : N/A
Size : N/A
Rated as : Low Risk
Release Date : 2008-10-28


Description

This is a Trojan detection. Unlike viruses, Trojans do not self-replicate. They are spread manually, often under the premise that they are beneficial or wanted.

References

http://vil.nai.com/vil/content/v_152978.htm

Credits

Reported by McAfee