VIRUS \ Spyware ALERTS - October 28, 2008

Alert ID : FrSIRT/ALRT-2008-06472
Aliases : N/A
Size : N/A
Rated as : Low Risk
Release Date : 2008-10-28


Description

This is a Trojan detection. Unlike viruses, Trojans do not self-replicate. They are spread manually, often under the premise that they are beneficial or wanted.

References

http://vil.nai.com/vil/content/v_152977.htm

Credits

Reported by McAfee

Aliases Trojan-Downloader.Win32.Agent.ajwx

Category Viruses and Spyware

Type Trojan

Troj/Dloadr-BWU is downloader Trojan for the Windows platform.

Troj/Dloadr-BWU installs itself in the <System> folder as a filename in the format of Lka999_999.dll where both instances of "999" could be any 3 digit number.

A INI format file "Download1" is also created in the Windows folder. This is harmless.


http://www.sophos.com/security/analyses/viruses-and-spyware/trojdloadrbwu.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Troj/DelSpy-Gen are a set of Trojans which typically have keylogging and emailing capabilities.

http://www.sophos.com/security/analyses/viruses-and-spyware/trojdelspygen.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojcinmusgen.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Troj/Bnkmr-Fam is a family of Trojans which attempt to steal information related to banking websites.

http://www.sophos.com/security/analyses/viruses-and-spyware/trojbnkmrfam.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojbckdrqqc.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojagentibs.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojagentibr.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojagenthzz.html?_log_from=rss

Category Viruses and Spyware

Type Malicious Behavior

Mal/Behav-301 is a program which displays characteristics unique to malware which have been seen mass-mailed out in ZIP attachments.

http://www.sophos.com/security/analyses/viruses-and-spyware/malbehav301.html?_log_from=rss

Category Viruses and Spyware

Type Malicious Behavior

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/malbancosb.html?_log_from=rss

Category Suspicious behavior and files

Type Suspicious behavior

What's been detected Sus/Veneb-B exhibits characteristics commonly, but not exclusively, found in malware.

Affected operating systems Windows

http://www.sophos.com/security/analyses/suspicious-behavior-and-files/susvenebb.html?_log_from=rss

Category Suspicious behavior and files

Type Suspicious behavior

What's been detected Sus/Flake-A exhibits characteristics commonly, but not exclusively, found in malware.

Sus/Flake-A is a family of downloader Trojans which typically download a legitimate version of Macromedia Flash Player but then visit remote websites which may contain Shock Wave Flash files that install adware.

http://www.sophos.com/security/analyses/suspicious-behavior-and-files/susflakea.html?_log_from=rss

Alert ID : FrSIRT/ALRT-2008-06513
Aliases : Trojan-GameThief.Win32.OnLineGames.tphj
Size : N/A
Rated as : Low Risk
Release Date : 2008-10-28


Description

Technical details and description are not available at this time.

References

http://www.sophos.com/security/analyses/viruses-and-spyware/trojrootkitdz.html

Credits

Reported by Sophos

Category Viruses and Spyware

Type Trojan

Troj/WSHack-A is a Trojan for the Windows platform.

Troj/WSHack-A may attempt to redirect web browsers.

When installed, Troj/WSHack-A may attempt to overwrite the legitimate Windows DLL ws_32.dll.

Troj/WSHack-A may set the following registry entry:

HKCU\Software\Classes\{C7F7D382-3524-014E-9039-A610070EF557}


http://www.sophos.com/security/analyses/viruses-and-spyware/trojwshacka.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojfakevirgt.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Troj/FakeAV-FO is a Trojan for the Windows platform.

When Troj/FakeAV-FO is installed the following files are created:

<System>\1224433053\f4.dll
<System>\1224433053\winlogon.exe
<System>\m5p.dll
<System>\z6f.exe

http://www.sophos.com/security/analyses/viruses-and-spyware/trojfakeavfo.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojfakealejb.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojdloadrbxe.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojdloadrbxd.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojagentibv.html?_log_from=rss

Aliases PWS-OnlineGames.y.gen
TSPY_GAMETHI.DTZ
Trojan-GameThief.Win32.Magania.ahhn

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojagentibu.html?_log_from=rss

Category Viruses and Spyware

Type Malicious Behavior

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/malencpkfq.html?_log_from=rss