VIRUS \ Spyware ALERTS - October 29, 2008

Category Viruses and Spyware

Type Malicious Behavior

Mal/Renos-C is a malicious program for the Windows platform.

Mal/Renos-C attempts to connect to a remote computer to download further malicious code. It is likely that these downloaded components will display fake warning and error messages when executed.

Detection for members of Mal/Renos-C is behavior based. It is extremely important that customers report detections of Mal/Renos-C to Sophos and send a sample for analysis.

http://www.sophos.com/security/analyses/viruses-and-spyware/malrenosc.html?_log_from=rss

Category Viruses and Spyware

Type Malicious Behavior

Mal/BHO-M is a malicious program for the Windows platform.

Detection for members of Mal/BHO-M is behavior based. It is extremely important that customers report detections of Mal/BHO-M to Sophos and send a sample for analysis.

http://www.sophos.com/security/analyses/viruses-and-spyware/malbhom.html?_log_from=rss

Category Viruses and Spyware

Type Worm

When first run, W32/Dloadr-BXJ deletes itself and makes copies in the following locations:

<Program Files>\Common Files\System
opajqxn.exe

<Program Files>\Common Files\Microsoft Shared
vknaotn.exe

<Program Files>
meex.exe

C:
softlsy.exe

Additionally, the following file is created:

C:
autorun.inf

W32/Dloadr-BXJ creates the following registry entry to ensure it loads when Windows is run:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
qtgfcql
<Program Files>\Common Files\System\opajqxn.exe

http://www.sophos.com/security/analyses/viruses-and-spyware/w32dloadrbxj.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojpwsavh.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Window

http://www.sophos.com/security/analyses/viruses-and-spyware/trojfuzflea.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojdloadrbxk.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojagenticc.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojagentibg.html?_log_from=rss

Category Viruses and Spyware

Type Virus

AL/Bursted-Fam is a family of AutoCAD LISP (AutoLISP) virus. If an infected
file is received as ACAD.LSP and an AutoCAD Drawing is loaded from the same
folder the virus becomes resident within AutoCAD.

AL/Bursted-Fam edits the existing global ACAD.LSP or creates one to load
itself at AutoCAD startup from another LSP file in the same folder.

When an AutoCAD drawing (DWG file) is editted an ACAD.LSP will be created in
the same folder as the drawing.

http://www.sophos.com/security/analyses/viruses-and-spyware/alburstedfam.html?_log_from=rss

Alert ID : FrSIRT/ALRT-2008-06519
Aliases : N/A
Size : N/A
Rated as : Low Risk
Release Date : 2008-10-29


Description

This is a Trojan detection. Unlike viruses, Trojans do not self-replicate. They are spread manually, often under the premise that they are beneficial or wanted.

References

http://vil.nai.com/vil/content/v_152999.htm

Credits

Reported by McAfee

Alert ID : FrSIRT/ALRT-2008-06559
Aliases : N/A
Size : N/A
Rated as : Low Risk
Release Date : 2008-10-29


Description

Troj/WSHack-A is a Trojan for the Windows platform. Troj/WSHack-A may attempt to redirect web browsers.

References

http://www.sophos.com/security/analyses/viruses-and-spyware/trojwshacka.html

Credits

Reported by Sophos

Alert ID : FrSIRT/ALRT-2008-06579
Aliases : N/A
Size : N/A
Rated as : Low Risk
Release Date : 2008-10-29


Description

Troj/Sysdel-C tries to connect to the internet and drops a malicious file. It deletes the original copy of itself after execution.

References

http://www.sophos.com/security/analyses/viruses-and-spyware/trojsysdelc.html

Credits

Reported by Sophos

Alert ID : FrSIRT/ALRT-2008-06580
Aliases : N/A
Size : N/A
Rated as : Low Risk
Release Date : 2008-10-29


Description

W32/IRCBot-ACV sets the following registry entries: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system DisableTaskMgr HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system DisableRegistryTools W32/IRCBot-ACV copies itself to <Windows>\service.exe W32/IRCBot-ACV creates the following registry entries: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Windows Service <Windows>\service.exe HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce Windows Service <Windows>\service.exe HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx Windows Service <Windows>\service.exe.

References

http://www.sophos.com/security/analyses/viruses-and-spyware/w32ircbotacv.html

Credits

Reported by Sophos

Alert ID : FrSIRT/ALRT-2008-06577
Aliases : N/A
Size : N/A
Rated as : Low Risk
Release Date : 2008-10-29


Description

Technical details and description are not available at this time.

References

http://www.sophos.com/security/analyses/viruses-and-spyware/trojrenosbi.html

Credits

Reported by Sophos

Category Viruses and Spyware

Type Worm

How it spreads Removable storage devices

Affected operating systems Windows
Characteristics Installs itself in the registry

http://www.sophos.com/security/analyses/viruses-and-spyware/w32autorunnc.html?_log_from=rss

Aliases BackDoor-CLZ

Category Viruses and Spyware

Type Trojan

Troj/Telemot-B is a backdoor Trojan for the Windows platform.

When first run Troj/Telemot-B copies itself to <System>\chkdsk64.exe.

The file CHKDSK64.exe is registered as a new system driver service named "Logical Users Disk Manager Service", with a display name of "Disk management service for users requests" and a startup type of automatic, so that it is started automatically during system startup. Registry entries are created under:

HKLM\SYSTEM\CurrentControlSet\Services\Logical Users Disk Manager Service\

Troj/Telemot-B injects code into svchost.exe which listens for incoming TCP connections. An attacker connecting to the Trojan will be given a shell from which they can run commands that will:

More: http://www.sophos.com/security/analyses/viruses-and-spyware/trojtelemotb.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojfakealb.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojdloadrbxl.html?_log_from=rss

Alert ID : FrSIRT/ALRT-2008-06559
Aliases : N/A
Size : N/A
Rated as : Low Risk
Release Date : 2008-10-29


Description

Troj/WSHack-A is a Trojan for the Windows platform. Troj/WSHack-A may attempt to redirect web browsers.

References

http://www.sophos.com/security/analyses/viruses-and-spyware/trojwshacka.html

Credits

Reported by Sophos

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojonlinegbk.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

W32/Fanbot-M is a Trojan for the Windows platform.

W32/Fanbot-M includes functionality to access the internet and communicate with a remote server via HTTP.

When first run W32/Fanbot-M copies itself to <System>\llwzjy081029.exe and creates the following files:

<User>\jjjydf16.ini
<Root>\dfDelmlljy.bat
<System>\mvjaj32dla.dll

The file mvjaj32dla.dll is detected as Mal/Behav-236. The file jjjydf16.ini is detected as Troj/Fanbot-M. The batch file may be deleted.

The following registry entry is created to run llwzjy081029.exe on startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\run
dlnajjbdfa
<System>\llwzjy081029.exe

More: http://www.sophos.com/security/analyses/viruses-and-spyware/trojfanbotm.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Troj/Bckdr-QQE is a Trojan for the windows platform.

http://www.sophos.com/security/analyses/viruses-and-spyware/trojbckdrqqe.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojaglghta.html?_log_from=rss

Aliases Trojan-GameThief.Win32.Magania.aikp
Trojan.Win32.Writer.a
W32.Gammima.AG
PWS-OnlineGames.y.gen
PWS:Win32/Frethog.D
Mal/EncPk-BX
Pack/ZPack-A

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows
Characteristics Drops more malware

http://www.sophos.com/security/analyses/viruses-and-spyware/trojagentibt.html?_log_from=rss

Category Viruses and Spyware

Type Malicious Behavior

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/malzlobaa.html?_log_from=rss

Category Viruses and Spyware

Type Malicious Behavior

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/malencpkfr.html?_log_from=rss

Category Viruses and Spyware

Type Malicious Behavior

Affected operating systems Windows
Characteristics Installs itself in the registry

http://www.sophos.com/security/analyses/viruses-and-spyware/malbhon.html?_log_from=rss