VIRUS \ Spyware ALERTS - October 30, 2008

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojfakevirgv.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojdropbg.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojagentibg.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Troj/Dload-EE is a backdoor Trojan which allows a remote intruder to gain access and control over the computer.

Troj/Dload-EE includes functionality to access the internet and communicate with a remote server via HTTP.

When Troj/Dload-EE is installed the following files are created:

<System>\kryo2.sys
<System>\kryostm.dll

The file kryostm.dll is detected as Mal/TinyDL-T, and the file kryo2.sys is also detected as Troj/Dload-EE.

http://www.sophos.com/security/analyses/viruses-and-spyware/trojdloadee.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Troj/Delf-FBK is a Trojan for the Windows platform.

When first run Troj/Delf-FBK copies itself to <System>\wins\setup\msmgrs.exe and creates the file <Startup>\ntdll.lnk.

Troj/Delf-FBK sets the following registry entries, disabling the automatic startup of other software:

HKLM\SYSTEM\CurrentControlSet\Services\srservice
Start
4

The following registry entry is set:

HKCU\Software\Microsoft\Windows\CurrentVersion\Settings
LocationOld
<pathname of the Trojan executable>

http://www.sophos.com/security/analyses/viruses-and-spyware/trojdelffbk.html?_log_from=rss

Category Viruses and Spyware

Type Malicious Behavior

Mal/BHO-M is a malicious program for the Windows platform.

Detection for members of Mal/BHO-M is behavior based. It is extremely important that customers report detections of Mal/BHO-M to Sophos and send a sample for analysis.

http://www.sophos.com/security/analyses/viruses-and-spyware/malbhom.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/jsiframebj.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojzlobaqa.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Troj/Psyme-KJ is a malicious script embedded in web pages that attempts to exploit browser vulnerabilities in order to download and run other malware.

http://www.sophos.com/security/analyses/viruses-and-spyware/trojpsymekj.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojmultidrfw.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojircfloodu.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojfakeavfq.html?_log_from=rss

Category Viruses and Spyware

Type Trojan


Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojagentich.html?_log_from=rss

Type: Trojan

Infostealer.Hibik.A is a Trojan horse that steals confidential information from the compromised computer.

Symantec Security Response is currently investigating this threat and will post more information as it becomes available.

http://www.symantec.com/business/security_response/writeup.jsp?docid=2008-102916-3249-99

30 October 2008

One of the most common forms of malware distribution en mass is to spam it out with some enticing message however as administrators slowly lock down their spam rules and block questionable content the malware authors are needing to continually find new tricks?

One tried and tested method is the encrypted zip, as it prevents scanners from examining the archive content while still maintaining a perception of being legitimate. The password of course is in the message body which the recipient (often without thinking) employs with rather dire consequences.

In order to sound appealing, many of these new-wave spams relate to invoices, statements or UPS/FedEx tracking.

More: http://www.sophos.com/security/blog/2008/10/1907.html

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojzipcardb.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Troj/FakeAle-JF is a Trojan for the Windows platform.

Troj/FakeAle-JF includes functionality to access the internet and communicate with a remote server via HTTP.

When Troj/FakeAle-JF is installed the following files are created:

<Current Folder>\delself.bat
<System>\brastk.exe
<System>\dllcache\beep.sys
<System>\dllcache\figaro.sys
<System>\wini10253.exe

The files beep.sys and figaro.sys are detected as Mal/FakeAle-C.

More: http://www.sophos.com/security/analyses/viruses-and-spyware/trojfakealejf.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojbhoho.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojbancosber.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojautoitad.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojagentici.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojagenticg.html?_log_from=rss

Category Viruses and Spyware

Type Trojan


Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojzlobaqb.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojvbebk.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Troj/Thyself-B is a malicious JavaScript embedded in a web page.<br>
<br>
Troj/Thyself-B attempts to download malicious content from other remote sites when the web page is browsed.

http://www.sophos.com/security/analyses/viruses-and-spyware/trojthyselfb.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojkeygencq.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

How it spreads Web browsing

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojiframebk.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojfakeavfr.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojfakealejg.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojbankereoa.html?_log_from=rss