VIRUS \ Spyware ALERTS - October 30, 2008

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojagentick.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Troj/Agent-ICJ is a Trojan for the Windows platform.

Troj/Agent-ICJ includes functionality to access the internet and communicate with a remote server via HTTP.

When first run Troj/Agent-ICJ copies itself to <Program Files>\Microsoft Common\wuauclt.exe.

The following registry entry is changed to run wuauclt.exe on startup:

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe
Debugger
<Program Files>\Microsoft Common\wuauclt.exe

http://www.sophos.com/security/analyses/viruses-and-spyware/trojagenticj.html?_log_from=rss

Thursday, October 30, 2008

Over the last 48 hours we've seen a huge increase in ZIP'd malicious email attachments being spammed. The subjects have been:

Your Tracking #xxxxxxxx (where xxxxxxx is a random number)
New Ticket #xxxxx (where xxxxx is a random number)
Accounts Operations Report
Your Statement between 1/1/08 and 10/30/08


The ZIP file typically contains a file that looks like a document (.DOC) but it is really an EXE, there's just a lot of whitespaces between .DOC and .EXE.

More: http://www.f-secure.com/weblog/

Portuguese YouTube Spam Leads Users To Japan, Then To Malware

Our honeypots captured spammed email messages, written in Portugese, supposedly coming from the popular video sharing website YouTube.

More: http://blog.trendmicro.com/

Popular Mexican News Anchor Died!

At least that?s what a new spam run tells you.

Email messages claiming to be from Esmas, the largest television network in Mexico and also the world?s largest producer of Spanish language media, inform users that Joaqu

Category Viruses and Spyware

Type Trojan

Troj/FakeAV-FS is a Trojan for the Windows platform.

Troj/FakeAV-FS includes functionality to access the internet and communicate with a remote server via HTTP.

The following registry entry is created to run Troj/FakeAV-FS on startup:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
InstallProgram
<pathname of the Trojan executable>

Registry entries are created under:

HKCU\Software\Solt Lake Software\Pro Antispyware 2009

http://www.sophos.com/security/analyses/viruses-and-spyware/trojfakeavfs.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Troj/BHO-HB is a BHO Trojan for the Windows platform.

The Trojan will attempt to download components without user notification.

http://www.sophos.com/security/analyses/viruses-and-spyware/trojbhohb.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojagenticf.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojzlobaqc.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojfakevirgw.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojfakealc.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Troj/Dwnldr-HJU is a Trojan for the windows platform.

Troj/Dwnldr-HJU attempts to download an executable file from a remote website.

Troj/Dwnldr-HJU copies the executable file as <Windows>\N0tepad.exe and tries to execute it.

http://www.sophos.com/security/analyses/viruses-and-spyware/trojdwnldrhju.html?_log_from=rss

Category Viruses and Spyware

Type Malicious Behavior

Mal/Zlob-AC is a malicious program for the Windows platform.

Detection for members of Mal/Zlob-AC is behavior based. It is extremely important that customers report detections of Mal/Zlob-AC to Sophos and send a sample for analysis.

http://www.sophos.com/security/analyses/viruses-and-spyware/malzlobac.html?_log_from=rss

Category Adware or PUA

Type Hacking Tool

MSN Hook Library is a library which is used to monitor the MSN Messenger's activity. It had been seen to be dropped on comprised computer.

http://www.sophos.com/security/analyses/adware-and-puas/msnhooklibrary.html?_log_from=rss