VIRUS \ Spyware ALERTS - October 31, 2008

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojspybh.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojdwnldrhjv.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojdloadrbxm.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Troj/Bankr-C is a banking Trojan for the Windows platform.

When run, the Trojan modifies the host file to point certain banking URLS to a remote site hosting a phishing site.

http://www.sophos.com/security/analyses/viruses-and-spyware/trojbankrc.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojagenticn.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Troj/Agent-ICM is a Trojan for the Windows platform.

When run the Trojan copies itself to:

<Application Data>\Facegame\Facegame.exe

Troj/Agent-ICM sets the following registry entry:

HKCU\Software\Microsoft\CurrentVersion\Run
Facegame
<path to Trojan>

http://www.sophos.com/security/analyses/viruses-and-spyware/trojagenticm.html?_log_from=rss

Category Viruses and Spyware

Type Malicious Behavior

Mal/Renos-D is a malicious program for the Windows platform.

Detection for members of Mal/Renos-D is behavior based. It is extremely important that customers report detections of Mal/Renos-D to Sophos and send a sample for analysis.

http://www.sophos.com/security/analyses/viruses-and-spyware/malrenosd.html?_log_from=rss

Category Viruses and Spyware

Type Malicious Behavior

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/malencpkfd.html?_log_from=rss

Aliases Worm.VBS.Small.r

Category Viruses and Spyware

Type Worm

W32/Small-EMQ is a worm for the Windows platform.

When first run W32/Small-EMQ copies itself to <System>\scvhost.vbs.

The following registry entry is created to run scvhost.vbs on startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
SysChk
<System>\scvhost.vbs

http://www.sophos.com/security/analyses/viruses-and-spyware/w32smallemq.html?_log_from=rss

Category Viruses and Spyware

Type Worm

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/w32sdbotdni.html?_log_from=rss

Category Viruses and Spyware

Type Worm

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/w32autorunnh.html?_log_from=rss

Category Viruses and Spyware

Type Worm

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/w32autorunko.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Troj/VBDown-G is a VisualBasic downloader for the Windows platform.

When run the Trojan will attempt to download components from the internet and run them.

http://www.sophos.com/security/analyses/viruses-and-spyware/trojvbdowng.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojrootkitdx.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojpwsavi.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojagentico.html?_log_from=rss

Category Suspicious behavior and files

Type Suspicious behavior

What's been detected Sus/ObfJS-BI exhibits characteristics commonly, but not exclusively, found in malware.

Sus/ObfJS-BI will attempt to download and install other malware.

http://www.sophos.com/security/analyses/suspicious-behavior-and-files/susobfjsbi.html?_log_from=rss

Type: Trojan

Trojan.Reglirer is a Trojan horse that opens a back door on the compromised computer.

Symantec Security Response is currently investigating this threat and will post more information as it becomes available.

http://www.symantec.com/business/security_response/writeup.jsp?docid=2008-103106-5424-99

Category Viruses and Spyware

Type Worm

How it spreads Removable storage devices

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/w32mourna.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojrenosbl.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Troj/FakeAv-FU is a Trojan for the Windows platform.

Troj/FakeAv-FU includes functionality to access the internet and communicate with a remote server via HTTP.

When Troj/FakeAv-FU is first run it copies itself to <Profile>\Application Data\winlogon.exe and creates the following registry entry:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
CTEMON.EXE
<Profile>\Application Data\winlogon.exe

http://www.sophos.com/security/analyses/viruses-and-spyware/trojfakeavfu.html?_log_from=rss

Aliases BackDoor-YA.dr
Trojan-Spy.Win32.TianYan.b

Category Viruses and Spyware

Type Trojan

Troj/Agent-ICR is a Trojan for the Windows platform.

When first run Troj/Agent-ICR copies itself to <System>\cleanmg.exe.

The following registry entry is created to run cleanmg.exe on startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
winlogon
<System>\cleanmg.exe

http://www.sophos.com/security/analyses/viruses-and-spyware/trojagenticr.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojagenticq.html?_log_from=rss

Alert ID : FrSIRT/ALRT-2008-06648
Aliases : N/A
Size : 19968 bytes
Rated as : Low Risk
Release Date : 2008-10-31


Description

This Trojan may arrive bundled with malware packages as a malware component. It may arrive as a .DLL file that exports functions used by other malware.

References

http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=TROJ_GAMETHI.DDV

Credits

Reported by Trend Micro

Alert ID : FrSIRT/ALRT-2008-06649
Aliases : N/A
Size : 67584 bytes
Rated as : Low Risk
Release Date : 2008-10-31


Description

This Trojan arrives as a file downloaded from a certain URL. Upon execution, it drops a copy of itself and its components in the system. It modifies the system registry to enable its automatic execution at every system startup. It then attempts to access a certain Web site to download its configuration file. The said file contains information on where the malware can download an updated copy of itself, and on where it can send its stolen data. This configuration file also contains a list of targeted bank-related Web sites to monitor from which it steals information. Once users accesses any of the monitored sites, this Trojan starts logging keystrokes. It attempts to steal sensitive online banking information, such as user names and passwords. This routine risks the exposure of the user's account information, which may then lead to the unauthorized use of the stolen data. It has rootkit capabilities, which enables it to hide its processes and files from the user.

References

http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=TROJ_ZBOT.AJR

Credits

Reported by Trend Micro

Alert ID : FrSIRT/ALRT-2008-06643
Aliases : N/A
Size : N/A
Rated as : Low Risk
Release Date : 2008-10-31


Description

AH.Farfli.0 is a detection technology designed to detect entirely new malware threats without traditional signatures. This technology is aimed at detecting malicious software that has been intentionally mutated or morphed by attackers.

References

http://www.symantec.com/business/security_response/writeup.jsp?docid=2008-103115-3559-99

Credits

Reported by Symantec

Alert ID : FrSIRT/ALRT-2008-06644
Aliases : N/A
Size : N/A
Rated as : Low Risk
Release Date : 2008-10-31


Description

AH.Farfli.1 is a detection technology designed to detect entirely new malware threats without traditional signatures. This technology is aimed at detecting malicious software that has been intentionally mutated or morphed by attackers.

References

http://www.symantec.com/business/security_response/writeup.jsp?docid=2008-103115-5014-99

Credits

Reported by Symantec

Alert ID : FrSIRT/ALRT-2008-06645
Aliases : N/A
Size : N/A
Rated as : Low Risk
Release Date : 2008-10-31


Description

MH.Farfli.0 is a detection technology designed to detect entirely new malware threats without traditional signatures. This technology is aimed at detecting malicious software that has been intentionally mutated or morphed by attackers.

References

http://www.symantec.com/business/security_response/writeup.jsp?docid=2008-103116-0436-99

Credits

Reported by Symantec