VIRUS \ Spyware ALERTS - October 31, 2008

Alert ID : FrSIRT/ALRT-2008-06646
Aliases : N/A
Size : N/A
Rated as : Low Risk
Release Date : 2008-10-31


Description

MH.Farfli.1 is a detection technology designed to detect entirely new malware threats without traditional signatures. This technology is aimed at detecting malicious software that has been intentionally mutated or morphed by attackers.

References

http://www.symantec.com/business/security_response/writeup.jsp?docid=2008-103115-5515-99

Credits

Reported by Symantec

Alert ID : FrSIRT/ALRT-2008-06637
Aliases : N/A
Size : N/A
Rated as : Low Risk
Release Date : 2008-10-31


Description

Technical details and description are not available at this time.

References

http://www.sophos.com/security/analyses/viruses-and-spyware/trojagentici.html

Credits

Reported by Sophos

Alert ID : FrSIRT/ALRT-2008-06636
Aliases : N/A
Size : N/A
Rated as : Low Risk
Release Date : 2008-10-31


Description

Technical details and description are not available at this time.

References

http://www.sophos.com/security/analyses/viruses-and-spyware/trojagenticg.html

Credits

Reported by Sophos

Alert ID : FrSIRT/ALRT-2008-06642
Aliases : N/A
Size : N/A
Rated as : Low Risk
Release Date : 2008-10-31


Description

Technical details and description are not available at this time.

References

http://www.sophos.com/security/analyses/viruses-and-spyware/trojzipcardb.html

Credits

Reported by Sophos

Alert ID : FrSIRT/ALRT-2008-06641
Aliases : N/A
Size : N/A
Rated as : Low Risk
Release Date : 2008-10-31


Description

Troj/FakeAle-JF is a Trojan for the Windows platform. Troj/FakeAle-JF includes functionality to access the internet and communicate with a remote server via HTTP.

References

http://www.sophos.com/security/analyses/viruses-and-spyware/trojfakealejf.html

Credits

Reported by Sophos

Alert ID : FrSIRT/ALRT-2008-06640
Aliases : N/A
Size : N/A
Rated as : Low Risk
Release Date : 2008-10-31


Description

Technical details and description are not available at this time.

References

http://www.sophos.com/security/analyses/viruses-and-spyware/trojbhoho.html

Credits

Reported by Sophos

Alert ID : FrSIRT/ALRT-2008-06639
Aliases : N/A
Size : N/A
Rated as : Low Risk
Release Date : 2008-10-31


Description

Technical details and description are not available at this time.

References

http://www.sophos.com/security/analyses/viruses-and-spyware/trojbancosber.html

Credits

Reported by Sophos

Alert ID : FrSIRT/ALRT-2008-06638
Aliases : N/A
Size : N/A
Rated as : Low Risk
Release Date : 2008-10-31


Description

Technical details and description are not available at this time.

References

http://www.sophos.com/security/analyses/viruses-and-spyware/trojautoitad.html

Credits

Reported by Sophos

Alert ID : FrSIRT/ALRT-2008-06635
Aliases : N/A
Size : N/A
Rated as : Low Risk
Release Date : 2008-10-31


Description

W32/Tiotua-W is a Trojan for the Windows platform. W32/Tiotua-W includes functionality to access the internet and communicate with a remote server via HTTP.

References

http://www.sophos.com/security/analyses/viruses-and-spyware/w32tiotuaw.html

Credits

Reported by Sophos

Alert ID : FrSIRT/ALRT-2008-06634
Aliases : Worm.Win32.VB.ck - W32/YahLover.worm
Size : N/A
Rated as : Low Risk
Release Date : 2008-10-31


Description

W32/Sohana-BK is a worm for the Windows platform. W32/Sohana-BK includes functionality to download, install and run new software.

References

http://www.sophos.com/security/analyses/viruses-and-spyware/w32sohanabk.html

Credits

Reported by Sophos

Alert ID : FrSIRT/ALRT-2008-06633
Aliases : IM-Worm.Win32.Sohanad.hp - W32/Autorun.worm.bz - Win32/Autoit.CWworm
Size : N/A
Rated as : Low Risk
Release Date : 2008-10-31


Description

W32/Autoit-AE is a worm for the Windows platform. When first run W32/Autoit-AE copies itself to the Windows folder and creates the file <Windows>\pc-off.bat.

References

http://www.sophos.com/security/analyses/viruses-and-spyware/w32autoitae.html

Credits

Reported by Sophos

Alert ID : FrSIRT/ALRT-2008-06632
Aliases : N/A
Size : N/A
Rated as : Low Risk
Release Date : 2008-10-31


Description

Technical details and description are not available at this time.

References

http://www.sophos.com/security/analyses/viruses-and-spyware/trojzlobaqb.html

Credits

Reported by Sophos

Alert ID : FrSIRT/ALRT-2008-06631
Aliases : N/A
Size : N/A
Rated as : Low Risk
Release Date : 2008-10-31


Description

Technical details and description are not available at this time.

References

http://www.sophos.com/security/analyses/viruses-and-spyware/trojvbebk.html

Credits

Reported by Sophos

Alert ID : FrSIRT/ALRT-2008-06630
Aliases : N/A
Size : N/A
Rated as : Low Risk
Release Date : 2008-10-31


Description

Troj/Thyself-B is a malicious JavaScript embedded in a web page.<br> <br> Troj/Thyself-B attempts to download malicious content from other remote sites when the web page is browsed.

References

http://www.sophos.com/security/analyses/viruses-and-spyware/trojthyselfb.html

Credits

Reported by Sophos

Alert ID : FrSIRT/ALRT-2008-06629
Aliases : N/A
Size : N/A
Rated as : Low Risk
Release Date : 2008-10-31


Description

Technical details and description are not available at this time.

References

http://www.sophos.com/security/analyses/viruses-and-spyware/trojkeygencq.html

Credits

Reported by Sophos

Alert ID : FrSIRT/ALRT-2008-06628
Aliases : N/A
Size : N/A
Rated as : Low Risk
Release Date : 2008-10-31


Description

Technical details and description are not available at this time.

References

http://www.sophos.com/security/analyses/viruses-and-spyware/trojiframebk.html

Credits

Reported by Sophos

Virus Alerts [Panda Security's weekly report on viruses and intruders - 10/31/0

- Panda Security's weekly report on viruses and intruders -

Virus Alerts, by Panda Security (http://www.pandasecurity.com)

Two Trojans, Gimmiv.A and Aidreden.A, and theP2PShared.P worm are the
subject of this week's PandaLabs report.

Gimmiv.A allows its creator to take full control of infected systems.

Once a computer has been infected, the Trojan starts gathering the
following information:

* User names and passwords entered in web pages.
* MSN Messenger passwords
* Outlook Express passwords
* System user name
* Computer name
* Patches installed
* Information about the browser

All stolen information is encrypted using the Advanced Encryption
Standard (AES) and sent to a remote server.

Aidreden.A is a Trojan designed to dupe users into buying a fake
antivirus. To do this, it modifies the Host file on the infected
computer so that users that visit certain Web pages are taken to a fake
Microsoft web page and encouraged to download an anti-spyware software
(see image here:
http://www.flickr.com/photos/panda_security/2989258406/).

Finally, P2PShared.P is a worm with bot features that steals password
for all kinds of programs, applications, email and even banking details.
All this information is then sent to cyber-crooks.

Once run, it copies itself to the system and all the P2P file sharing
directories under names like:

Windows Live Password reveal.exe
Leona-Lewis-Bleeding-love.mp3.www-freemp3s.com
eMule-0-48a-VeryCD080902-Update.exe
MsnCleaner.exe

Category Viruses and Spyware

Type Worm

W32/Autorun-NJ is a worm for the Windows platform.

When first run, W32/Autorun-NJ copies itself to the following location:

<Program Files>\Microsoft Common
wuauclt.exe

The following registry entries are created to start W32/Autorun-NJ when Windows starts:

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe
Debugger
<Program Files>\Microsoft Common\wuauclt.exe

W32/Autorun-NJ attempts to copy itself to any removeable drives connected to the computer. These drives may then infect other computers they are later connected to.

W32/Autorun-NJ creates autorun.inf files on any drive it infects. These files are detected as Mal/AutoInf-A.

http://www.sophos.com/security/analyses/viruses-and-spyware/w32autorunnj.html?_log_from=rss

Category Viruses and Spyware

Type Worm

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/w32autorunni.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojfakeavfv.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Troj/Dwnldr-HJW is a Trojan for the Windows platform.

Troj/Dwnldr-HJW includes functionality to access the internet and communicate with a remote server via HTTP.

http://www.sophos.com/security/analyses/viruses-and-spyware/trojdwnldrhjw.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojdloadrbxo.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Troj/Cheuko-E is a Trojan for the Windows platform.

Troj/Cheuko-E includes functionality to access the internet and communicate with a remote server via HTTP.

http://www.sophos.com/security/analyses/viruses-and-spyware/trojcheukoe.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojagentics.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojagenticp.html?_log_from=rss

Category Viruses and Spyware

Type Malicious Behavior

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/malencpkfr.html?_log_from=rss

Category Adware or PUA

Type Adware

Affected operating systems Windows

http://www.sophos.com/security/analyses/adware-and-puas/doctorvaccine.html?_log_from=rss

Sinowal's evil genius

By Dan Goodin in San Francisco ? Get more from this author

Posted in Security, 31st October 2008

A well-organized crime gang has stolen credentials for more than a half-million financial accounts in less than three years using a sophisticated trojan that remains undetectable to the vast majority of its victims, a report published Friday warns.

The haul of bank, credit, and debit card account numbers stolen by the Sinowal trojan is among the largest ever discovered. It was unearthed by researchers at RSA's FraudAction Research Lab. They say the program, which is also known as Torpig and Mebroot, has been operating non-stop for almost three years, an unusually long time in the fly-by-night world of cybercrime.

More: http://www.theregister.co.uk/2008/10/31/sinowal_trojan_heist/

300K bank accounts compromised by backdoor code

By John Leyden ? Get more from this author

Posted in Security, 31st October 2008


Security researchers at RSA have uncovered how a banking Trojan may have stolen the login credentials of as many as 300,000 online bank accounts.

The Sinowell (AKA Torpig) trojan has also lifted email and FTP account login details. Previous attempts to track the source of the Trojan have run into blind alleys.

One popular theory is that the malware authors behind the trojan are in the same gang as the group who ran the infamous Russian Business Network (RBN). RSA's analysis suggests that the authors of Sinowell may have been at least affiliated with the Storm worm gang in the past but are now running the malware through hosting facilities unaffiliated to the RBN.

More: http://www.theregister.co.uk/2008/10/31/torpig_banking_trojan/

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojdloadrbxp.html?_log_from=rss