Spyware, viruses, & security forum: VIRUS ALERTS - May 29, 2006

Type
Trojan

Aliases
Trojan.Win32.Small.fb

Troj/DwnLdr-CCV is a Trojan for the Windows platform.

When first run Troj/DwnLdr-CCV copies itself to <System> \dmktn.exe.

The following registry entry is created to run dmktn.exe on startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
dmktn.exe
<System> \dmktn.exe

http://www.sophos.com/virusinfo/analyses/trojdwnldrccv.html

Type
Trojan

Aliases
Trojan-Downloader.Win32.Harnig.bs

Troj/DwnLdr-BYI is a Trojan for the Windows platform.

Troj/DwnLdr-BYI includes functionality to access the internet and communicate with a remote server via HTTP.

When Troj/DwnLdr-BYI is installed the following files are created:

<Program Files> \pgybc.exe
<Program Files> \secure32.html
\uniq
\ <random filename>.exe

Troj/DwnLdr-BYI also attempts to terminate security and anti-virus related processes.

http://www.sophos.com/virusinfo/analyses/trojdwnldrbyi.html

Type
Trojan

Aliases
SpamTool.Win32.Agent.h

Troj/Spammit-E is an email spamming Trojan for the Windows platform.

http://www.sophos.com/virusinfo/analyses/trojspammite.html

Type
Spyware Trojan

Aliases
Trojan-Spy.Win32.Banker.anv
PWS-Banker.gen.i

Troj/Banker-BMB is a Trojan for the Windows platform.

When first run Troj/Banker-BMB copies itself to:

<Startup> \lsass32.exe
<System> \lsass32.exe

The following registry entry is created to run lsass32.exe on startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
lsass32
<System> \lsass32.exe

http://www.sophos.com/virusinfo/analyses/trojbankerbmb.html

Type
Trojan

Aliases
Trojan-Downloader.Win32.Zlob.pz
Win32/TrojanDownloader.Zlob.OR

Troj/Zlob-LA is a downloading Trojan for the Windows platform.

Troj/Zlob-LA pretends to be an installer for an application called 'Media-Codec 4.0', but installs Trojan files instead of those of the expected application.

The Trojan provides an uninstall option which can be accessed via the Add or Remove Programs dialog in the Windows Control Panel, under the name "Media-Codec 4.0". However this does not uninstall the Trojan.

http://www.sophos.com/virusinfo/analyses/trojzlobla.html

Type
Trojan

Aliases
Trojan-Downloader.Win32.Pux.d

Troj/Banloa-ADD is a Trojan for the Windows platform.

Troj/Banloa-ADD includes functionality to access the internet and communicate
with a remote server via HTTP.

Troj/Banloa-ADD attempts to download and install two files. They are detected by
Sophos as Troj/Bancos-AJQ and Troj/Bnkmr-Fam.

http://www.sophos.com/virusinfo/analyses/trojbanloaadd.html

Type
Trojan

Aliases
Email-Worm.Win32.Bagle.gh

Troj/BagleDl-BR is a Trojan for the Windows platform.

The Trojan has the functionality to silently download, install and run new software from preconfigured sources via HTTP.

http://www.sophos.com/virusinfo/analyses/trojbagledlbr.html

Type Worm

Aliases Email-Worm.Win32.Banwarum.f
W32/Banwarum@MM
Win32/Banwarum.F
WORM_RANCHNEG.A
W32.Banwarum@mm

W32/Zasran-D is a mass mailing worm with backdoor functionality for the Windows platform.

W32/Zasran-D runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer.

W32/Zasran-D is capable of spreading through email. Email sent by W32/Zasran-D has the following properties:

Subject line chosen from:
Ficke meine Brust!
Geld
Geld von Postbank
Geldueberweisungen
Gewonnen? GeWONNEN!
Guten Tag
Hallo!
Hier sind ihre WM Tickets!
Holen sie jetzt ihre WM Tickets ab!
Holen sie sich WM Tickets fuer das Finalle JETZT!
Ich bin dauergeill warum?
Ich hab die neuen Fotos Fertig!
Ich hab ihr Geld.
Ich habe Geld von ihren Postbank Konto bekommen
Ich lauf aus bitte leck mich!
Ich liebe dich!
Ihr Geld, Postbank
Ihre Auszahlungen an mich
JehhuuuU! WWWMMMM!!
Komme mit!
Lass dich Umsonst Wixen! Nur ab 18 Jahren!
Missueberweisungen
Nimm mich durch mein Schadz!
Postbank Ueberweisungen
Sie haben WM Tickets gewonnen!
Treibs mit einer schlampe!
Uberweisungen
Ueberweisung an einen falschen Adressanten
Umsonst mein Arschficken ab 18 Jahren!
Warum schicken sie mir Geld?
Weltmeisterschaft!
WM Tickets!

Message text is typically displayed as a GIF file with the words chosen from:

More: http://www.sophos.com/virusinfo/analyses/w32zasrand.html

Type Trojan

Aliases Trojan-Downloader.Win32.Harnig.bg
Downloader-AVS
Win32/TrojanDownloader.Small.CKJ

Troj/Harnig-AA is a downloader Trojan for the Windows platform.

Troj/Harnig-AA includes functionality to access the internet and communicate with a remote server via HTTP.

http://www.sophos.com/virusinfo/analyses/trojharnigaa.html

Type Trojan

Aliases Win32/TrojanDownloader.Zlob.OR
Trojan-Downloader.Win32.Zlob.pz

Troj/Zlob-LB is a Trojan for the Windows platform.

The Trojan pretends to be an installer for an application called "DigiKeygen 2.10", but installs Troj/Zlob-LA files instead of those of the expected application.

Troj/Zlob-LB provides an uninstall option which can be accessed via the Add or Remove Programs dialog in the Windows Control Panel. The software is listed as "DigiKeygen 2.10". However this does not uninstall the Trojan.

http://www.sophos.com/virusinfo/analyses/trojzloblb.html

Type Spyware Trojan

Aliases Trojan-Spy.Win32.Banker.anv
Infostealer.Bancos!gen

Troj/Banker-BNZ is a password stealing Trojan for the Windows platform.

Troj/Banker-BNZ includes functionality to send notification messages to remote locations.

http://www.sophos.com/virusinfo/analyses/trojbankerbnz.html

Type Trojan

Aliases Trojan-Spy.Win32.Delf.dq

Troj/AdClick-CL is a Trojan for the Windows platform.

When Troj/AdClick-CL is installed the creates several html files in the Windows temp folder. The Trojan will also modify the HOSTS file.

http://www.sophos.com/virusinfo/analyses/trojadclickcl.html

Type Trojan

Aliases Trojan-Spy.Win32.BZub.w

Troj/Cimuz-AL is a Trojan for the Windows platform.

Under certain circumstances Troj/Cimuz-AL may attempt to delete the operating system and Program File folders.

http://www.sophos.com/virusinfo/analyses/trojcimuzal.html

Type Spyware Trojan

Aliases Trojan-PSW.Win32.Sinowal.v

Troj/Torpig-AY is an information stealing Trojan for the Windows platform.

Troj/Torpig-AY has the functionalities to:

- steal email account and password details
- communicate with a remote server via HTTP

http://www.sophos.com/virusinfo/analyses/trojtorpigay.html

Type Spyware Trojan

Aliases Trojan-Spy.Win32.Delf.pd
PWS-Banker.gen.i

Troj/Mesoto-C is a Trojan for the Windows platform.

Troj/Mesoto-C attempts to steal passwords and user information related to Microsoft MSN Messenger, and may send stolen information to a remote user via email.

Troj/Mesoto-C may display a fake MSN screen to encourage users to enter their details.

http://www.sophos.com/virusinfo/analyses/trojmesotoc.html