Spyware, viruses, & security forum: VIRUS \ Spyware ALERTS - April 28, 2008

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojdloadrbld.html

Category Viruses and Spyware

Type Trojan

Troj/DwnLdc-Gen is a downloader Trojan for the Windows platform.

http://www.sophos.com/security/analyses/viruses-and-spyware/trojdwnldcgen.html

Type: Email-Worm

Category: Malware

Summary
Email-Worm.Win32.Agent.ev arrives on systems as an e-mail attachment and attempts to download additional components onto the system if executed.

http://www.f-secure.com/v-descs/email-worm_w32_agent_ev.shtml

Category Viruses and Spyware

Type Trojan

Troj/Inja-Gen is a Trojan for the Windows platform. Troj/Inja-Gen includes functionality to inject code into other processes.

http://www.sophos.com/security/analyses/viruses-and-spyware/trojinjagen.html

April 28th, 2008 by JM Hipolito
Our friends from RSA have recently reported about the latest one-two punch employed by the infamous Rock Phish gang (also reported here and here ). Best known for their easy-to-use kits that yield professional looking phishing pages, Rock Phish now adds information-stealing malware dubbed as the Zeus Trojan in its arsenal.

This attack is reminiscent of the Bank of America phishing attack, which we reported several days ago, wherein users are prompted to install a digital certificate in order to access the banks online login page. Incidentally, the phishing page was also Rock Phish.

And apparently there were more: Trend Micro Advanced Threats Researcher Paul Ferguson and the TrendLabs Content Security team came across a couple of malicious certificates detected as TSPY_PAPRAS.AC and TSPY_PAPRAS.AD. These spyware each target the Comerica and Colonial banks, respectively.

More: http://blog.trendmicro.com/

Aliases Trojan.Win32.KillAV.jr

Category Viruses and Spyware

Type Worm

W32/KillAv-EO is a worm for the Windows platform.

The following registry entry is created to run W32/KillAv-EO on startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Svcs: Dnscache
<pathname of the worm executable>

The following registry entry is set:

HKCU\Software\Microsoft\Internet Explorer\InformationBar
FirstTime
0

http://www.sophos.com/security/analyses/viruses-and-spyware/w32killaveo.html?_log_from=rss

Category Viruses and Spyware

Type Virus

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/w32cekarf.html?_log_from=rss

Aliases Backdoor.Win32.Sinowal.br

Category Viruses and Spyware

Type Trojan

Troj/Torpig-BZ is a Trojan for the Windows platform.

When Troj/Torpig-BZ is installed it creates the following files:

<Temp>\2.tmp (empty file)
<Temp>\1.tmp (also detected as Troj/Torpig-BZ )

http://www.sophos.com/security/analyses/viruses-and-spyware/trojtorpigbz.html?_log_from=rss

Category Viruses and Spyware

Type Virus

http://www.sophos.com/security/analyses/viruses-and-spyware/simvir.html?_log_from=rss

Category Viruses and Spyware

Type Malicious Behavior

Mal/Behav-208 is a malicious program for the Windows platform.

Detection for members of Mal/Behav-208 is behavior based.

http://www.sophos.com/security/analyses/viruses-and-spyware/malbehav208.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Troj/Dloadr-BLE is a downloader Trojan for the Windows platform.

Troj/Dloadr-BLE includes functionality to access the internet and communicate with a remote server via HTTP.

When Troj/Dloadr-BLE is installed the following files are created:

<Temp>\DogKiller.sys (detected as Troj/NTRootK-DG)
<System>\systemInfomations.ini (a text file which may safely be deleted)

http://www.sophos.com/security/analyses/viruses-and-spyware/trojdloadrble.html

Category Viruses and Spyware

Type Malicious Behavior

Mal/Mdrop-B is a Trojan which drops more files and may attempt to terminate security related processes.

http://www.sophos.com/security/analyses/viruses-and-spyware/malmdropb.html

Category Suspicious behavior and files

Type Suspicious behavior

What's been detected Sus/Mdrop-C exhibits characteristics commonly, but not exclusively, found in malware.

Sus/Mdrop-C has characteristics common to Trojans which drop more files and may attempt to terminate security related processes.

http://www.sophos.com/security/analyses/suspicious-behavior-and-files/susmdropc.html

Category Viruses and Spyware

Type Trojan

Troj/Mdrop-BSB drops the file <Windows>\<Random number>.dll which is detected as Mal/LineDLL-B.

http://www.sophos.com/security/analyses/viruses-and-spyware/trojmdropbsb.html