Spyware, viruses, & security forum: VIRUS \ Spyware ALERTS - July 31, 2008

Type Trojan

SubType Exploit

Overview -

This detection is for Javascript malware that maybe hosted on a website, with an intention to serve further malware to users visiting the site.



Aliases
JS/Redirector.A [Norman] JS/Redirector.E [NOD32v2] JS_REDIRECTOR.M [TrendMicro] Trojan.JS.Redirector.C [BitDefender] Trojan.JS.Redirector.e [Kaspersky] Trojan.Redirect.10 [DrWeb]
Characteristics
Characteristics -

When a user visits a site which hosts this malicious java script, the script could execute to perform any of the following:

Redirect users to other sites Display pop-ups Download additional malware

http://vil.mcafeesecurity.com/vil/content/v_144753.htm

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojfakealedp.html

Category Viruses and Spyware

Type Worm

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/w32sohanabd.html

Category Viruses and Spyware

Type Trojan

Troj/PDFJs-A is a PDF that contains a malicious JavaScript.

http://www.sophos.com/security/analyses/viruses-and-spyware/trojpdfjsa.html

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojbanloafo.html

Category Suspicious behavior and files

Type Suspicious behavior

What's been detected Sus/Behav-277 exhibits characteristics commonly, but not exclusively, found in malware.

Sus/Behav-277 contains code characteristic of malware.

http://www.sophos.com/security/analyses/suspicious-behavior-and-files/susbehav277.html

Type Trojan

SubType Generic Worm

Overview -

This threat is a generic detection for the W32/YahLover.worm which are packaged with AutoIT. Please view the W32/YahLover.worm VIL for more specific information about this threat.

http://vil.mcafeesecurity.com/vil/content/v_148419.htm

Malware type: Trojan

Malware Overview

This Trojan may be downloaded from remote sites by other malware. It may be dropped by other malware. It may be downloaded unknowingly by a user when visiting malicious Web sites.

It creates folders and drops a file detected by Trend Micro as TROJ_RENOS.ACQ.

It creates a registry key and a registry entry as part of its installation routine

http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=TROJ%5FFAKEAV%2EBH

Category Viruses and Spyware

Type Trojan

Troj/FakeAV-AW is a Trojan for the Windows platform.

Troj/FakeAV-AW includes functionality to access the internet and communicate with a remote server via HTTP.

When Troj/FakeAV-AW is installed the following files are created:

<User>\Application Data\Microsoft\Internet Explorer\Quick Launch\Antivirus-2008pro.lnk
<Desktop>\antivirus-2008pro.lnk
<Program Files>\Antivirus 2008 PRO\zlib.dll
<Program Files>\Antivirus 2008 PRO\vscan.tsi
<Program Files>\Antivirus 2008 PRO\antivirus-2008pro.exe
<User>\Start Menu\Programs\Antivirus 2008 PRO\antivirus-2008pro.lnk

The files zlib.dll and vscan.tsi may be deleted.

The following registry entry is set to automatically run the Trojan:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\
antivirus-2008pro.exe
<Program Files>\Antivirus 2008 PRO\antivirus-2008pro.exe

http://www.sophos.com/security/analyses/viruses-and-spyware/trojfakeavaw.html?_log_from=rss

Aliases Downloader-UA.h

Category Viruses and Spyware

Type Trojan

Troj/Wimad-E is a Windows Media Video file that uses features of Windows Digital Rights Management (DRM) to trigger visit to a web page that will attempt to download files related to software that delivers internet adverts (adware).


http://www.sophos.com/security/analyses/viruses-and-spyware/trojwimade.html?_log_from=rss

Category Viruses and Spyware

Type Worm

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/w32autorungy.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Troj/FakeAle-DQ is part of a multi-component Trojan that displays fraudulent security alerts.

The Trojan contains functionality to disable legitimate security applications.

Troj/FakeAle-DQ is installed to <System>\drivers\beep.sys, replacing the legitimate system file of this name.

The following files are created:

<Windows>\buritos.exe
<Windows>\karina.net
<System>\buritos.exe
<System>\karina.net

Files files burito.exe are detected as Troj/Renos-AX. The files karina.net are detected as Mal/EncPk-BB.

The following registry entry is created in order to load karina.dat automatically:

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
AppInit_DLLs
<System>\karina.dat


http://www.sophos.com/security/analyses/viruses-and-spyware/trojfakealedq.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Troj/Alpha-H is a Trojan for the Windows platform.

When Troj/Alpha-H is installed the following files are created:

<Windows>\inform.dat
<System>\ritz8.dll
<System>\xd.txt

The following registry entry is created to run ritz8.dll on startup:

HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{9988775D-4368-4857-871A-D01D66CA3A71}
StubPath
rundll32 ritz8.dll,InitO

The file ritz8.dll is registered as a COM object and Browser Helper Object (BHO) for Microsoft Internet Explorer, creating registry entries under:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{930247B4-16BE-48d2-87DD-86D7FB314639}
HKCR\CLSID\{930247B4-16BE-48d2-87DD-86D7FB314639}

More: http://www.sophos.com/security/analyses/viruses-and-spyware/trojalphah.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojagenthij.html?_log_from=rss

Category Suspicious behavior and files

Type Suspicious behavior

What's been detected Sus/Behav-192 exhibits characteristics commonly, but not exclusively, found in malware.


Sus/Behav-192 contains code characteristic of malware.


http://www.sophos.com/security/analyses/suspicious-behavior-and-files/susbehav192.html