Spyware, viruses, & security forum: VIRUS \ Spyware ALERTS - October 9, 2008

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojfakeaven.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojbdooraol.html?_log_from=rss

Category Viruses and Spyware

Type Worm

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/w32autorunlf.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojagenthwg.html?_log_from=rss

Discovered: October 9, 2008
Updated: October 9, 2008 11:31:49 AM
Type: Trojan, Virus

Packed.Generic.190 is a heuristic detection for files that may have been obfuscated or encrypted in order to conceal them from antivirus software.

http://www.symantec.com/business/security_response/writeup.jsp?docid=2008-100911-1708-99

Category Viruses and Spyware

Type Trojan

Troj/Pushdo-X is a Trojan for the Windows platform.

When Troj/Pushdo-X is installed it creates the file <System>\drivers\ati7xbxx.sys, which is detected as Troj/Pushu-Gen.

The file ati7xbxx.sys is registered as a new system driver service named "ati7xbxx". Registry entries are created under:

HKLM\SYSTEM\CurrentControlSet\Services\ati7xbxx
HKLM\SYSTEM\CurrentControlSet\SafeBoot\Minimal\ati7xbxx.sys
HKLM\SYSTEM\CurrentControlSet\SafeBoot\Network\ati7xbxx.sys
HKLM\SYSTEM\ControlSet002\Services\ati7xbxx

http://www.sophos.com/security/analyses/viruses-and-spyware/trojpushdox.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojiframebb.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojagenthwn.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Troj/Agent-HWL is a Trojan for the Windows platform.

When first run Troj/Agent-HWL copies itself to <System>\qq.exe and creates the file <Root>\bot.txt.

The file QQ.exe is registered as a new system driver service named "windows XP", with a display name of "windows XP" and a startup type of automatic, so that it is started automatically during system startup. Registry entries are created under:

HKLM\SYSTEM\CurrentControlSet\Services\windows XP

http://www.sophos.com/security/analyses/viruses-and-spyware/trojagenthwl.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojagenthwj.html?_log_from=rss

Category Adware or PUA

Type Adware

Adzgalore is an adware plugin for Microsoft Internet Explorer.

When the application is installed the following files are created:

<System>\cont_adzgalore-remove.exe
<System>\nsxB.dll

The file nsxB.dll is registered as a COM object and Browser Helper Object (BHO) for Microsoft Internet Explorer, creating registry entries under:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{d22a17ff-9f1f-6cd5-74e4-64d841b2339b}
HKCR\CLSID\{d22a17ff-9f1f-6cd5-74e4-64d841b2339b}

Registry entries are created under:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\cont_adzgalore

Adzgalore provides an uninstall option which can be accessed via the Add or Remove Programs dialog in the Windows Control Panel. The software is listed as "Contextual Tool Adzgalore".

http://www.sophos.com/security/analyses/adware-and-puas/adzgalore.html?_log_from=rss

Discovered: October 9, 2008
Updated: October 9, 2008 6:41:07 PM
Type: Virus

W32.Bluven is a worm that infects all document files on the compromised computer and attempts to spread through removable devices.

http://www.symantec.com/business/security_response/writeup.jsp?docid=2008-100917-1214-99