Spyware, viruses, & security forum: VIRUS \ Spyware ALERTS - October 17, 2008

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojagenthxv.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojpwsaul.html?_log_from=rss

Category Viruses and Spyware

Type Worm

W32/HostInf-A is a worm with IRC backdoor functionality for the Windows platform.

W32/HostInf-A modifies the infected computers hosts file.

W32/HostInf-A runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over
the computer via IRC channels.

When first run W32/HostInf-A copies itself to <System>\<temp name>.exe.

http://www.sophos.com/security/analyses/viruses-and-spyware/w32hostinfa.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojagenthxx.html?_log_from=rss

Category Adware or PUA

Type Unspecified PUA

PlayMp3 is a potentially unwanted application that attempts to perform downloads.

http://www.sophos.com/security/analyses/adware-and-puas/playmp3.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/jspsymekh.html?_log_from=rss

Category Viruses and Spyware

Type Trojan


Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojkeygencn.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojfakevirgm.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojagenthxz.html?_log_from=rss

Category Adware or PUA

Type Unspecified PUA

App/CoupBar-A is a potentially unwanted application.

When the application is installed the following files are created:

<Windows>\CBBasis.xml
<Windows>\CBVersion.txt
<Windows>\CouponBarIE.dll
<Windows>\cpbrkpie.ocx
<Windows>\UccSpecB.sys

The files CouponBarIE.dll and cpbrkpie.ocx are registered as COM objects, creating registry entries under:

http://www.sophos.com/security/analyses/adware-and-puas/couponbar.html?_log_from=rss

Name : Worm:W32/AutoRun.NOI
Detection Names : Worm.Win32.AutoRun.noi

Aliases : W32/Autorun-jl (Sophos)
Generic.dx trojan (McAfee)
WORM_AUTORUN.RC (Trend Micro)
W32.SillyFDC (Symantec)
Worm:Win32/Emold.C (Microsoft)

Type: Worm
Category: Malware

Summary
AutoRun worm.

Additional Details
Worm.Win32.AutoRun.noi creates a copy of itself as the following:


C:\Program Files\Microsoft Common\wuauclt.exe

It creates the following registry key:


HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe
Debugger = "%ProgramFiles%\Microsoft Common\wuauclt.exe


Note: The key is created for automatic execution when explorer.exe is launched.

http://www.f-secure.com/v-descs/worm_w32_autorun_noi.shtml

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojjsadclid.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojfakeavev.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Troj/Dloadr-BVY is a Trojan for the Windows platform.

Troj/Dloadr-BVY includes functionality to access the internet and communicate with a remote server via HTTP.

When Troj/Dloadr-BVY is installed it creates the file <Temp>\wewt0.bat.

Registry entries are created under:

HKCU\Software\Applications
HKCR\multimediaControls.chl\CLSID

http://www.sophos.com/security/analyses/viruses-and-spyware/trojdloadrbvy.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojbankerenu.html?_log_from=rss