[copy-n-paste from sophos.com]

Name   W32/Mytob-BY

Type  
    * Worm

How it spreads  
    * Email attachments

Affected operating systems  
    * Windows

Side effects  
    * Turns off anti-virus applications
    * Allows others to access the computer
    * Sends itself to email addresses found on the infected computer
    * Forges the sender's email address

Aliases  
    * Net-Worm.Win32.Mytob.bi
    * WORM_MYTOB.GN

Prevalence (1-5) 2

Description
W32/Mytob-BY is a mass-mailing worm and IRC backdoor Trojan.

W32/Mytob-BY can spread by sending itself as an email attachment to 
email addresses it harvests from the infected computer, either as an 
attachment with a double-extension or as a zip file containing a file 
with a double-extension. W32/Mytob-BY avoids sending emails to addresses 
containing certain strings in them.

W32/Mytob-BY processes the emails it has harvested by splitting them 
into name and domain. Once it has sent itself to the emails it has 
harvested, it uses a predefined list of names with the harvested 
domains. W32/Mytob-BY spoofs the sender, sending emails as if from one 
of the following at the same domain as the recipient:

support
administrator
mail
service
admin
info
register
webmaster

For example if sending itself to name{at}example.com, W32/Mytob-BY might 
send the email as if from admin{at}example.com.

Emails sent by the worm have characteristics from the following:

Subject line:
Your password has been updated
Your password has been successfully updated
You have successfully updated your password
Your new account password is approved
Your Account is Suspended
*DETECTED* Online User Violation
Your Account is Suspended For Security Reasons
Warning Message: Your services near to be closed.
Important Notification
Members Support
Security measures
Email Account Suspension
Notice of account limitation


Message text - a formatted version of one of the following:
Dear user ,

You have successfully updated the password of your  
account.

If you did not authorize this change or if you need assistance with your 
account, please contact  customer service at: 


Thank you for using !
The  Support Team 

+++ Attachment: No Virus (Clean)
+++  Antivirus - www.

Dear user ,

It has come to our attention that your  User Profile 
( x ) records are out of date. For further details see the attached 
document.

Thank you for using !
The  Support Team

+++ Attachment: No Virus (Clean)
+++  Antivirus - www.

Dear  Member,

We have temporarily suspended your email account .

This might be due to either of the following reasons:

1. A recent change in your personal information (i.e. change of address).
2. Submiting invalid information during the initial sign up process.
3. An innability to accurately verify your selected option of 
 subscription due to an internal error within our processors.
See the details to reactivate your  account.

Sincerely,The  Support Team

+++ Attachment: No Virus (Clean)
+++  Antivirus - www.

Dear  Member,

Your e-mail account was used to send a huge amount of unsolicited spam 
messages during the recent week. If you could please take 5-10 minutes 
out of your online experience and confirm the attached document so you 
will not run into any future problems with the online service.

If you choose to ignore our request, you leave us no choice but to 
cancel your membership.

Virtually yours,
The  Support Team

+++ Attachment: No Virus found
+++  Antivirus - www.

Attachment name:
updated-password
email-password
new-password
password
approved-password
account-password
accepted-password
important-details
account-details
email-details
account-info
document
readme
account-report

First extension (of attachment or of file inside zip):
doc
htm
txt

Second extension (of attachment or of file inside zip):
pif
scr
exe
cmd
bat

If the attachment is a zip file it will have the same base name as the 
double-extension file inside.

Example attachment names include document.txt.pif and 
information.doc.cmd, usually with a large number of spaces between the 
extensions.

Advanced
W32/Mytob-BY is a mass-mailing worm and IRC backdoor Trojan.

W32/Mytob-BY runs continuously in the background, providing a backdoor 
server which allows a remote intruder to gain access and control over 
the computer via IRC channels, including the ability to download and 
execute files on the infected computer.

W32/Mytob-BY can spread by sending itself as an email attachment to 
email addresses it harvests from the infected computer, either as an 
attachment with a double-extension or as a zip file containing a file 
with a double-extension. W32/Mytob-BY avoids sending emails to addresses 
containing certain strings in them.

W32/Mytob-BY processes the emails it has harvested by splitting them 
into name and domain. Once it has sent itself to the emails it has 
harvested, it uses a predefined list of names with the harvested domains. 
W32/Mytob-BY spoofs the sender, sending emails as if from one of the 
following at the same domain as the recipient:

support
administrator
mail
service
admin
info
register
webmaster

For example if sending itself to name{at}example.com, W32/Mytob-BY might 
send the email as if from admin{at}example.com.

Emails sent by the worm have characteristics from the following:

Subject line:
Your password has been updated
Your password has been successfully updated
You have successfully updated your password
Your new account password is approved
Your Account is Suspended
*DETECTED* Online User Violation
Your Account is Suspended For Security Reasons
Warning Message: Your services near to be closed.
Important Notification
Members Support
Security measures
Email Account Suspension
Notice of account limitation


Message text - a formatted version of one of the following:
Dear user ,

You have successfully updated the password of your  
account.

If you did not authorize this change or if you need assistance with your 
account, please contact  customer service at: 


Thank you for using !
The  Support Team 

+++ Attachment: No Virus (Clean)
+++  Antivirus - www.

Dear user ,

It has come to our attention that your  User Profile 
( x ) records are out of date. For further details see the attached 
document.

Thank you for using !
The  Support Team

+++ Attachment: No Virus (Clean)
+++  Antivirus - www.

Dear  Member,

We have temporarily suspended your email account .

This might be due to either of the following reasons:

1. A recent change in your personal information (i.e. change of address).
2. Submiting invalid information during the initial sign up process.
3. An innability to accurately verify your selected option of 
 subscription due to an internal error within our processors.
See the details to reactivate your  account.

Sincerely,The  Support Team

+++ Attachment: No Virus (Clean)
+++  Antivirus - www.

Dear  Member,

Your e-mail account was used to send a huge amount of unsolicited spam 
messages during the recent week. If you could please take 5-10 minutes 
out of your online experience and confirm the attached document so you 
will not run into any future problems with the online service.

If you choose to ignore our request, you leave us no choice but to 
cancel your membership.

Virtually yours,
The  Support Team

+++ Attachment: No Virus found
+++  Antivirus - www.

Attachment name:
updated-password
email-password
new-password
password
approved-password
account-password
accepted-password
important-details
account-details
email-details
account-info
document
readme
account-report

First extension (of attachment or of file inside zip):
doc
htm
txt

Second extension (of attachment or of file inside zip):
pif
scr
exe
cmd
bat

If the attachment is a zip file it will have the same base name as the 
double-extension file inside.

Example attachment names include document.txt.pif and 
information.doc.cmd, usually with a large number of spaces between the 
extensions.

W32/Mytob-BY copies itself to the Window system folder with the filename 
nibie.exe or skybotx.exe and sets the following registry entries to run 
itself on system startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
WINDOWS SYSTEM =


HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices\
WINDOWS SYSTEM =


W32/Mytob-BY sets the following registry entries, disabling the 
automatic startup of other software:

HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess
Start
4

W32/Mytob-BY attempts to terminate a large number of processes related 
to security and anti-virus programs including REGEDIT.EXE, MSCONFIG.EXE 
and NETSTAT.EXE.

W32/Mytob-BY modifies the Windows hosts file in order to block access to 
the following security-related websites:

127.0.0.1 www.symantec.com
127.0.0.1 securityresponse.symantec.com
127.0.0.1 symantec.com
127.0.0.1 www.sophos.com
127.0.0.1 sophos.com
127.0.0.1 www.mcafee.com
127.0.0.1 mcafee.com
127.0.0.1 liveupdate.symantecliveupdate.com
127.0.0.1 www.viruslist.com
127.0.0.1 viruslist.com
127.0.0.1 viruslist.com
127.0.0.1 f-secure.com
127.0.0.1 www.f-secure.com
127.0.0.1 kaspersky.com
127.0.0.1 kaspersky-labs.com
127.0.0.1 www.avp.com
127.0.0.1 www.kaspersky.com
127.0.0.1 avp.com
127.0.0.1 www.networkassociates.com
127.0.0.1 networkassociates.com
127.0.0.1 www.ca.com
127.0.0.1 ca.com
127.0.0.1 mast.mcafee.com
127.0.0.1 my-etrust.com
127.0.0.1 www.my-etrust.com
127.0.0.1 download.mcafee.com
127.0.0.1 dispatch.mcafee.com
127.0.0.1 secure.nai.com
127.0.0.1 nai.com
127.0.0.1 www.nai.com
127.0.0.1 update.symantec.com
127.0.0.1 updates.symantec.com
127.0.0.1 us.mcafee.com
127.0.0.1 liveupdate.symantec.com
127.0.0.1 customer.symantec.com
127.0.0.1 rads.mcafee.com
127.0.0.1 trendmicro.com
127.0.0.1 pandasoftware.com
127.0.0.1 www.pandasoftware.com
127.0.0.1 www.trendmicro.com
127.0.0.1 www.grisoft.com
127.0.0.1 www.microsoft.com
127.0.0.1 microsoft.com
127.0.0.1 www.virustotal.com
127.0.0.1 virustotal.com
127.0.0.1 www.amazon.com
127.0.0.1 www.amazon.co.uk
127.0.0.1 www.amazon.ca
127.0.0.1 www.amazon.fr
127.0.0.1 www.paypal.com
127.0.0.1 paypal.com
127.0.0.1 moneybookers.com
127.0.0.1 www.moneybookers.com
127.0.0.1 www.ebay.com
127.0.0.1 ebay.com





Name   Troj/BagleDl-R

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Turns off anti-virus applications
    * Modifies data on the computer
    * Downloads code from the internet
    * Installs itself in the Registry

Aliases  
    * Email-Worm.Win32.Bagle.bq

Prevalence (1-5) 2

Description
Troj/BagleDl-R is a downloader Trojan which will download, install and 
run new software without notification that it is doing so.

Troj/BagleDl-R includes functionality to:

- inject its code into EXPLORER.EXE
- modify the HOSTS file
- disable other software, including anti-virus, firewall and security 
  related applications

Troj/BagleDl-R then attempts to download files from remote websites and 
run them.

Troj/BagleDl-R may also run MSPAINT.EXE in an attempt to obfuscate 
itself.

Advanced
Troj/BagleDl-R is a downloader Trojan which will download, install and 
run new software without notification that it is doing so.

Troj/BagleDl-R includes functionality to:

- inject its code into EXPLORER.EXE
- modify the HOSTS file
- disable other software, including anti-virus, firewall and security 
  related applications

When first run Troj/BagleDl-R copies itself to \winshost.exe and 
creates the file \wiwshost.exe. The file
\wiwshost.exe is 
also detected by Sophos as Troj/BagleDl-R.

The following registry entries are created to run winshost.exe on 
startup:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
winshost.exe
\winshost.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
winshost.exe
\winshost.exe

Registry entries are set as follows:

HKLM\SYSTEM\CurrentControlSet\Services\Alerter
Start
00000004

HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess
Start
00000004

HKLM\SYSTEM\CurrentControlSet\Services\wuauserv
Start
00000004

Troj/BagleDl-R creates a new version of the HOSTS file. The new HOSTS 
file will typically contain the following:

127.0.0.1 localhost

Troj/BagleDl-R also attempts to modify or delete the following registry 
entries:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Symantec NetDriver Monitor

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
ccApp

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
NAV CfgWiz

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
SSC_UserPrompt

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
McAfee Guardian

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
McAfee.InstantUpdate.Monitor

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
APVXDWIN

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
KAV50

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
avg7_cc

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
avg7_emc

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Zone Labs Client

HKLM\SOFTWARE\Symantec

HKLM\SOFTWARE\McAfee

HKLM\SOFTWARE\KasperskyLab

HKLM\SOFTWARE\Agnitum

HKLM\SOFTWARE\Panda Software

HKLM\SOFTWARE\Zone Labs

Troj/BagleDl-R then attempts to download files from remote websites and 
run them.

Troj/BagleDl-R may also run MSPAINT.EXE in an attempt to obfuscate 
itself.





Name   W32/Sdbot-AYF

Type  
    * Worm

How it spreads  
    * Network shares

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Modifies data on the computer
    * Deletes files off the computer
    * Steals information
    * Drops more malware

Prevalence (1-5) 2

Description
W32/Sdbot-AYF is a network worm with backdoor Trojan functionality for 
the Windows platform.

The worm spreads through network shares protected by weak passwords, 
MS-SQL servers and through various operating system vulnerabilities.

W32/Sdbot-AYF connects to a predetermined IRC channel and awaits further 
commands from remote users.

Patches for the vulnerabilities exploited by W32/Sdbot-AYF can be 
obtained from Microsoft at:

MS02-039
MS04-011
MS04-012

Advanced
W32/Sdbot-AYF is a network worm with backdoor Trojan functionality for 
the Windows platform.

When first run, W32/Sdbot-AYF copies itself to the Windows system folder 
as WinAwk.exe, drops a driver file named rdriv.sys and creates the 
following registry entries:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
WinAwk
"WinAwk.exe"

HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_RDRIV
[several entries]

HKLM\SYSTEM\CurrentControlSet\Services\rdriv
[several entries]

HKLM\SYSTEM\CurrentControlSet\Control
WaitToKillServiceTimeout
"7000"

The rdriv.sys file dropped by W32/Sdbot-AYF is detected by Sophos's 
anti-virus products as Troj/Rootkit-X.

The worm spreads through network shares protected by weak passwords, 
MS-SQL servers and through various operating system vulnerabilities.

W32/Sdbot-AYF connects to a predetermined IRC channel and awaits further 
commands from remote users. The backdoor component of W32/Sdbot-AYF can 
be instructed to perform the following functions:

scan networks for vulnerabilities
download/execute arbitrary files
start an ftp server

Patches for the vulnerabilities exploited by W32/Sdbot-AYF can be 
obtained from Microsoft at:

MS02-039
MS04-011
MS04-012





Name   W32/Traxg-B

Type  
    * Worm

How it spreads  
    * Email messages

Affected operating systems  
    * Windows

Side effects  
    * Sends itself to email addresses found on the infected computer
    * Modifies data on the computer
    * Installs itself in the Registry

Aliases  
    * WORM_VB.F

Prevalence (1-5) 2

Description
W32/Traxg-B is a worm that attempts to spread using Microsoft Outlook.

W32/Traxg-B may create the file C:\folder.htt. This file may be deleted.

Advanced
W32/Traxg-B is a worm that attempts to spread using Microsoft Outlook.

W32/Traxg-B copies itself to several locations using randomly generated 
filenames and creates the following registry entry in order to run on 
Windows startup:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\TempCom

W32/Traxg-B may set the following registry entries in order to modify 
the behaviour of Windows Explorer:

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\
Hidden = 0

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\
HideFileExt = 1

W32/Traxg-B may create the file c:\folder.htt. This file may be deleted.





Name   Troj/Insor-B

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Downloads code from the internet
    * Installs itself in the Registry

Aliases  
    * Trojan-Dropper.Win32.Small.aay
    * Downloader-ACG

Prevalence (1-5) 2

Description
Troj/Insor-B is a downloader and proxy Trojan.

When run the Trojan drops iedld32.dll into the Windows system folder and 
loads it.

Troj/Insor-B can be given a command to download and run an executable or 
provide a proxy connection on a random port.

Advanced
Troj/Insor-B is a downloader and proxy Trojan.

When run the Trojan drops iedld32.dll into the Windows system folder and 
loads it.

When there is an active internet connection Troj/Insor-B notifies a 
remote server that it is active and waits for a command.

Troj/Insor-B can be given a command to download and run an executable or 
provide a proxy connection on a random port.

Troj/Insor-B will create the following registry entries so as to 
auto-load:

HKCR\CLSID\(114C670C-C510-4F49-B431-4B812F50BA7B)\InprocServer32
(default)
"\iedld32.dll"





Name   Troj/Zlob-K

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Downloads code from the internet
    * Installs itself in the Registry

Aliases  
    * Trojan-Downloader.Win32.Zlob.s
    * Downloader-XC
    * Trojan.Zlob.B

Prevalence (1-5) 2

Description
Troj/Zlob-K is a downloader Trojan.

Troj/Zlob-K will contact predefined remote sites and download data. The 
Trojan may then download further executable files and run them.

Advanced
Troj/Zlob-K is a downloader Trojan.

Troj/Zlob-K will contact predefined remote sites and download data. The 
Trojan may then download further executable files and run them.

In order to run automatically each time Explorer initializes, 
Troj/Zlob-K will set the following registry entry:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
notepad.exe
msmsgs.exe

In order to run automatically each time a user logs in, Troj/Zlob-K will 
add MSMSGS.EXE to the following registry entry:

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Shell

Troj/Zlob-K will attempt to hide its activity by injecting code into
EXPLORER.EXE.





Name   W32/Kelvir-CB

Type  
    * Worm

How it spreads  
    * Chat programs

Affected operating systems  
    * Windows

Aliases  
    * IM-Worm.Win32.Kelvir.cb

Prevalence (1-5) 2

Description
W32/Kelvir-CB is an instant messaging worm for the Windows platform.

Advanced
W32/Kelvir-CB is an instant messaging worm for the Windows platform.

W32/Kelvir-CB monitors the status of all Windows Messenger contacts and 
sends the following text to all online contacts:

Doesnt this kind of look like you?
http://[DOMAIN REMOVED]/pics.php?id=345&pic=4565.jpg

At the time of writing, the link referenced in the message text was 
unavailable.





Name   Troj/Multidr-DQ

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Drops more malware
    * Leaves non-infected files on computer

Prevalence (1-5) 2

Description
Troj/Multidr-DQ is a Trojan for the Windows platform.

Troj/Multidr-DQ drops several files and then runs them. The dropped 
files are detected by Sophos's anti-virus products as Troj/Prorat-19 or 
Troj/Bckdr-CKA.

Advanced
Troj/Multidr-DQ is a Trojan for the Windows platform.

When run, Troj/Multidr-DQ drops the following files and then runs them:

\Windows\ktd32.atm
\Windows\plugin1.dat
\Windows\services.exe
\Windows\system\sservice.exe
\Windows\system32\fservice.exe
\Windows\system32\lncom_.exe
\Windows\system32\reginv.dll
\Windows\system32\winkey.dll
\Windows\transliator.exe

The dropped files are detected by Sophos's anti-virus products as 
Troj/Prorat-19 (services.exe, sservice.exe, fservice.exe, reginv.dll and 
winkey.dll) or Troj/Bckdr-CKA (lncom_.exe and transliator.exe). The 
ktd32.atm and plugin1.dat files are harmless data files and may be 
safely deleted.





Name   W32/Codbot-AG

Type  
    * Worm

How it spreads  
    * Network shares
    * Web downloads

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Modifies data on the computer
    * Deletes files off the computer
    * Steals information
    * Downloads code from the internet

Aliases  
    * WORM_SDBOT.BLH
    * Backdoor.Win32.Codbot.ag
    * W32.Toxbot

Prevalence (1-5) 2

Description
W32/Codbot-AG is a network worm with backdoor functionality for the 
Windows platform.

W32/Codbot-AG can spread to remote network shares protected by weak 
passwords and to computers vulnerable to common exploits, including the 
RPC-DCOM, LSASS and MSSQL vulnerabilities.

W32/Codbot-AG can be controlled by a remote attacker via the IRC 
network. The attacker can issue commands to download and run further 
malicious code, steal passwords and system information and sniff packets 
from the local network.

Advanced
W32/Codbot-AG is a network worm with backdoor functionality for the 
Windows platform.

W32/Codbot-AG can spread to remote network shares protected by weak 
passwords and to computers vulnerable to common exploits, including the 
RPC-DCOM, LSASS and MSSQL vulnerabilities. The following patches for the 
operating system vulnerabilities exploited by W32/Codbot-AG can be 
obtained from the Microsoft website:

MS02-039
MS04-011
MS04-012

W32/Codbot-AG can be controlled by a remote attacker via the IRC network. 
The attacker can issue commands to download and run further malicious 
code, steal passwords and system information and sniff packets from the 
local network.

W32/Codbot-AG copies itself to the Windows system folder with the 
filename dhcpclient.exe.

On NT-based versions of Windows (NT,2000,XP) the worm registers itself 
as a service process named Ulead Service with a displayname of DHCP 
Client and a start-type of automatic so that the worm is run on computer 
login. Registry entries are created under:

HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_DHCP_CLIENT


HKLM\SYSTEM\CurrentControlSet\Services\DHCP Client


W32/Codbot-AG also creates the following registry entries in order to 
run as a service process in safe mode:

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\DHCP Client
(default)
Service

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\DHCP Client
(default)
Service





Name   Troj/Banker-DV

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Steals credit card details
    * Steals information
    * Reduces system security
    * Records keystrokes
    * Installs itself in the Registry

Aliases  
    * Trojan-Spy.Win32.Banker.cv

Prevalence (1-5) 2

Description
Troj/Banker-DV is a password-stealing Trojan targeted at customers of 
Brazilian banks.

Troj/Banker-DV may display a fake error message containing the following 
text:

Erro de aplicativo
Aplicativo nao inicializado corretamente (0xc0000005). Clique em OK para 
finalizar a execucao

Advanced
Troj/Banker-DV is a password-stealing Trojan targeted at customers of 
Brazilian banks.

Troj/Banker-DV will monitor a user's internet access. When certain 
internet banking sites are visited, the Trojan will display a fake login 
screen in order to trick the user into inputting their details.

Troj/Banker-DV will then send the stolen details to a remote location.

Troj/Banker-DV may display a fake error message containing the following 
text:

Erro de aplicativo
Aplicativo nao inicializado corretamente (0xc0000005). Clique em OK para 
finalizar a execucao

When first run, Troj/Banker-DV will copy itself to \winlogin.exe
In order to run automatically each time a user logs in, Troj/Banker-DV 
will set the following registry entry:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Windows Update
\winlogin.exe





Name   Troj/Psyme-CA

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Downloads code from the internet
    * Exploits system or software vulnerabilities

Aliases  
    * Trojan-Downloader.VBS.Psyme.q
    * VBS/Psyme
    * CHM_PSYME.AG

Prevalence (1-5) 2

Description
Troj/Psyme-CA is an HTML-based script which exploits the XMLHTTP and 
ADODB Stream vulnerabilities associated with Microsoft Internet Explorer 
to download and run an executable file.

Advanced
Troj/Psyme-CA is an HTML-based script which exploits the XMLHTTP and 
ADODB Stream vulnerabilities associated with Microsoft Internet Explorer 
to download and run an executable file.

On Windows 98 the Trojan will save the downloaded file to C:\qwe.exe, on 
Windows 2000 the file will be downloaded to C:\Documents and 
Settings\All Users\Start Menu\Programs\Startup\qwe.exe, and under 
Windows 95, ME, NT, and XP the file will be downloaded and saved over 
Windows Media Player if it exists at any of the following locations:

C:\Programmer\Windows Media Player\wmplayer.exe
C:\Program\Windows Media Player\wmplayer.exe
C:\Programme\Windows Media Player\wmplayer.exe
C:\Programmi\Windows Media Player\wmplayer.exe
C:\Programfiler\Windows Media Player\wmplayer.exe
C:\Programas\Windows Media Player\wmplayer.exe
C:\Programa1s\Windows Media Player\wmplayer.exe
C:\Archivos de programa\Windows Media Player\wmplayer.exe
C:\Program Files\Windows Media Player\wmplayer.exe





Name   W32/Rbot-AGP

Type  
    * Worm

How it spreads  
    * Network shares

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Drops more malware
    * Downloads code from the internet
    * Reduces system security
    * Records keystrokes
    * Installs itself in the Registry

Aliases  
    * Backdoor.Win32.IRCBot.cj
    * W32/Sdbot.worm.gen.bj

Prevalence (1-5) 2

Description
W32/Rbot-AGP is a worm with backdoor functionality for the Windows 
platform that spreads to other network computers by exploiting a number 
of known vulnerabilities and by copying itself to network shares 
protected by weak passwords.

Advanced
W32/Rbot-AGP is a worm with backdoor functionality for the Windows 
platform that spreads to other network computers by exploiting a number 
of known vulnerabilities and by copying itself to network shares 
protected by weak passwords.

W32/Rbot-AGP runs continuously in the background, providing a backdoor 
server which allows a remote intruder to gain access and control over 
the computer via IRC channels.

W32/Rbot-AGP includes functionality to access the internet and 
communicate with a remote server via HTTP.

Once executed W32/Rbot-AGP moves itself to the file \scrnsaver.scr, and in order to be able to run automatically when 
Windows starts up sets the following registry entries:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Screen Saver
scrnsaver.scr

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
Screen Saver
scrnsaver.scr

When W32/Rbot-AGP is installed it creates the file \svkp.sys which is a legitimate driver for NT based systems.

The file SVKP.sys is registered as a new system driver service named 
"SVKP", with a display name of "SVKP" and a startup
type of automatic, 
so that it is started automatically during system startup. Registry 
entries are created under:

HKLM\SYSTEM\CurrentControlSet\Services\SVKP\





Name   Troj/Bancb-Fam

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Steals credit card details
    * Turns off anti-virus applications
    * Steals information
    * Uses its own emailing engine
    * Records keystrokes
    * Installs itself in the Registry

Prevalence (1-5) 2

Description
Troj/Bancb-Fam detects members of the Bancban family of Trojans. Members 
of this family typically attempt to steal confidential information when 
a user visits banking-related websites.

Advanced
Troj/Bancb-Fam detects members of the Bancban family of Trojans. Members 
of this family typically attempt to steal confidential information when 
a user visits banking-related websites.

Trojans of this family typically monitor URLs entered into Internet 
Explorer. When certain websites are visited, the Trojan may display a 
fake user interface in order to trick the user into entering 
confidential details. Stolen information is sent by email to a remote 
user.

Typically a registry entry is created in order to run the Trojan on 
system startup:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run







Name   W32/Rbot-AGQ

Type  
    * Worm

Prevalence (1-5) 2

Description
W32/Rbot-AGQ is a worm and IRC backdoor Trojan for the Windows platform.

W32/Rbot-AGQ spreads by copying itself to network shares protected by 
weak passwords.

W32/Rbot-AGQ runs continuously in the background, providing a backdoor 
server which allows a remote intruder to gain access and control over 
the computer via IRC channels.

W32/Rbot-AGQ includes functionality to:

- steal confidential information
- carry out DDoS flooder attacks
- silently download, install and run new software, including updates of 
  its software

Advanced
W32/Rbot-AGQ is a worm and IRC backdoor Trojan for the Windows platform.

W32/Rbot-AGQ spreads by copying itself to network shares protected by 
weak passwords.

W32/Rbot-AGQ runs continuously in the background, providing a backdoor 
server which allows a remote intruder to gain access and control over 
the computer via IRC channels.

W32/Rbot-AGQ includes functionality to:

- steal confidential information
- carry out DDoS flooder attacks
- silently download, install and run new software, including updates of 
  its software

When first run W32/Rbot-AGQ copies itself to \syscfg.exe.

The following registry entries are created to run syscfg.exe on startup:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
System Support
syscfg.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
System Support
syscfg.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
System Support
syscfg.exe





Name   W32/Codbot-Gen

Type  
    * Worm

How it spreads  
    * Network shares

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Steals information
    * Installs itself in the Registry

Prevalence (1-5) 2

Description
Sophos Anti-Virus products detect members of the W32/Codbot family of 
worms as W32/Codbot-Gen.

Worms detected as W32/Codbot-Gen provide backdoor Trojan functionality 
to a remote attacker via IRC channels. Such worms may spread to remote 
network shares with weak passwords in response to a command from a 
remote attacker.

Members of W32/Codbot family typically attempt to exploit 
vulnerabilities, such as the LSASS vulnerability (MS04-011).

Advanced
Sophos Anti-Virus products detect members of the W32/Codbot family of 
worms as W32/Codbot-Gen.

Worms detected as W32/Codbot-Gen provide backdoor Trojan functionality 
to a remote attacker via IRC channels. Such worms may spread to remote 
network shares with weak passwords in response to a command from a 
remote attacker.

Members of W32/Codbot family may copy themselves to the Windows system 
folder and create entries in the following registry entries to run 
themselves when the user logs on:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal

This backdoor functionality typically includes the ability to sniff 
packets, download further malicious code and steal passwords and other 
system information.

W32/Codbot worms may register themselves as service processes.

Members of W32/Codbot family typically attempt to exploit 
vulnerabilities, such as the LSASS vulnerability (MS04-011).





Name   W32/Mytob-CT

Type  
    * Worm

How it spreads  
    * Email attachments

Affected operating systems  
    * Windows

Side effects  
    * Turns off anti-virus applications
    * Allows others to access the computer
    * Sends itself to email addresses found on the infected computer
    * Forges the sender's email address

Aliases  
    * Net-Worm.Win32.Mytob.gen

Prevalence (1-5) 2

Description
W32/Mytob-CT is a mass-mailing worm and IRC backdoor Trojan.

W32/Mytob-CT can spread by sending itself as an email attachment to 
email addresses it harvests from the infected computer, either as an 
attachment with a double-extension or as a zip file containing a file 
with a double-extension. W32/Mytob-CT avoids sending emails to addresses 
containing certain strings in them.

W32/Mytob-CT processes the emails it has harvested by splitting them 
into name and domain. Once it has sent itself to the emails it has 
harvested, it uses a predefined list of names with the harvested 
domains. W32/Mytob-CT spoofs the sender, sending emails as if from one 
of the following at the same domain as the recipient:

support
administrator
mail
service
admin
info
register
webmaster

For example if sending itself to name{at}example.com, W32/Mytob-CT might 
send the email as if from admin{at}example.com.

Emails sent by the worm have characteristics from the following:

Subject line:

Notice: **Last Warning**
*DETECTED* Online User Violation
Your Email Account is Suspended For Security Reasons
Account Alert
Important Notification
*WARNING* Your Email Account Will Be Closed
Security measures
Email Account Suspension
Notice of account limitation

Message body - one of the following or a garbled message:

Once you have completed the form in the attached file , your account 
records will not be interrupted and will continue as normal.

The original message has been included as an attachment.

We regret to inform you that your account has been suspended due to the 
violation of our site policy, more info is attached.

We attached some important information regarding your account.

Please read the attached document and follow it's instructions.

Attachment name:

email-info
email-doc
information
account-details
document
INFO
instructions
info-text
information

First extension (of attachment or of file inside zip):

doc
htm
txt

Second extension (of attachment or of file inside zip):

pif
scr
exe
cmd
bat

If the attachment is a zip file it will have the same base name as the 
double-extension file inside.

Example attachment names include document.txt.pif and 
information.doc.cmd, usually with a large number of spaces between the 
extensions.

Advanced
W32/Mytob-CT is a mass-mailing worm and IRC backdoor Trojan.

W32/Mytob-CT runs continuously in the background, providing a backdoor 
server which allows a remote intruder to gain access and control over 
the computer via IRC channels, including the ability to download and 
execute files on the infected computer.

W32/Mytob-CT can spread by sending itself as an email attachment to 
email addresses it harvests from the infected computer, either as an 
attachment with a double-extension or as a zip file containing a file 
with a double-extension. W32/Mytob-CT avoids sending emails to addresses 
containing certain strings in them.

W32/Mytob-CT processes the emails it has harvested by splitting them 
into name and domain. Once it has sent itself to the emails it has 
harvested, it uses a predefined list of names with the harvested 
domains. W32/Mytob-CT spoofs the sender, sending emails as if from one 
of the following at the same domain as the recipient:

support
administrator
mail
service
admin
info
register
webmaster

For example if sending itself to name{at}example.com, W32/Mytob-CT might 
send the email as if from admin{at}example.com.

Emails sent by the worm have characteristics from the following:

Subject line:

Notice: **Last Warning**
*DETECTED* Online User Violation
Your Email Account is Suspended For Security Reasons
Account Alert
Important Notification
*WARNING* Your Email Account Will Be Closed
Security measures
Email Account Suspension
Notice of account limitation

Message body - one of the following or a garbled message:

Once you have completed the form in the attached file , your account 
records will not be interrupted and will continue as normal.

The original message has been included as an attachment.

We regret to inform you that your account has been suspended due to the 
violation of our site policy, more info is attached.

We attached some important information regarding your account.

Please read the attached document and follow it's instructions.

Attachment name:

email-info
email-doc
information
account-details
document
INFO
instructions
info-text
information

First extension (of attachment or of file inside zip):

doc
htm
txt

Second extension (of attachment or of file inside zip):

pif
scr
exe
cmd
bat

If the attachment is a zip file it will have the same base name as the 
double-extension file inside.

Example attachment names include document.txt.pif and 
information.doc.cmd, usually with a large number of spaces between the 
extensions.

W32/Mytob-CT copies itself to the Window system folder with the filename 
"Lien Vande Kelder.exe" and sets the following registry entries to run 
itself on system startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
http://www.lienvandekelder.be =
"Lien Vande Kelder.exe"

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices\
http://www.lienvandekelder.be =
"Lien Vande Kelder.exe"

W32/Mytob-CT sets the following registry entries, disabling the 
automatic startup of other software:

HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess
Start
4

W32/Mytob-CT attempts to terminate a large number of processes related 
to security and anti-virus programs including REGEDIT.EXE, MSCONFIG.EXE 
and NETSTAT.EXE.

W32/Mytob-CT modifies the Windows hosts file in order to block access to 
the following security-related websites:

127.0.0.1 www.symantec.com
127.0.0.1 securityresponse.symantec.com
127.0.0.1 symantec.com
127.0.0.1 www.sophos.com
127.0.0.1 sophos.com
127.0.0.1 www.mcafee.com
127.0.0.1 mcafee.com
127.0.0.1 liveupdate.symantecliveupdate.com
127.0.0.1 www.viruslist.com
127.0.0.1 viruslist.com
127.0.0.1 f-secure.com
127.0.0.1 www.f-secure.com
127.0.0.1 easydedicated.com
127.0.0.1 www.easydedicated.com
127.0.0.1 easydedicated.net
127.0.0.1 www.easydedicated.net
127.0.0.1 kaspersky.com
127.0.0.1 kaspersky-labs.com
127.0.0.1 www.avp.com
127.0.0.1 www.kaspersky.com
127.0.0.1 avp.com
127.0.0.1 www.networkassociates.com
127.0.0.1 networkassociates.com
127.0.0.1 www.ca.com
127.0.0.1 ca.com
127.0.0.1 mast.mcafee.com
127.0.0.1 my-etrust.com
127.0.0.1 www.my-etrust.com
127.0.0.1 download.mcafee.com
127.0.0.1 dispatch.mcafee.com
127.0.0.1 secure.nai.com
127.0.0.1 nai.com
127.0.0.1 www.nai.com
127.0.0.1 update.symantec.com
127.0.0.1 updates.symantec.com
127.0.0.1 us.mcafee.com
127.0.0.1 liveupdate.symantec.com
127.0.0.1 customer.symantec.com
127.0.0.1 rads.mcafee.com
127.0.0.1 trendmicro.com
127.0.0.1 www.trendmicro.com
127.0.0.1 www.grisoft.com
127.0.0.1 www.microsoft.com
127.0.0.1 microsoft.com
127.0.0.1 www.virustotal.com
127.0.0.1 virustotal.com





Name   W32/Rbot-AGT

Type  
    * Worm

How it spreads  
    * Network shares

Affected operating systems  
    * Windows

Side effects  
    * Turns off anti-virus applications
    * Allows others to access the computer
    * Modifies data on the computer
    * Deletes files off the computer
    * Steals information

Prevalence (1-5) 2

Description
W32/Rbot-AGT is a network worm with backdoor functionality for the 
Windows platform.

W32/Rbot-AGT spreads using a variety of techniques including exploiting 
weak passwords on computers and SQL servers, exploiting operating system 
vulnerabilities (including DCOM-RPC, LSASS and WKS) and using backdoors 
opened by other worms or Trojans.

W32/Rbot-AGT can be controlled by a remote attacker over IRC channels.

Advanced
W32/Rbot-AGT is a network worm with backdoor functionality for the 
Windows platform.

The worm copies itself to a file named scrsave.scr in the Windows system 
folder and creates the following registry entries:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
MS Screen Saver
scrsave.scr

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
MS Screen Saver
scrsave.scr

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
MS Screen Saver
scrsave.scr

W32/Rbot-AGT spreads using a variety of techniques including exploiting 
weak passwords on computers and SQL servers, exploiting operating system 
vulnerabilities (including DCOM-RPC, LSASS and WKS) and using backdoors 
opened by other worms or Trojans.

W32/Rbot-AGT can be controlled by a remote attacker over IRC channels. 
The backdoor component of W32/Rbot-AGT can be instructed by a remote 
user to perform the following functions:

start an FTP server
start a Proxy server
start a web server
take part in distributed denial of service (DDoS) attacks
log keypresses
capture screen/webcam images
packet sniffing
port scanning
download/execute arbitrary files
start a remote shell (RLOGIN)
steal product registration information from certain software

Patches for the operating system vulnerabilities exploited by 
W32/Rbot-AGT can be obtained from Microsoft at:

MS01-059
MS03-007
MS03-049
MS04-011
MS04-012





Name   W32/Rbot-AGI

Type  
    * Worm

How it spreads  
    * Network shares

Affected operating systems  
    * Windows

Side effects  
    * Turns off anti-virus applications
    * Allows others to access the computer
    * Steals information
    * Reduces system security
    * Records keystrokes
    * Installs itself in the Registry

Aliases  
    * Backdoor.Win32.Agobot.xb

Prevalence (1-5) 2

Description
W32/Rbot-AGI is a worm and IRC backdoor Trojan for the Windows platform.

W32/Rbot-AGI runs continuously in the background, providing a backdoor 
server which allows a remote intruder to gain access and control over 
the computer via IRC channels.

W32/Rbot-AGI can spread to remote network shares protected by weak 
passwords and to computers vulnerable to common exploits, including 
LSASS (MS04-011). For a patch for this vulnerability, see:

MS04-011

Advanced
W32/Rbot-AGI is a worm and IRC backdoor Trojan for the Windows platform.

W32/Rbot-AGI runs continuously in the background, providing a backdoor 
server which allows a remote intruder to gain access and control over 
the computer via IRC channels.

W32/Rbot-AGI can spread to remote network shares protected by weak 
passwords and to computers vulnerable to common exploits, including 
LSASS (MS04-011). For a patch for this vulnerability, see:

MS04-011

W32/Rbot-AGI copies itself to the Windows system folder with a random 
filename and sets the following registry entries in order to run 
automatically on computer login:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Win Secure Update


HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
Win Secure Update






Name   Troj/Banker-EB

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Steals credit card details
    * Steals information

Aliases  
    * Trojan-Downloader.Win32.Small.ayu

Prevalence (1-5) 2

Description
Troj/Banker-EB is a password stealing Trojan for the Windows platform.

Troj/Banker-EB collects data sent to banking sites in Internet Explorer 
sessions.

Advanced
Troj/Banker-EB is a password stealing Trojan for the Windows platform.

Troj/Banker-EB collects data sent to banking sites in Internet Explorer 
sessions.

Troj/Banker-EB may set several registry entries under
HKCR\CLSID\(e3175614-f331-f31a-53ed-fdd682644311).





Name   Troj/ByteVeri-M

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Downloads code from the internet
    * Exploits system or software vulnerabilities

Aliases  
    * Exploit-ByteVerify
    * JAVA_BYTEVER.Q
    * Trojan.Java.ClassLoader.ai

Prevalence (1-5) 2

Description
Troj/ByteVeri-M is a Java Applet that exploits a vulnerability in the 
Byte Code Verify component of the Microsoft VM to download and run an 
executable file.

Advanced
Troj/ByteVeri-M is a Java Applet that exploits a vulnerability in the 
Byte Code Verify component of the Microsoft VM to download and run an 
executable file.

Troj/ByteVeri-M arrives by browsing websites whose pages contain applets 
that use the Troj/ByteVeri-M class.

For more information about this exploit see the Microsoft Security 
Bulletin MS03-011.





Name   Troj/GrayBird-M

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Modifies data on the computer
    * Steals information
    * Drops more malware
    * Downloads code from the internet
    * Reduces system security

Prevalence (1-5) 2

Description
Troj/GrayBird-M is a Trojan for the Windows platform.

The Trojan opens a backdoor allowing remote intruders access to the 
infected computer. Troj/GrayBird-M may also attempt to download and 
execute files from a remote site.

Advanced
Troj/GrayBird-M is a Trojan for the Windows platform.

The Trojan opens a backdoor allowing remote intruders access to the 
infected computer. Troj/GrayBird-M may also attempt to download and 
execute files from a remote site.

When run, Troj/GrayBird-M copies itself to the Windows folder as 
yak_tw.exe and drops a file as yak_tw.dll to the same location. The 
Trojan registers itself as a service process with the display name "yak 
tw" and sets registry entries under the following:

HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_YAK_TW
HKLM\SYSTEM\ControlSet001\Services\yak tw

 
--- MultiMail/Win32 v0.43