[cut-n-paste from sophos.com]

Name   W32/Sdbot-SW

Type  
    * Worm

How it spreads  
    * Network shares

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Downloads code from the internet
    * Reduces system security
    * Installs itself in the Registry
    * Exploits system or software vulnerabilities

Prevalence (1-5) 2

Description
W32/Sdbot-SW is a worm which attempts to spread to remote network shares. 
It also contains backdoor Trojan functionality, allowing unauthorised 
remote access to the infected computer via IRC channels while running in 
the background as a service process.

Advanced
W32/Sdbot-SW is a worm which attempts to spread to remote network shares. 
It also contains backdoor Trojan functionality, allowing unauthorised 
remote access to the infected computer via IRC channels while running in 
the background as a service process.

W32/Sdbot-SW drops two files to the folder C:\WinNT\system32. One is 
dropped as HB90HGF3.EXE and is detected as W32/Sdbot-SW, the other is 
dropped as SYSEDITS.EXE and is a corrupt file that will not run.

The file dropped as HB90HGF3.EXE copies itself to APPNV.EXE in the 
Windows system folder and creates entries in the registry at the 
following locations to run this copy on system startup:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

W32/Sdbot-SW spreads to network shares with weak passwords and via 
network security exploits as a result of the backdoor Trojan element 
receiving the appropriate command from a remote user, spreading by 
copying the file NVAPPSW.EXE from the Windows system folder (which 
should be the original W32/Sdbot-SW dropper file) to the remote machine.





Name   Troj/BeastDo-W

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Steals information
    * Installs itself in the Registry

Prevalence (1-5) 2

Description
Troj/BeastDo-W is a backdoor Trojan for the Windows platform that 
creates several hidden threads within other processes which allow 
unauthorised remote access to the computer over a network.

Advanced
Troj/BeastDo-W is a backdoor Trojan for the Windows platform that 
creates several hidden threads within other processes which allow 
unauthorised remote access to the computer over a network.

Troj/BeastDo-W moves itself to the Windows folder with the filename 
svchost.exe and copies itself to the Windows system and msagent folders 
with the filenames xxxxxx.pif and yyyyyy.pif where x and y is a random 
character.

In order to be able to run automatically when Windows starts up 
Troj/BeastDo-W sets the registry entries:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\
COM Service
"yyyyyy.pif"

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\
COM Service
"yyyyyy.pif"

where yyyyyy.pif is a Trojan copy from the Windows msagent folder.

HKLM\SOFTWARE\Microsoft\Active Setup\Installed
Components\{42CE4021-DE03-E3CC-EA32-40BB12E6015D}\
StubPath
"xxxxxx.pif"

where xxxxxx.pif is a Trojan copy from the Windows system folder.

Also Troj/BeastDo-W creates a data file in the Windows system folder 
with the filename msnat.gtx which is not viral and may be safely 
deleted.





Name   Troj/Agent-FO

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Downloads code from the internet
    * Installs itself in the Registry

Aliases  
    * Trojan-Downloader.Win32.Agent.fo

Prevalence (1-5) 2

Description
Troj/Agent-FO is a Trojan for the Windows platform.

Troj/Agent-FO attempts to download files.

Troj/Agent-FO may attempt to terminate various security related 
applications.

Advanced
Troj/Agent-FO is a Trojan for the Windows platform.

When executed the Trojan copies itself to a randomly named folder in the 
Windows system folder and creates a randomly named entry in the registry 
at the following location pointing at this file in order that it may be 
run on startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\

Troj/Agent-FO then attempts to download files.

Troj/Agent-FO may attempt to terminate various security related 
applications.





Name   Troj/Chum-A

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Reduces system security
    * Installs itself in the Registry

Aliases  
    * BackDoor-AZV.gen

Prevalence (1-5) 2

Description
Troj/Chum-A is a backdoor Trojan that uses the IRC network to allow an 
attacker to access the infected computer.

Troj/Chum-A copies itself to the Windows system folder with the filename 
mspmspv.exe.

Advanced
Troj/Chum-A is a backdoor Trojan that uses the IRC network to allow an 
attacker to access the infected computer.

Troj/Chum-A copies itself to the Windows system folder with the filename 
mspmspv.exe and sets the following registry entries so that the Trojan 
is run when a user logs on to Windows:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
LangSupportEx
mspmspv.exe

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
LangSupportEx
mspmspv.exe





Name   Troj/Bancban-AV

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Steals credit card details
    * Steals information

Aliases  
    * Trojan-Spy.Win32.Banker.fo

Prevalence (1-5) 2

Description
Troj/Bancban-AV is a Trojan for the Windows platform that steals 
confidential information such as online banking details and sends it to 
a preconfigured email address.

When executed Troj/Bancban-AV copies itself to the Windows system folder 
with the filename install.scr and establishes a background process that 
monitors user internet activity.

Troj/Bancban-AV displays fake screen shots of a Brazilian banking 
website in an attempt to trick a user into entering their login details.





Name   W32/Leebad-B

Type  
    * Worm

How it spreads  
    * Network shares

Affected operating systems  
    * Windows

Aliases  
    * Worm.Win32.Leebad.c
    * W32/Sautor.worm
    * BKDR_SMALL.AE

Prevalence (1-5) 2

Description
W32/Leebad-B is a worm for the Windows platform that propagates through 
the available network shares with the filename system32.exe.

Advanced
W32/Leebad-B is a network worm for the Windows platform that targets 
open network shares.

When executed W32/Leebad-B copies itself to the root folder with the 
filename system32.exe, creates admin.bat batch script file and 
autorun.inf file that runs the worm copy on the open share. Admin.bat 
script contains commands that add a current user to the local 
administrators group.





Name   W32/Dedler-H

Type  
    * Worm

How it spreads  
    * Network shares

Affected operating systems  
    * Windows

Side effects  
    * Modifies data on the computer

Aliases  
    * Worm.Win32.Dedler
    * Win32/Dedler.A
    * WORM_ICQ.A

Prevalence (1-5) 2

Description
W32/Dedler-H is a worm for the Windows platform that attempts to spread 
using ICQ functionality.

Advanced
W32/Dedler-H is a worm for the Windows platform that attempts to spread 
using ICQ functionality.

The autorun component may arrive with the filename xxx.exe and is used 
by the main component of the Trojan to run automatically.





Name   W32/Forbot-DH

Type  
    * Worm

How it spreads  
    * Network shares

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Reduces system security
    * Installs itself in the Registry
    * Exploits system or software vulnerabilities

Aliases  
    * Backdoor.Win32.Wootbot.gen

Prevalence (1-5) 2

Description
W32/Forbot-DH is an IRC backdoor and network worm for the Windows 
platform.

Once installed, W32/Forbot-DH connects to a preconfigured IRC server and 
joins a channel from which an attacker can issue further commands. These 
commands can cause the infected machine to perform any of the following 
actions:

start an HTTP server
start an FTP server
portscan randomly-chosen IP addresses
execute arbitrary commands
steal information such as passwords and product keys
upload/download files

The worm can spread to unpatched computers affected by the LSASS 
vulnerability (see MS04-011), through backdoors left open by the 
Troj/Optix family of Trojans and to poorly protected network shares.

Advanced
W32/Forbot-DH is an IRC backdoor and network worm for the Windows 
platform.

In order to run automatically when Windows starts up the worm moves 
itself to the Windows system folder as scvvhost.exe and creates the 
following registry entries:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
Microsoft Windows Update
scvvhost.exe

HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce\
Microsoft Windows Update
scvvhost.exe

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\
Microsoft Windows Update
scvvhost.exe

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\
Microsoft Windows Update
scvvhost.exe

HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce\
Microsoft Windows Update
scvvhost.exe

W32/Forbot-DH also creates its own service named "Microsoft Update", 
with the display name "Microsoft Windows Update".

 
--- MultiMail/Win32 v0.43