[cut-n-paste from sophos.com]

Name   W32/Bagle-CO

Type  
    * Worm

How it spreads  
    * Email attachments
    * Peer-to-peer

Affected operating systems  
    * Windows

Side effects  
    * Sends itself to email addresses found on the infected computer
    * Forges the sender's email address
    * Downloads code from the internet
    * Installs itself in the Registry

Aliases  
    * Email-Worm.Win32.Bagle.ae
    * W32/Bagle.gen{at}MM
    * Worm.Bagle.Gen-dll
    * WORM_Bagle.GEN
    * W32/Sality

Prevalence (1-5) 3

Description
W32/Bagle-CO is a worm for the Windows platform.

W32/Bagle-CO spreads via file sharing on P2P networks and via email.

Messages sent by the worm have the following characteristics:

From: an address found on the infected computer

Subject: one of

Will You Be My Valentine?
Love you with all my heart!
See you tonight!
Come Be With Me, my Love!
My dream is coming true!

Message text:
The instruction "Click to attachment to load a movie" followed by 
several lines of poetry, with a heart as the background image

Attachment name: one of
love_me.exe
love_me_now.exe
mplay.exe

Advanced
W32/Bagle-CO is a worm for the Windows platform.

W32/Bagle-CO spreads via file sharing on P2P networks and via email.

W32/Bagle-CO sends itself to email addresses found on the infected 
computer. Emails sent by the worm have the following characteristics:

From: an address found on the infected computer

Subject: one of

Will You Be My Valentine?
Love you with all my heart!
See you tonight!
Come Be With Me, my Love!
My dream is coming true!

Message text:
The instruction "Click to attachment to load a movie" followed by 
several lines of poetry, with a heart as the background image

Attachment name: one of
love_me.exe
love_me_now.exe
mplay.exe

W32/Bagle-CO runs continuously in the background, providing a 
backdoor server which allows a remote intruder to gain access and 
control over the computer.

W32/Bagle-CO includes functionality to access the internet and 
communicate with a remote server via HTTP.

When first run W32/Bagle-CO copies itself to the following filenames 
in any folders containing the letters "shar":

Adobe Photoshop 9 full.exe
Ahead Nero 10.exe
anna benson sex video.exe
barrett jackson nude photos, movies, porn video.exe
Britney Spears sex photos.exe
IE beta 7.exe
jenna elfman sex anal deepthroat
kate beckinsale nude pictures.exe
miss america Porno, sex, oral, anal cool, awesome!!.exe
paris hilton Porno pics arhive, xxx.exe
Porno Screensaver.scr
Serials 2005 database.exe
Serials.txt.exe
Windown Vista Beta Leak.exe
Windows Sourcecode update.doc.exe
XXX hardcore images.exe

W32/Bagle-CO copies itself to the file lmovie.exe in the Windows 
system folder and creates following registry entry to run itself on 
startup:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
MovieM
\lmovie.exe

W32/Bagle-CO creates the file vcaults32.exe in the Windows folder. 
This file (also detected as W32/Bagle-CO) attempts to download and 
execute files from preconfigured URLs.

When first run, W32/Bagle-CO displays the following fake error message:

Title: Error!
Message: Can't find a viewer associated with the file.





Name   Troj/Cimuz-U

Type  
    * Spyware Trojan

Affected operating systems  
    * Windows

Side effects  
    * Steals information
    * Downloads code from the internet
    * Installs itself in the Registry
    * Leaves non-infected files on computer

Aliases  
    * Trojan-PSW.Win32.Agent.eo

Prevalence (1-5) 2

Description
Troj/Cimuz-U is a password stealing Trojan for the Windows platform.

Advanced
Troj/Cimuz-U is a password stealing Trojan for the Windows platform.

Once installed Troj/Cimuz-U attempts to harvest passwords from the 
infected computer.

When Troj/Cimuz-U is installed the following files are created:

\msnscps.dll - detected as Troj/Cimuz-U
\text.txt - this file may be safely deleted

The file msnscps.dll is registered as a COM object and Browser Helper 
Object (BHO) for Microsoft Internet Explorer, creating registry 
entries under:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\
Explorer\Browser Helper Objects\(random CLSID)

HKCR\CLSID\(random CLSID)

The following registry entries are set, affecting internet security:

HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\
FirewallPolicy\

HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\

HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\

HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\List\

HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\
List\\Internet Explorer
IEXPLORE.EXE
\Internet Explorer\IEXPLORE.EXE:*:Enabled:Internet 
Explorer

The following registry entry is set:

HKCU\Software\Microsoft\Internet Explorer\Main
Enable Browser Extensions
yes





Name   W32/Sality-I

Type  
    * Virus

How it spreads  
    * Infected files

Affected operating systems  
    * Windows

Side effects  
    * Steals information
    * Records keystrokes

Aliases  
    * W32/Sality.n

Prevalence (1-5) 2

Description
W32/Sality-I is a prepending virus that also acts as a keylogger.

W32/Sality-I has been seen using an infected copy of W32/Bagle-CK to 
spread via email.

Advanced
W32/Sality-I is a prepending virus that also acts as a keylogger.

W32/Sality-I drops a file \wmimgr32.dll, also detected as 
W32/Sality-I, which it uses to log keystrokes to certain windows, as 
well as information about the infected computer. This logged data is 
periodically sent by email to a remote website.

W32/Sality-I has been seen using an infected copy of W32/Bagle-CK to 
spread via email.





Name   Troj/Teros-A

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Downloads code from the internet

Prevalence (1-5) 2

Description
Troj/Teros-A is a Trojan for the Windows platform.

When executed Troj/Teros-A attempts to download, install and run new 
software.

At the time of writing, Troj/Teros-A is being spammed aggressively in 
emails with messages such as the following:

Subject: New act of terrorism in London

Message Body:

Today the Scotland Yard has informed new act of terrorism in London.
Look details in an applied file.

Advanced
Troj/Teros-A is a Trojan for the Windows platform.

When executed Troj/Teros-A attempts to download, install and run new 
software. Should these downloads be succesful, the following files 
will be created:

\svclocal.exe
\svclocal2.exe

At the time of writing, these downloaded files are samples of 
Troj/Flecsip-B and Troj/QHosts-S.

At the time of writing, Troj/Teros-A is being spammed aggressively in 
emails with messages such as the following:

Subject: New act of terrorism in London

Message Body:

Today the Scotland Yard has informed new act of terrorism in London.
Look details in an applied file.





Name   Troj/Haxdoor-AT

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Drops more malware
    * Installs itself in the Registry

Aliases  
    * Trojan-Dropper.Win32.Microjoin.aj
    * MultiDropper-PO

Prevalence (1-5) 2

Description
Troj/Haxdoor-AT is a backdoor Trojan for the Windows platform.

The Trojan drops a stealthing component detected as Troj/Haxdor-Gen.

The Trojan may arrive in a CAB file also containing a configuration 
file detected as Troj/Iyus-G.

Advanced
Troj/Haxdoor-AT is a backdoor Trojan for the Windows platform.

When Troj/Haxdoor-AT is installed the following files are created:

\server.exe
\.bat
\refresh.html
\kednl6.sys

The file kednl6.sys is a stealthing component detected as 
Troj/Haxdor-Gen. The BAT file is used to delete the original Trojan 
file. The file refresh.html is a harmless HTML file.

The Trojan may arrive in a CAB file also containing a configuration 
file detected as Troj/Iyus-G.

The file kednl6.sys is registered as a new system driver service 
named "kednl6", with a display name of "AVSearch
service". Registry 
entries are created under:

HKLM\SYSTEM\CurrentControlSet\Services\kednl6\





Name    Troj/Spammit-A

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Reduces system security
    * Installs itself in the Registry

Aliases  
    * Backdoor.Win32.Agent.tk

Prevalence (1-5) 2

Description
Troj/Spammit-A is a backdoor Trojan which allows an infected computer 
to send
emails as specified by a remote intruder.

Advanced
Troj/Spammit-A is a backdoor Trojan which allows an infected computer 
to send
emails as specified by a remote intruder.

The following registry entry is created to run Troj/Spammit-A on 
startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Anti-Virus Update Scheduler


The following registry entries are set, affecting internet security:

HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\ 
Parameters\FirewallPolicy
DomainProfile\AuthorizedApplications\List

C:\NvRun\:*:Enabled:Server

HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\ 
Parameters\FirewallPolicy
StandardProfile\AuthorizedApplications\List

C:\NvRun\:*:Enabled:Server





Name   Troj/Bancban-OE

Type  
    * Spyware Trojan

Affected operating systems  
    * Windows

Side effects  
    * Steals information
    * Records keystrokes
    * Installs itself in the Registry

Prevalence (1-5) 2

Description
Troj/Bancban-OE is an information stealing Trojan for the Windows 
platform.

Troj/Bancban-OE includes functionality to send notification messages 
to remote locations.

Troj/Bancban-OE monitors a user's internet activity and steals 
information entered into certain banking websites. The stolen 
information is emailed to a remote address.

Advanced
Troj/Bancban-OE is an information stealing Trojan for the Windows 
platform.

Troj/Bancban-OE includes functionality to send notification messages 
to remote locations.

Troj/Bancban-OE monitors a user's internet activity and steals 
information entered into certain banking websites. The stolen 
information is emailed to a remote address.

When first run Troj/Bancban-OE copies itself to:

\winzip32.exe
\winzip32.exe

The following registry entry is created to run winzip32.exe on startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
winzip32
\winzip32.exe





Name   Troj/BagleDl-BI

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Downloads code from the internet
    * Installs itself in the Registry

Prevalence (1-5) 2

Description
Troj/BagleDl-BI is a downloader and backdoor Trojan for the Windows 
platform.

Troj/BagleDl-BI runs continuously in the background, providing a 
backdoor server which allows a remote intruder to gain access and 
control over the computer.

Troj/BagleDl-BI includes functionality to access the internet and 
communicate with a remote server via HTTP.

Advanced
Troj/BagleDl-BI is a downloader and backdoor Trojan for the Windows 
platform.

Troj/BagleDl-BI runs continuously in the background, providing a 
backdoor server which allows a remote intruder to gain access and 
control over the computer.

Troj/BagleDl-BI includes functionality to access the internet and 
communicate with a remote server via HTTP.

When first run Troj/BagleDl-BI copies itself to \wintems.exe.

The following registry entry is created to run wintems.exe on startup:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
german.exe
\wintems.exe

Troj/BagleDl-BI sets the following registry entries, disabling the 
automatic
startup of other software:

HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess
Start
4

Note: disabling autostart for the SharedAccess service deactivates 
the Microsoft
Internet Connection Firewall (ICF).

Registry entries are created under:

HKCU\Software\DateTime4\





Name   Troj/Dloadr-LM

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Downloads code from the internet

Aliases  
    * Trojan-Downloader.Win32.VB.ws

Prevalence (1-5) 2

Description
Troj/Dloadr-LM is a Trojan for the Windows platform.

Troj/Dloadr-LM has the functionality to silently download, install 
and run new
software.





Name   Troj/Hookie-B

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Drops more malware

Prevalence (1-5) 2

Description
Troj/Hookie-B is a Trojan used to created worms for the Windows 
platform.
Worms created by Troj/Hookie-B are detected by Sophos's anti-virus 
products as W32/Hookie-A.

Advanced
Troj/Hookie-B is a Trojan used to created worms for the Windows 
platform.
Worms created by Troj/Hookie-B are detected by Sophos's anti-virus 
products as W32/Hookie-A.

Troj/Hookie-B creates and registers as a COM server a file named 
actskn4.ocx in the Windows system folder. Actiskn4.ocx is not 
malicious.





Name   OSX/Leap-A

Type  
    * Worm

How it spreads  
    * Chat programs

Affected operating systems  
    * Macintosh

Side effects  
    * Deletes files off the computer
    * Leaves non-infected files on computer

Aliases  
    * CME-4
    * MacOS/Leap
    * MacOS/Leap!tgz
    * OSX.Leap.A
    * OSX/Leap

Prevalence (1-5) 2

Description
OSX/Leap-A is an instant-messaging worm for the Mac OS X platform.

The worm attempts to spread via the iChat instant messaging system, 
sending itself to available contacts on the infected users' buddy 
list in a file called latestpics.tgz.

OSX/Leap-A attempts to infect recently used applications.

Advanced
OSX/Leap-A is an instant-messaging worm for the Mac OS X platform.

The worm attempts to spread via the iChat instant messaging system, 
sending itself to available contacts on the infected users' buddy 
list in a file called latestpics.tgz. This file is an archive 
consisting of:

latestpics: the worm executable
._latestpics: a hidden resource file designed to disguise the 
executable as a JPEG image

OSX/Leap-A installs itself as an application hook by deleting the 
"apphook" subdirectory of either the /Library/InputManagers/ 
directory (if run with root permissions) or the 
~/Library/InputManagers/ directory (if run as a non-root user) and 
replacing it with the following three files:

apphook/Info
apphook/apphook.bundle/Contents/Info.plist
apphook/apphook.bundle/Contents/MacOS/apphook

OSX/Leap-A attempts to infect recently used applications by 
overwriting the original application with a copy of the worm, storing 
the original application in the file's resource fork. Infected 
application files have the following extended attribute:

name: oompa
value: loompa

OSX/Leap-A also creates the following temporary files:

/tmp/pic.gz
/tmp/pic
/tmp/latestpics
/tmp/lastespics.tar
/tmp/lastespics.tar.gz
/tmp/lastespics.tgz

and several files under

/tmp/apphook





Name   W32/Sdbot-DJA

Type  
    * Spyware Worm

How it spreads  
    * Network shares

Affected operating systems  
    * Windows

Side effects  
    * Turns off anti-virus applications
    * Allows others to access the computer
    * Modifies data on the computer
    * Steals information
    * Downloads code from the internet
    * Records keystrokes
    * Installs itself in the Registry
    * Exploits system or software vulnerabilities
    * Used in DOS attacks

Aliases  
    * WORM_SDBOT.DJA
    * Backdoor.Win32.SdBot.ajs

Prevalence (1-5) 2

Description
W32/Sdbot-DJA is a worm for the Windows platform.

W32/Sdbot-DJA runs continuously in the background, providing a 
backdoor server which allows a remote intruder to gain access and 
control over the computer via IRC channels.

W32/Sdbot-DJA spreads
- to computers vulnerable to common exploits, including: LSASS 
(http://www.microsoft.com/technet/security/bulletin/ms04-011.mspx), 
RPC-DCOM 
(http://www.microsoft.com/technet/security/bulletin/ms04-012.mspx), 
PNP 
(http://www.microsoft.com/technet/security/bulletin/ms05-039.mspx) 
and ASN.1 
(http://www.microsoft.com/technet/security/bulletin/ms04-007.mspx)
- to network shares

Advanced
W32/Sdbot-DJA is a worm for the Windows platform.

W32/Sdbot-DJA runs continuously in the background, providing a 
backdoor server which allows a remote intruder to gain access and 
control over the computer via IRC channels.

W32/Sdbot-DJA includes functionality to access the internet and 
communicate with a remote server via HTTP.

When first run W32/Sdbot-DJA copies itself to \snddrv.exe.

The file snddrv.exe is registered as a new system driver service 
named "SndDRV", with a display name of "SndDRV (MS Sound
Driver)" and 
a startup type of automatic, so that it is started automatically 
during system startup. Registry entries are created under:

HKLM\SYSTEM\CurrentControlSet\Services\SndDRV\

W32/Sdbot-DJA sets the following registry entries, disabling the 
automatic startup of other software:

HKLM\SYSTEM\CurrentControlSet\Services\Messenger
Start
4

HKLM\SYSTEM\CurrentControlSet\Services\RemoteRegistry
Start
4

HKLM\SYSTEM\CurrentControlSet\Services\TlntSvr
Start
4

Registry entries are set as follows:

HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
DoNotAllowXPSP2
1

HKLM\SOFTWARE\Microsoft\Ole
EnableDCOM
N

HKLM\SYSTEM\CurrentControlSet\Control\Lsa
restrictanonymous
1

Registry entries are created under:

HKLM\SOFTWARE\Microsoft\Security Center\
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\

W32/Sdbot-DJA spreads
- to computers vulnerable to common exploits, including: LSASS 
(http://www.microsoft.com/technet/security/bulletin/ms04-011.mspx), 
RPC-DCOM 
(http://www.microsoft.com/technet/security/bulletin/ms04-012.mspx), 
PNP 
(http://www.microsoft.com/technet/security/bulletin/ms05-039.mspx) 
and ASN.1 
(http://www.microsoft.com/technet/security/bulletin/ms04-007.mspx)
- to network shares





Name   Troj/BagleDl-BL

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Downloads code from the internet
    * Installs itself in the Registry

Aliases  
    * Trojan-Downloader.Win32.Bagle.y
    * W32/Bagle.dv.dldr

Prevalence (1-5) 2

Description
Troj/BagleDl-BL is a Trojan for the Windows platform.

Troj/BagleDl-BL includes functionality to access the internet and 
communicate with a remote server via HTTP.

Advanced
Troj/BagleDl-BL is a Trojan for the Windows platform.

Troj/BagleDl-BL includes functionality to access the internet and 
communicate with a remote server via HTTP.

When first run Troj/BagleDl-BL copies itself to \anti_troj.exe.

The following registry entries are created to run anti_troj.exe on 
startup:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
anti_troj
\anti_troj.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
anti_troj
\anti_troj.exe

The following registry entry is also created:

HKCU\Software\FirstRRRun
FirstRRRun
1





Name   Troj/Dropper-EH

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Drops more malware
    * Installs itself in the Registry

Prevalence (1-5) 2

Description
Troj/Dropper-EH is a Trojan for the Windows platform.

When Troj/Dropper-EH is installed the following files are created:

\Documentazione_riservata.pps
\msx.dll

Advanced
Troj/Dropper-EH is a Trojan for the Windows platform.

When Troj/Dropper-EH is installed the following files are created:

\Documentazione_riservata.pps
\msx.dll

The file msx.dll is registered as a COM object and Browser Helper 
Object (BHO) for Microsoft Internet Explorer, creating registry 
entries under:

HKCR\CLSID\(521693AA-7453-47ED-9959-3BD47DAA1B1A)
HKCR\Interface\(A25166AB-84F1-4636-B8C2-1D0366E8BB7B)
HKCR\TypeLib\(613D5EB6-379E-4726-B568-1C4F996A78EB)
HKCR\xsmx.ready2wear\
HKCR\xsmx.ready2wear.1\
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser 
Helper Objects\(521693AA-7453-47ED-9959-3BD47DAA1B1





Name   Troj/BankSnif-G

Type  
    * Spyware Trojan

Affected operating systems  
    * Windows

Side effects  
    * Steals information
    * Installs itself in the Registry

Aliases  
    * Trojan-Spy.Win32.Banker.atw

Prevalence (1-5) 2

Description
Troj/BankSnif-G is a Trojan for the Windows platform.

Advanced
Troj/BankSnif-G is a Trojan for the Windows platform.

When first run Troj/BankSnif-G copies itself to \order_mala.exe 
and creates the file \order_opt2.bin.

The file order_opt2.bin is not malicious and can simply be deleted.

The following registry entry is created to run order_mala.exe on 
startup:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
order_Shell
\order_mala.exe





Name   W32/Bagle-CU

Type  
    * Worm

Affected operating systems  
    * Windows

Side effects  
    * Drops more malware
    * Installs itself in the Registry

Aliases  
    * Email-Worm.Win32.Bagle.fc
    * W32/Bagle.dv.dr
    * Trojan.Lodav.A

Prevalence (1-5) 2

Description
W32/Bagle-CU is a worm for the Windows platform.

When run, the worm opens a dialog box asking the user to 'Select file 
to crack'.

W32/Bagle-CU drops the Trojan Troj/BagleDl-BL.

Advanced
W32/Bagle-CU is a worm for the Windows platform.

When run, the worm opens a dialog box asking the user to 'Select file 
to crack'.

When W32/Bagle-CU is installed the following files are created:

\.dmp
\anti_troj.exe
\winlog.dll
\winlog.exe

The files anti_troj.exe and winlog.exe are also copied to the Temp 
folder under random filenames.

The file anti_troj.exe is detected as Troj/BagleDl-BL.

The following registry entries are created to run anti_troj.exe and 
winlog.exe on startup:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
key2
\winlog.exe

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
anti_troj
\anti_troj.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
key2
\winlog.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
anti_troj
\anti_troj.exe

Registry entries are created under:

HKCU\Software\FirstRRRun\





Name   Troj/Bancos-PZ

Type  
    * Spyware Trojan

Affected operating systems  
    * Windows

Side effects  
    * Steals information

Aliases  
    * Trojan-Spy.Win32.Banker.mm

Prevalence (1-5) 2

Description
Troj/Bancos-PZ is a Trojan for the Windows platform.

The Trojan is registered as a Browser Helper Object and steals login 
credentials entered into web page forms.

 
--- MultiMail/Win32 v0.43