[cut-n-paste from sophos.com]

Name   W32/Poebot-LO

Type  
    * Worm

How it spreads  
    * Network shares

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Downloads code from the internet
    * Installs itself in the Registry
    * Exploits system or software vulnerabilities

Aliases  
    * Backdoor.Win32.VanBot.ax
    * BKDR_POEBOT.MJ

Prevalence (1-5) 2

Description
W32/Poebot-LO is an IRC worm with backdoor functionality which allows 
a remote intruder to gain access and control over the computer.

W32/Poebot-LO includes functionality to download, install and run new 
software.

W32/Poebot-LO spreads to other network computers by exploiting common 
vulnerabilities, including LSASS (MS04-011), SRVSVC (MS06-040), 
RPC-DCOM (MS04-012) and PNP (MS05-039) .

Advanced
W32/Poebot-LO is an IRC worm with backdoor functionality which allows 
a remote intruder to gain access and control over the computer.

W32/Poebot-LO includes functionality to download, install and run new 
software.

W32/Poebot-LO spreads to other network computers by exploiting common 
vulnerabilities, including LSASS (MS04-011), SRVSVC (MS06-040), 
RPC-DCOM (MS04-012) and PNP (MS05-039) .

When first run W32/Poebot-LO copies itself to \iexplore.exe 
and creates the non-malicious file 'jbikuyoy.bat'.

The following registry entry is created to run iexplore.exe:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Internet 
Explorer = \iexplore.exe





Name   W32/Brontok-DG

Type  
    * Worm

How it spreads  
    * Removable storage devices

Affected operating systems  
    * Windows

Side effects  
    * Drops more malware
    * Reduces system security
    * Installs itself in the Registry

Prevalence (1-5) 2

Description
W32/Brontok-DG is a worm for the Windows platform.

Advanced
W32/Brontok-DG is a worm for the Windows platform.

When first run W32/Brontok-DG copies itself to:

\Backup\WMP_10 for XP.exe
\user32.exe
\_default.exe
\x-executor.exe
\vergon1885.exe

and creates the file \man.bat.

The following registry entry is created to run vergon1885.exe on 
startup:
            
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
wmplayer
\vergon1885.exe
           
The following registry entries are changed to run W32/Brontok-DG on 
startup:
            
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Shell
Explorer.exe "\vergon1885.exe"

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Userinit
\userinit.exe,"\vergon1885.exe"

W32/Brontok-DG attempts to periodically copy itself to removeable 
drives, including floppy drives and USB keys. The worm will attempt 
to create hidden folders on the logical drive and copy itself to them.





Name   Troj/LegMir-AQX

Type  
    * Spyware Trojan

Affected operating systems  
    * Windows

Side effects  
    * Steals information
    * Installs itself in the Registry

Aliases  
    * Trojan-PSW.Win32.OnLineGames.nw

Prevalence (1-5) 2

Description
Troj/LegMir-AQX is a password-stealing Trojan for the Windows platform.

Advanced
Troj/LegMir-AQX is a password-stealing Trojan for the Windows platform.

When first run Troj/LegMir-AQX copies itself to:

\alg32.dat
\alg32.exe

and creates the following files:

\MirSet.ini
\Winhttps.dat
\Winhttps.dll

The files Winhttps.dat and Winhttps.dll are also detected as 
Troj/LegMir-AQX.





Name   SB/BadBunny-A

Type  
    * Worm

How it spreads  
    * Infected files
    * Chat programs

Side effects  
    * Modifies data on the computer
    * Used in DOS attacks

Aliases  
    * IRC-Worm.StarOffice.Badbunny.a

Prevalence (1-5) 2

Description
SB/BadBunny-A is a multi-platform worm written in several scripting 
languages and distributed as an OpenOffice.org document containing a 
StarBasic macro.

Advanced
SB/BadBunny-A is a multi-platform worm written in several scripting 
languages and distributed as an OpenOffice.org document containing a 
StarBasic macro.

SB/BadBunny-A spreads by dropping malicious script files that affect 
the behavior of the popular IRC programs mIRC and X-Chat, causing 
them send SB/BadBunny-A to other users. These malicious script files 
are named badbunny.py (for XChat) and script.ini (for mIRC, 
overwriting the existing mIRC file) and are also detected as 
SB/BadBunny-A.

SB/BadBunny-A drops different additional components depending on the 
platform on which it is running:
 - On Windows, it drops a file named badbunny.js that is a JavaScript 
file infector also detected as SB/BadBunny-A.
 - On Linux, it drops a file named badbunny.pl that is a Perl file 
infector also detected as SB/BadBunny-A.
 - On MacOS, it drops one of two possible files named badbunny.rb and 
badbunnya.rb that are Ruby file infectors also detected as 
SB/BadBunny-A.

SB/BadBunny-A will also attempt a ping of death attack against the 
following anti-virus sites:-
 www.ikarus.at
 www.aladdin.com
 www.norman.no
 www.norman.com
 www.kaspersky.com
 www.kaspersky.ru
 www.kaspersky.pl
 www.grisoft.cz
 www.symantec.com
 www.proantivirus.com
 www.f-secure.com
 www.sophos.com
 www.arcabit.pl
 www.arcabit.com
 www.avira.com
 www.avira.de
 www.avira.ro
 www.avast.com
 www.virusbuster.hu
 www.trendmicro.com
 www.bitdefender.com
 www.pandasoftware.comm [sic]
 www.drweb.com
 www.drweb.ru
 www.viruslist.com

 
 
 
 
Name   W32/Rbot-GPL

Type  
    * Worm

How it spreads  
    * Network shares

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Installs itself in the Registry
    * Exploits system or software vulnerabilities

Prevalence (1-5) 2

Description
W32/Rbot-GPL is a network worm and IRC backdoor for the Windows 
platform.

W32/Rbot-GPL spreads
 - to computers vulnerable to common exploits, including: SRVSVC 
(MS06-040), RPC
 -DCOM (MS04-012), ASN.1 (MS04-007), RealVNC (CVE-2006-2369) and 
Symantec (SYM06-010)
 - to MSSQL servers protected by weak passwords
 - to network shares protected by weak passwords

The following patches for the operating system vulnerabilities 
exploited by the
worm can be obtained from the Microsoft website:

http://www.microsoft.com/technet/security/bulletin/MS06-040.mspx
http://www.microsoft.com/technet/security/bulletin/MS04-012.mspx
http://www.microsoft.com/technet/security/bulletin/MS04-007.mspx

Advanced
W32/Rbot-GPL is a network worm and IRC backdoor for the Windows 
platform.

W32/Rbot-GPL spreads
 - to computers vulnerable to common exploits, including: SRVSVC 
(MS06-040), RPC
 -DCOM (MS04-012), ASN.1 (MS04-007), RealVNC (CVE-2006-2369) and 
Symantec (SYM06-010)
 - to MSSQL servers protected by weak passwords
 - to network shares protected by weak passwords

The following patches for the operating system vulnerabilities 
exploited by the
worm can be obtained from the Microsoft website:

http://www.microsoft.com/technet/security/bulletin/MS06-040.mspx
http://www.microsoft.com/technet/security/bulletin/MS04-012.mspx
http://www.microsoft.com/technet/security/bulletin/MS04-007.mspx

W32/Rbot-GPL runs continuously in the background, providing a 
backdoor server which allows a remote intruder to gain access and 
control over the computer via IRC channels.

When W32/Rbot-GPL is installed it creates the file 
\WinSecUp.exe.

The following registry entries are created to run WinSecUp.exe on 
startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Microsoft
WinSecUp.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
Microsoft
WinSecUp.exe





Name   W32/Rbot-GQN

Type  
    * Spyware Worm

How it spreads  
    * Network shares

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Steals information
    * Downloads code from the internet
    * Records keystrokes
    * Installs itself in the Registry
    * Exploits system or software vulnerabilities
    * Used in DOS attacks

Prevalence (1-5) 2

Description
W32/Rbot-GQN is a worm for the Windows platform.

Advanced
W32/Rbot-GQN is a worm for the Windows platform.

W32/Rbot-GQN runs continuously in the background, providing a 
backdoor server which allows a remote intruder to gain access and 
control over the computer via IRC channels.

When first run W32/Rbot-GQN copies itself to \wlimyc.exe.

The following registry entries are created to run wlimyc.exe on 
startup:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Microsoft Update Machine
wlimyc.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Microsoft Update Machine
wlimyc.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
Microsoft Update Machine
wlimyc.exe





Name   Troj/Clickr-AC

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Opens links to websites

Prevalence (1-5) 2

Description
Troj/Clickr-AC is a Trojan for the Windows platform.

Advanced
Troj/Clickr-AC is a Trojan for the Windows platform.

Troj/Clickr-AC may display browser popups.

Troj/Clickr-AC is registered as a COM object and Browser Helper 
Object (BHO) for Microsoft Internet Explorer, creating registry 
entries under:

HKCR\CLSID\{89731480-D47D-4DC4-8A36-BAAE55E094C5}
HKCR\Interface\{1E293881-F1AA-4580-9EA4-4C714E71162A}
HKCR\TypeLib\{08DFED4C-5BEB-490A-8AFA-331AC1AE5C0D}
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser 
Helper Objects\{89731480-D47D-4DC4-8A36-BAAE55E094C5}

Registry entries are set as follows:

HKCR\Explorer.MExplorer.1\CLSID
(default)
{89731480-D47D-4DC4-8A36-BAAE55E094C5}

HKCR\Explorer.MExplorer\CLSID
(default)
{89731480-D47D-4DC4-8A36-BAAE55E094C5}

Registry entries are created under:

HKCR\Explorer.MExplorer





Name   Troj/DwnLdr-GUW

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Downloads code from the internet

Prevalence (1-5) 2

Description
Troj/DwnLdr-GUW is a downloader Trojan for the Windows platform.

Advanced
Troj/DwnLdr-GUW is a downloader Trojan for the Windows platform.

Troj/DwnLdr-GUW includes functionality to access the internet and 
communicate with a remote server via HTTP.

When Troj/DwnLdr-GUW is installed the following files are created:

\test.txt
\test2.txt

These files contain downloaded components. At the time of writing, 
the site hosting these components was unavailable.





Name   W32/Vizim-A

Type  
    * Worm

How it spreads  
    * Removable storage devices

Affected operating systems  
    * Windows

Side effects  
    * Leaves non-infected files on computer
    * Installs a browser helper object

Aliases  
    * W32/Vizim.worm
    * Virus.Win32.AutoRun.m

Prevalence (1-5) 2

Description
W32/Vizim-A is a worm for the Windows platform.

Advanced
W32/Vizim-A is a worm for the Windows platform.

When first run W32/Vizim-A copies itself to the root and Windows 
system folders and creates the following files:

\autorun.inf
\autorun.inf

The file autorun.inf is designed to start the worm once the 
removeable drive is connected to a uninfected computer. The file 
autorun.inf can be safely deleted.

Registry entries are set as follows:

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
LegalNoticeCaption
PROMISE???

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
LegalNoticeText
I am still waiting for the strawberry coming from my Baguio! Pls.. 
Help!





Name   W32/Mypis-A

Type  
    * Virus

How it spreads  
    * Infected files

Affected operating systems  
    * Windows

Side effects  
    * Downloads code from the internet

Prevalence (1-5) 2

Description
W32/Mypis-A is a virus for the Windows platform.

Advanced
W32/Mypis-A is a virus for the Windows platform.

The virus may create the file \Common 
Files\System\svchost.exe and this file is detected as Mal/Basine-C.





Name   W32/AHKHeap-A

Type  
    * Worm

How it spreads  
    * Removable storage devices

Affected operating systems  
    * Windows

Side effects  
    * Installs itself in the Registry
    * Leaves non-infected files on computer

Prevalence (1-5) 2

Description
W32/AHKHeap-A is a worm for the Windows platform.

Advanced
W32/AHKHeap-A is a worm for the Windows platform.

When run, W32/AHKHeap-A creates the following files:

\MicrosoftPowerPoint\2.mp3 - can be safely removed
\MicrosoftPowerPoint\drivelist.txt - can be safely removed
\MicrosoftPowerPoint\Icon.ico - can be safely removed
\MicrosoftPowerPoint\Install.txt - detected as W32/AHKHeap-A
\MicrosoftPowerPoint\pathlist.txt - can be safely removed
\MicrosoftPowerPoint\svchost.exe - can be safely removed
C:\heap41a\2.mp3 - can be safely removed
C:\heap41a\drivelist.txt - can be safely removed
C:\heap41a\Icon.ico - can be safely removed
C:\heap41a\reproduce.txt - detected as W32/AHKHeap-A
C:\heap41a\script1.txt - detected as W32/AHKHeap-A
C:\heap41a\std.txt - detected as W32/AHKHeap-A
C:\heap41a\svchost.exe - can be safely removed
C:\heap41a\offspring\autorun.inf - detected as W32/AHKHeap-A

W32/AHKHeap-A attempts to periodically copy itself to removeable 
drives and USB keys. The worm will attempt to create a hidden file 
Autorun.inf on the removeable drive and copy itself to the removeable 
drive as MicrosoftPowerPoint.exe.
            
The file Autorun.inf is designed to start the worm once the 
removeable drive is connected to a uninfected computer.

The following registry entries are set to run W32/AHKHeap-A on startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run
status
present

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run
winlogon
C:\heap41a\svchost.exe C:\heap41a\std.txt

The following registry entry is set:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder
\Hidden\SHOWALL
CheckedValue
0





Name   W32/Tilebot-JQ

Type  
    * Worm

How it spreads  
    * Network shares

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Installs itself in the Registry

Aliases  
    * Backdoor.Win32.SdBot.bic

Prevalence (1-5) 2

Description
W32/Tilebot-JQ is a worm with IRC backdoor Trojan functionality.

W32/Tilebot-JQ runs continuously in the background, providing a 
backdoor server which allows a remote intruder to gain access and 
control over the computer via IRC channels.

W32/Tilebot-JQ includes functionality to access the internet and 
communicate with a remote server via HTTP.

Advanced
W32/Tilebot-JQ is a worm with IRC backdoor Trojan functionality.

W32/Tilebot-JQ runs continuously in the background, providing a 
backdoor server which allows a remote intruder to gain access and 
control over the computer via IRC channels.

W32/Tilebot-JQ includes functionality to access the internet and 
communicate with a remote server via HTTP.

When first run W32/Tilebot-JQ copies itself to \wault.exe.

The file wault.exe is registered as a new system driver service named 
"Windows Auto Update Tool", with a display name of "Windows Auto 
Update Tool" and a startup type of automatic, so that it is started 
automatically during system startup. Registry entries are created 
under:

HKLM\SYSTEM\CurrentControlSet\Services\Windows Auto Update Tool

The file \sfc_os.dll is modified in order to disable the 
System File Checker. The modified version is detected as Disabled 
System File Check DLL.

The files \ftp.exe and \tftp.exe are replaced by 
non-functional versions of those applications.

Registry entries are set as follows:

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
SFCScan
0

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
SFCDisable
ffffff9d





Name   W32/Gatina-B

Type  
    * Spyware Worm

How it spreads  
    * Email messages

Affected operating systems  
    * Windows

Side effects  
    * Turns off anti-virus applications
    * Sends itself to email addresses found on the infected computer
    * Steals information
    * Forges the sender's email address
    * Uses its own emailing engine
    * Downloads code from the internet
    * Reduces system security
    * Installs itself in the Registry

Prevalence (1-5) 2

Description
W32/Gatina-B is an email and network worm.

Advanced
W32/Gatina-B is an email and network worm.

The emails sent by the worm have forged "From:" addresses and the 
following characteristics:

Subject line:

  "FILIPINO'S SECRETS"

  "LYRICS OF BAMBOO AND OTHER BOY BAND"

  "Philippines Government Top Secret"

  "New Virus Information"

  "Ukinnam Virus Information"

Message text:

  "Hi! Look the Attach Document for more details about FILIPINOS..."

  "HOY! PINOY AKO! BUO AKING LOOB MAY AGIMAT AKO... FOR MORE LYRICS 
CHECK THE ATTACH FILE..."

  "The Government of the Philippines revealed the truth. For more 
information please read the Attach file..."

  "Please read the attach file for more information about computer 
virus..."

  "If your computer has been infected by Ukinnam Virus. Open the 
attach file and follow the instruction to remove the virus..."

Attached file:

  README.DOC.exe

  INFO.DOC.exe

  TAETAE.TXT.exe

  DATA.DOC.exe

W32/Gatina-B collects email addresses from files whose extension is 
HTT, HTM, HTML, HTA, HTE, HTX, SHTML, STM, ASP, XML, DOC, RTF, TXT, 
DBX, PHP, PHP3, PTHML, JSP, SQL, EML, INI, TBB or TBI.

When first run W32/Gatina-B copies itself to:

Startup>\MSKernell.bat
\Exit to DosPrompt.pif
\Mails\DATA.DOC.exe
\Mails\DOCUMENT.DOC.exe
\Mails\INFO.DOC.exe
\Mails\README.DOC.exe
\Mails\TAETAE.TXT.exe
\AutoRun.bat

The following registry entries are created to run Exit to 
DosPrompt.pif and AutoRun.bat on startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
NOYPI_KANG_ASTIG
\Exit to DosPrompt.pif

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
taetae
\Exit to DosPrompt.pif

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
TANG_INA_MO
\AutoRun.bat

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
taengtae
\AutoRun.bat

The following registry entries are set, disabling system software:

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System
DisableTaskMgr
1

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System
DisableRegistryTools
1

Registry entries are set as follows:

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
NoFind
1

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
NoFolderOptions
1

HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions
NoFindFiles
1

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
Hidden
2

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
HideFileExt
1

W32/Gatina-B closes applications whose title matches any of the 
following:

  Ad-aware 6.0 Personal
  Ad-Aware SE Personal
  Anti-Trojan - Infection Monitor
  Anti-Virus
  AntiViral Toolkit Pro
  AVG E-Mail Server Edition - Advanced Interface
  AVG E-Mail Server Edition - Basic Interface
  AVG E-Mail Server Edition - Control Centerr
  AVP
  AVP Monitor
  BitDefender
  BitDefender Sheild
  BlackICE
  Command Prompt
  Control Panel
  eTrust Antivirus - Local Scanner
  F-Secure Anti-Virus
  HijackThis
  Kaspersky Anti-Virus Monitor
  Kaspersky Anti-Virus personal
  Kaspersky Anti-Virus Scanner
  My Computer
  My Documents
  NOD32 Antivirus Program
  Norton
  Norton Antivirus
  Norton AntiVirus Porfessional
  Pop3trap
  Process Explorer
  Registry Editor
  Registry Monitor
  Registry Monitor
  Services
  Sophos Anti-Virus - SWEEP
  Spybot - Search & Destroy
  Sygate Personal Firewall Pro
  System Configuration Utility
  System Restore
  Windows Firewall
  Windows Security Center
  Windows Task Manager
  WinPatrol

W32/Gatina-B also attempts to spread to other network computers via 
network shares as a file named README.EXE.

W32/Gatina-B attempts to periodically copy itself to removeable 
drives, including floppy drives and USB keys under the following names:

  AutoRun.bat
  Exit to DosPrompt.pif
  ReadMe.scr
  MSKernell.bat

  
  
  
  
Name   Troj/DaMailer-B

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Sends itself to email addresses found on the infected computer

Prevalence (1-5) 2

Description
Troj/DaMailer-B is a Trojan for Windows platform.





Name   Mal/Qbot-A

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Reduces system security
    * Dropped by malware

Prevalence (1-5) 2

Description
Mal/Qbot-A is a family of components for IRC backdoor Trojans.

Advanced
Mal/Qbot-A is a family of components for IRC backdoor Trojans.





Name   Troj/DNSChan-LT

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Modifies data on the computer

Aliases  
    * Trojan.Win32.DNSChanger.jb

Prevalence (1-5) 2

Description
Troj/DNSChan-LT is a Trojan for the Windows platform.

The Trojan includes functionality to modify the DNS setting, access 
the internet and communicate with a remote server via HTTP.





Name   Troj/Nofere-I

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Downloads code from the internet
    * Installs itself in the Registry

Aliases  
    * Trojan-PSW.Win32.Nilage.bei
    * Win32/TrojanDownloader.Agent.NIG

Prevalence (1-5) 2

Description
Troj/Nofere-I is a Trojan for the Windows platform.

Troj/Nofere-I includes functionality to access the internet and 
communicate with a remote server via HTTP.

Troj/Nofere-I may download and execute files from remote locations, 
delete registry entries and kill specified processes.

Advanced
Troj/Nofere-I is a Trojan for the Windows platform.

Troj/Nofere-I includes functionality to access the internet and 
communicate with a remote server via HTTP.

Troj/Nofere-I may download and execute files from remote locations, 
delete registry entries and kill specified processes.

When first run Troj/Nofere-I copies itself to 
C:\Progra~1\Eset\IEXPLORER.EXE. Troj/Nofere-I may also copy itself to 
the Windows, Windows system or Temp folders.

The following registry entry is created to run IEXPLORER.EXE on 
startup:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
ravshell
\Eset\IEXPLORER.EXE

Troj/Nofere-I may set a registry entries under the following location:

HKCR\ferefile





Name   Troj/Yar-A

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Turns off anti-virus applications

Prevalence (1-5) 2

Description
Troj/Yar-A is a Trojan for the Windows platform.

Advanced
Troj/Yar-A is a Trojan for the Windows platform.

Once installed Troj/Yar-A creates the files:

\dld_2urls_dd3_nonpack_rpolycrypt.exe - detected as Troj/Yar-A.
\pirate_alert.exe - non malicious file that can be safely 
removed.

The file \pirate_alert.exe is then run and will display a fake 
error message with the title "Unsupported MPEG Codec Error: Pirates 
of the Caribbean: At World's End" and the message "Unsupported MPEG 
Codec Error: Pirates of the Caribbean: At World's End. Go to official 
web site: ".

Troj/Yar-A may be spammed out via email as an zip attachment with the 
subject lines:

"Pirates of the Caribbean: At World's End -- The Official Trailer"
"Pirates of the Caribbean 3"


The message body may also contain a brief synopsis of the movie.





Name   W32/Looked-DG

Type  
    * Virus

How it spreads  
    * Infected files

Affected operating systems  
    * Windows

Side effects  
    * Installs itself in the Registry

Aliases  
    * W32/HLLP.Philis.kl
    * Worm.Win32.Viking.lm

Prevalence (1-5) 2

Description
W32/Looked-DG is a virus for the Windows platform.

Advanced
W32/Looked-DG is a virus for the Windows platform.

When W32/Looked-DG is installed the following files are created:

\Logo1_.exe
\uninstall\rundl132.exe

The following registry entry is created to run rundl132.exe on startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
load
\uninstall\rundl132.exe





Name   Troj/Maha-S

Type  
    * Spyware Trojan

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Steals information
    * Downloads code from the internet
    * Installs itself in the Registry

Aliases  
    * Trojan-Spy.Win32.Delf.tl
    * Win32/PSW.Maha.A trojan

Prevalence (1-5) 2

Description
Troj/Maha-S is a Trojan for the Windows platform.

Advanced
Troj/Maha-S is a Trojan for the Windows platform.

Troj/Maha-S includes functionality to access the internet and 
communicate with a remote server via HTTP, and also contains 
information-stealing and keylogging functionality.

When first run Troj/Maha-S copies itself to:

\me.mp3
\testy.exe

and creates the file \testy.dll, also detected as 
Troj/Maha-S. The file me.mp3 will then be deleted by the Trojan.

Troj/Maha-S creates the folder \system32\drivers\ssl\06.

The file testy.exe is registered as a new system driver service named 
"Windows License ManagementA" and no display name. Registry entries 
are created under:

HKLM\SYSTEM\CurrentControlSet\Services\Windows License ManagementA\

Troj/Maha-S may also create the file C:\ali.html.

Troj/Maha-S may create a message box with the text "STUPID KAV".





Name   Troj/Dloadr-AYS

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Downloads code from the internet
    * Installs itself in the Registry
    * Dropped by malware

Aliases  
    * Trojan-Downloader.Win32.Alphabet.gen

Prevalence (1-5) 2

Description
Troj/Dloadr-AYS is a Trojan for the Windows platform.

Advanced
Troj/Dloadr-AYS is a Trojan for the Windows platform.

Once run, Troj/Dloadr-AYS attempts to connect to a remote server and 
download other content.

The following Registry entry is added to run the Trojan on system 
restart:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
avp
(path and filename of executed Trojan)

 
--- MultiMail/Win32 v0.43