[cut-n-paste from sophos.com]
Name Troj/Steam-F
Type
* Spyware Trojan
Affected operating systems
* Windows
Side effects
* Steals information
* Leaves non-infected files on computer
Aliases
* Trojan-PSW.Win32.Delf.kn
* PWS-Steam
Prevalence (1-5) 2
Description
Troj/Steam-F is a password-stealing Trojan for the Windows platform.
Advanced
Troj/Steam-F is a password-stealing Trojan for the Windows platform.
Troj/Steam-F steals passwords from the game Half Life 2 and submit
them to a remote website.
When first run Troj/Steam-F copies itself to \xy337.bat.
Troj/Steam-F creates files with the following names:
XJ.exe
JX.exe
Steam.dll
xt69j1m.tmp
XJ.EXE is detected as Troj/Steam-F, JX.exe and Steam.dll are clean
applications used to access the encrypted password data, and
xt69j1m.tmp is a clean log file.
Name W32/Tilebot-EA
Type
* Spyware Worm
How it spreads
* Network shares
Affected operating systems
* Windows
Side effects
* Turns off anti-virus applications
* Allows others to access the computer
* Steals information
* Downloads code from the internet
* Reduces system security
* Installs itself in the Registry
* Exploits system or software vulnerabilities
* Used in DOS attacks
Prevalence (1-5) 2
Description
W32/Tilebot-EA is a worm and IRC backdoor Trojan for the Windows
platform.
W32/Tilebot-EA spreads:
- to other network computers by exploiting common buffer overflow
vulnerabilities, including: LSASS (MS04-011), RPC-DCOM (MS04-012),
PNP (MS05-039) and ASN.1 (MS04-007)
- to MSSQL servers protected by weak passwords
- to network shares protected by weak passwords
W32/Tilebot-EA runs continuously in the background, providing a
backdoor server which allows a remote intruder to gain access and
control over the computer via IRC channels.
Advanced
W32/Tilebot-EA is a worm and IRC backdoor Trojan for the Windows
platform.
W32/Tilebot-EA spreads:
- to other network computers by exploiting common buffer overflow
vulnerabilities, including: LSASS (MS04-011), RPC-DCOM (MS04-012),
PNP (MS05-039) and ASN.1 (MS04-007)
- to MSSQL servers protected by weak passwords
- to network shares protected by weak passwords
W32/Tilebot-EA runs continuously in the background, providing a
backdoor server which allows a remote intruder to gain access and
control over the computer via IRC channels.
W32/Tilebot-EA includes functionality to download, install and run
new software.
When first run W32/Tilebot-EA copies itself to \win32ssr.exe.
The file win32ssr.exe is registered as a new system driver service
named "Win32Sr", with a display name of "Win32Sr" and a
startup type
of automatic, so that it is started automatically during system
startup. Registry entries are created under:
HKLM\SYSTEM\CurrentControlSet\Services\Win32Sr\
W32/Tilebot-EA sets the following registry entries, disabling the
automatic startup of other software:
HKLM\SYSTEM\CurrentControlSet\Services\Messenger
Start
4
HKLM\SYSTEM\CurrentControlSet\Services\RemoteRegistry
Start
4
HKLM\SYSTEM\CurrentControlSet\Services\TlntSvr
Start
4
Registry entries are set as follows:
HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
DoNotAllowXPSP2
1
HKLM\SOFTWARE\Microsoft\Ole
EnableDCOM
N
HKLM\SYSTEM\CurrentControlSet\Control\Lsa
restrictanonymous
1
Registry entries are created under:
HKLM\SOFTWARE\Microsoft\Security Center\
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\
Name Troj/Banload-VI
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Downloads code from the internet
Aliases
* Trojan-Downloader.Win32.Banload.zm
Prevalence (1-5) 2
Description
Troj/Banload-VI is a Trojan for the Windows platform.
Troj/Banload-VI includes functionality to access the internet and
communicate with a remote server via HTTP.
Troj/Banload-VI will attempt to download a file to
/defrag.exe and run it.
The downloaded file is detected by Sophos as Troj/Banker-AOU.
Name W32/Kassbot-M
Type
* Worm
How it spreads
* Network shares
* Chat programs
Affected operating systems
* Windows
Side effects
* Allows others to access the computer
* Reduces system security
* Installs itself in the Registry
* Exploits system or software vulnerabilities
Prevalence (1-5) 2
Description
W32/Kassbot-M is a worm with backdoor functionality for the Windows
platform.
W32/Kassbot-M runs continuously in the background, providing a
backdoor server which allows a remote intruder to gain access and
control over the computer via IRC channels.
W32/Kassbot-M spreads to other network computers by exploiting the
buffer overflow vulnerabilities: LSASS (MS04-011), RPC-DCOM
(MS04-012), WKS (MS03-049) (CAN-2003-0812), PNP (MS05-039) and ASN.1
(MS04-007) and by copying itself to network shares protected by weak
passwords and AOL Instant Messenger.
W32/Kassbot-M includes functionality to access the internet and
communicate with a remote server via HTTP.
Advanced
W32/Kassbot-M is a worm with backdoor functionality for the Windows
platform.
W32/Kassbot-M runs continuously in the background, providing a
backdoor server which allows a remote intruder to gain access and
control over the computer via IRC channels.
W32/Kassbot-M spreads to other network computers by exploiting the
buffer overflow vulnerabilities: LSASS (MS04-011), RPC-DCOM
(MS04-012), WKS (MS03-049) (CAN-2003-0812), PNP (MS05-039) and ASN.1
(MS04-007) and by copying itself to network shares protected by weak
passwords and AOL Instant Messenger.
W32/Kassbot-M includes functionality to access the internet and
communicate with a remote server via HTTP.
When first run W32/Kassbot-M copies itself to \JavaPlatform.
The file JavaPlatform is registered as a new service named
"JavaPlatform64",with a display name of "JavaPlatform64. Registry
entries are created under:
HKLM\SYSTEM\CurrentControlSet\Services\JavaPlatform64\
W32/Kassbot-M sets the following registry entries, disabling the
automatic startup of other software:
HKLM\SYSTEM\CurrentControlSet\Services\Messenger
Start
4
HKLM\SYSTEM\CurrentControlSet\Services\RemoteRegistry
Start
4
HKLM\SYSTEM\CurrentControlSet\Services\TlntSvr
Start
4
Registry entries are set as follows:
HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
DoNotAllowXPSP2
1
HKLM\SOFTWARE\Microsoft\Ole
EnableDCOM
N
HKLM\SYSTEM\CurrentControlSet\Control\Lsa
restrictanonymous
1
Registry entries are created under:
HKLM\SOFTWARE\Microsoft\Security Center\
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\
Name Troj/Clagger-L
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Downloads code from the internet
* Reduces system security
* Installs itself in the Registry
Prevalence (1-5) 2
Description
Troj/Clagger-L is a Trojan for the Windows platform.
Troj/Clagger-L may arrive in a spam message claiming to be sent from
amazon.co.uk.
Troj/Clagger-L includes functionality to download, install and run
new software. The Trojan downloads a file as \suhoy112.exe.
Advanced
Troj/Clagger-L is a Trojan for the Windows platform.
Troj/Clagger-L may arrive in a spam message claiming to be sent from
amazon.co.uk.
Troj/Clagger-L includes functionality to download, install and run
new software. The Trojan downloads a file as \suhoy112.exe.
The following registry entries are set, affecting internet security:
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FiREWaLL
policy\
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FiREWaLL
policy\StAnDaRDPrOFiLe\
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FiREWaLL
policy\StAnDaRDPrOFiLe\AUtHorizedapplications\
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FiREWaLL
policy\StAnDaRDPrOFiLe\AUtHorizedapplications\List\
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FiREWaLL
policy\StAnDaRDPrOFiLe\AUtHorizedapplications\List
:*:ENABLED:0
Name Troj/Corpse-A
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Allows others to access the computer
* Installs itself in the Registry
Aliases
* Trojan-Proxy.Win32.Small.ah
* Proxy-Corpse
Prevalence (1-5) 2
Description
Troj/Corpse-A is a proxy Trojan.
Advanced
Troj/Corpse-A is a proxy Trojan.
Troj/Corpse-A drops a component as EPLRR3.DLL in the System folder
and creates the following registry entries in order to run it on
system startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellService
ObjectDelayLoad
eplrr
{B4B5996F-1C4B-4856-A6D5-840D74A9FF65}
HKCR\CLSID\{B4B5996F-1C4B-4856-A6D5-840D74A9FF65}\InprocServer32
{at}
\eplrr3.dll
Name Troj/VB-API
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Reduces system security
* Installs itself in the Registry
Prevalence (1-5) 2
Description
Troj/VB-API is a Trojan for the Windows platform.
Troj/VB-API can modify security settings for Internet Explorer.
Advanced
Troj/VB-API is a Trojan for the Windows platform.
Troj/VB-API can modify security settings for Internet Explorer.
Troj/VB-API may create the following registry entry in order to run
automatically on computer login:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
ntxp2
ntxp2.exe
Name Troj/Haxdoor-BH
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Allows others to access the computer
* Downloads code from the internet
* Installs itself in the Registry
* Leaves non-infected files on computer
Prevalence (1-5) 2
Description
Troj/Haxdoor-BH is a backdoor Trojan for the Windows platform.
Troj/Haxdoor-BH includes functionality to access the internet and
communicate with a remote server via HTTP.
Advanced
Troj/Haxdoor-BH is a backdoor Trojan for the Windows platform.
Troj/Haxdoor-BH includes functionality to access the internet and
communicate with a remote server via HTTP.
When Troj/Haxdoor-BH is installed the following file is created:
\ke7dnl.sys
The file ke7dnl.sys is a stealthing component of the Trojan and
registered as a new system driver service named "ke7dnl", with a
display name of "AVXSearch service". Registry entries are created
under:
HKLM\SYSTEM\CurrentControlSet\Services\ke7dnl\
Troj/Haxdoor-BH attempts to download file as \Dtmp106.exe.
Name Troj/Orse-R
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Drops more malware
* Downloads code from the internet
* Installs itself in the Registry
Aliases
* Trojan-Proxy.Win32.Lager.aq
* Downloader-ZQ
Prevalence (1-5) 2
Description
Troj/Orse-R is a Trojan for the Windows platform.
Troj/Orse-R includes functionality to access the internet and
communicate with a remote server via HTTP.
Advanced
Troj/Orse-R is a Trojan for the Windows platform.
Troj/Orse-R includes functionality to access the internet and
communicate with a remote server via HTTP.
When first run Troj/Orse-R copies itself to \taskdir.exe and
creates the following files:
\taskdir.dll
\zlbw.dll
The file taskdir.dll is detected as Troj/HideDl-A. zlbw.dll is a
clean file.
The following registry entry is created to run taskdir.exe on startup:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
taskdir
\taskdir.exe
Name Troj/DwnLdr-AKR
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Drops more malware
* Downloads code from the internet
* Installs itself in the Registry
* Leaves non-infected files on computer
Aliases
* Downloader-ZQ
* Trojan.Abwiz.F
Prevalence (1-5) 2
Description
Troj/DwnLdr-AKR is a Trojan for the Windows platform.
Advanced
Troj/DwnLdr-AKR is a Trojan for the Windows platform.
Troj/DwnLdr-AKR includes functionality to access the internet and
communicate with a remote server via HTTP.
When first run Troj/DwnLdr-AKR copies itself to \taskdir.exe
and creates the following files:
\taskdir.dll
\zlbw.dll
The file taskdir.dll is detected as Troj/HideDl-A. The file zlbw.dll
is not malicious and can be safely deleted.
The following registry entry is created to run taskdir.exe on startup:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
taskdir
\taskdir.exe
Name W32/Cellery-B
Type
* Worm
How it spreads
* Network shares
Affected operating systems
* Windows
Side effects
* Drops more malware
* Installs itself in the Registry
* Leaves non-infected files on computer
Aliases
* W32/FakeTet.worm
* W32.SillyWNSE
Prevalence (1-5) 2
Description
W32/Cellery-B is a network worm for the Windows platform that spreads
by copying itself to certain shared network drives.
When first executed W32/Cellery-B drops to the Windows folder and
plays a standard MIDI data file with the filename minuet.mid, and
opens an interactive Tetris-like game window.
Advanced
W32/Cellery-B is a network worm for the Windows platform that spreads
by copying itself to certain shared network drives.
When first executed W32/Cellery-B drops to the Windows folder and
plays a standard MIDI data file with the filename minuet.mid, opens
an interactive Tetris-like game window and at the same time copies
itself to the Windows system folder with the filename format32.exe.
In order to be able to run automatically when Windows starts up the
worm sets the registry entries:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
Systrsy
"format32.exe"
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\
Systrsy
"format32.exe"
When run, format32.exe creates a copy of itself in Windows Tasks
folder with the filename sys32.exe and establishes a corresponding
background process.
W32/Cellery-B attempts to copy itself to the \Documents and
Settings\All Users folder and as Admin$\task\sys32.exe of the shared
network drives that match removable and fixed drive types.
Name Troj/Loosky-BY
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Installs itself in the Registry
Aliases
* Trojan-Downloader.Win32.agq
Prevalence (1-5) 2
Description
Troj/Loosky-BY is a Trojan for the Windows platform.
When first run Troj/Loosky-BY copies itself to \batserv2.exe
and creates the file \sysc.exe.
Advanced
Troj/Loosky-BY is a Trojan for the Windows platform.
When first run Troj/Loosky-BY copies itself to \batserv2.exe
and creates the file \sysc.exe.
The following registry entry is created to run batserv2.exe on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
BatSrv
\batserv2.exe
Name W32/Tilebot-DW
Type
* Worm
How it spreads
* Network shares
Affected operating systems
* Windows
Side effects
* Allows others to access the computer
* Reduces system security
* Installs itself in the Registry
* Exploits system or software vulnerabilities
Prevalence (1-5) 2
Description
W32/Tilebot-DW is a worm with backdoor Trojan functionality.
W32/Tilebot-DW runs continuously in the background, providing a
backdoor server
which allows a remote intruder to gain access and control over the
computer via
IRC channels.
W32/Tilebot-DW includes functionality to download, install and run
new software.
Advanced
W32/Tilebot-DW is a worm with backdoor Trojan functionality.
W32/Tilebot-DW runs continuously in the background, providing a
backdoor server
which allows a remote intruder to gain access and control over the
computer via
IRC channels.
W32/Tilebot-DW includes functionality to download, install and run
new software.
When first run W32/Tilebot-DW copies itself to
<Windows>\win32ssr.exe.
The file win32ssr.exe is registered as a new system driver service
named
"Win32Sr", with a display name of "Win32Sr" and a
startup type of
automatic, so
that it is started automatically during system startup. Registry
entries are
created under:
HKLM\SYSTEM\CurrentControlSet\Services\Win32Sr\
W32/Tilebot-DW sets the following registry entries, disabling the
automatic
startup of other software:
HKLM\SYSTEM\CurrentControlSet\Services\Messenger
Start
4
HKLM\SYSTEM\CurrentControlSet\Services\RemoteRegistry
Start
4
HKLM\SYSTEM\CurrentControlSet\Services\TlntSvr
Start
4
Registry entries are set as follows:
HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
DoNotAllowXPSP2
1
HKLM\SOFTWARE\Microsoft\Ole
EnableDCOM
N
HKLM\SYSTEM\CurrentControlSet\Control\Lsa
restrictanonymous
1
Registry entries are created under:
HKLM\SOFTWARE\Microsoft\Security Center\
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\
--- MultiMail/Win32 v0.43
* Origin: Try Our Web Based QWK: DOCSPLACE.ORG (1:123/140)
SEEN-BY: 633/267 270
@PATH: 123/140 500 106/2000 633/267
|