Articles by eSecurityPlanet.com Staff

6/30: Doep.A Spreads Via File Sharing

W32.Doep.A is a worm that spreads through file-sharing networks, such as Kazaa, eMule, eDonkey2000, Lphant, and Overnet.

6/30: Bankhook.A Steals User Information

Bankhook.A is a Trojan that installs itself in the affected computer by taking advantage of several vulnerabilities.

6/30: Agobot-KG Sets Up IRC Channel

W32/Agobot-KG is an IRC backdoor Trojan and network worm which establishes an IRC channel to a remote server in order to grant an intruder access to the compromised machine.

6/30: Rbot-CG Allows Unauthorized Access

W32/Rbot-CG is a backdoor Trojan and network worm that allows unauthorized remote access to the infected computer via IRC channels while running in the background as a service process.

6/29: Trojan.Ecure Modifies IE Page

Trojan.Ecure is a Trojan horse that modifies the Hosts file and Internet Explorer home page.

6/29: Downloader-LY Carries Trojan

Downloader-LY is a Trojan that attempts to connect to a remote URL, and downloads Keylog Briss.

6/29: Boxed.D Performs DoS Attacks

Trojan.Boxed.D is a Trojan horse that performs a Denial of Service (DoS) attack on certain Web sites.

6/29: Randex.ATX Remotely Controlled

W32.Randex.ATX is a network-aware worm that may be remotely controlled using IRC.

6/29: Gaobot.AUS Lets Attackers In

W32.Gaobot.AUS is a repacked variant of W32.Gaobot.SN.

6/29: Rbot-CC Has Backdoor Capabilities

W32/Rbot-CC is a member of the W32/Rbot family of worms with backdoor component.

6/28: Agobot-KE Exploits Weak Passwords

W32/Agobot-KE is a backdoor Trojan and worm that spreads to computers protected by weak passwords.

6/28: JS-Scoba.A is Trojan Script

JS-Scoba.A is Trojan script that is usually embedded in malicious Web pages.

6/28: JS-Ject.A Hides in Hostile Web Pages

JS_Ject.A is Trojan script that usually arrives as an encrypted Java script file embedded in malicious Web pages.

6/28: Backdoor-AXY Runs Silently

Backdoor-AXY is a Trojan that upon execution, runs silently, no GUI message boxes appear.

6/28: Backdoor-CCL Running Wild

Backdoor-CCL is a Trojan that when executed, the file runs silently, no GUI message boxes appear.

6/28: Mota May Arrive As Attachment

W32/Mota.worm may arrive as an e-mail file attachment with the file attachment being either a .scr or .pif or .zip file.

6/28: Backdoor.Botex Steals Information

Backdoor.Botex is a backdoor program to allow unauthorized remote access to a compromised system.

6/28: Rbot-CA Allows Remote Access

W32/Rbot-CA is a worm that attempts to spread to remote network shares.

6/25: JS/Scob-A a Java Script Trojan

JS/Scob-A is a Java script trojan that is reported to be appended to HTML files on IIS machines.

6/25: Korgo.U Exploits LSASS Flaw

Korgo.U is a worm that spreads via the Internet by exploiting the LSASS vulnerability in remote computers.

6/25: Korgo.V Exploits Vulnerability

Worm_Korgo.V exploits the Windows LSASS vulnerability, which is a buffer overrun that allows remote code execution and enables an attacker to gain full control of the affected system.

6/25: Sdbot.Fo Exploits LSASS Flaw

Worm_Sdbot.Fo is a worm that spreads by exploiting the Windows LSASS flaw, which is a buffer overrun that allows remote code execution and enables an attacker to gain full control of the affected system.

6/25: BackDoor-AXJ Very Active

BackDoor-AXJ is a Trojan that when run on the victim machine, serves multiple actions.

6/25: JS.Scob Executes Javascript File

JS.Scob.Trojan is a simple trojan that executes a JavaScript file from a remote server.

6/24: Bobax.B Exploits LSASS Vulnerability

Worm_Bobax.B is known to exploit the Windows LSASS vulnerability, which is a buffer overrun that allows remote code execution and enables an attacker to gain full control of an affected system.

6/24: Korgo.R Scans IP Addresses

W32/Korgo-R is a network worm using the LSASS exploit to propagate (MS04-011).

6/24: Downloader.JH Downloads Dialer

Downloader.JH is a Trojan that gets information on the affected computer in order to download a dialer, detected by Panda Software as Dialer.DA, to the computer.

6/24: Korgo.T Exploits LSASS Vulnerability

Worm_Korgo.T is a memory-resident worm that exploits the Windows LSASS vulnerability, which is a buffer overrun that allows remote code execution and enables an attacker to gain full control of the affected system.

6/24: Sdbot-JF Allows Remote Access

W32/Sdbot-JB is a worm that attempts to spread to remote network shares.

6/23: Korgo.S Exploiting LSASS Vulnerability

Continuing its way through the alphabet, Panda Software issued an alert for the S variant of the Korgo worm, which spreads via the Internet by exploiting the LSASS vulnerability in remote computers.

6/23: Korgo Q, R Variants Use LSASS Flaw

Some security vendors have issued alerts for the Q and R variants of the Korgo worm, which spreads via the Internet by exploiting the LSASS vulnerability in remote computers.

6/23: Agobot-KC Seeks Weak Passwords

W32/Agobot-KC is a backdoor worm that spreads to computers protected by weak passwords.

6/22: Ranky.G Runs as Proxy Server

Backdoor.Ranky.G is a Trojan horse that runs as a proxy server.

6/22: Rbot-BL Spreads to Remote Shares

W32/Rbot-BL is a worm that attempts to spread to remote network shares.

6/21: IPScanner.A is a Hacking Tool

IPScanner.A is a hacking tool.

6/21: Lovgate.AB Spreads Via Email

Worm_Lovgate.AB drops copies of itself in several locations using varying file names.

6/21: Hacarmy.C Gives Hacker Control

Backdoor.Hacarmy.C is a Backdoor Trojan horse that gives an attacker control over a compromised computer.

6/21: Rbot-BI Runs in Background

W32/Rbot-BI is a worm that attempts to spread to remote network shares.

6/21: Lovgate-V Spreads Multiple Ways

W32/Lovgate-V is a variant of the W32/Lovgate family of worms that spread via email, network shares and filesharing networks.

6/21: Korgo-N, O, P Exploit LSASS Flaw

Some security vendors Monday issued alerts for the N, O and P variants of the Korgo worm, which spread by exploiting the LSASS vulnerability in Windows.

6/18: Dansh-A Copies to Windows

W32/Dansh-A is a network worm and IRC backdoor Trojan that can copy itself to the Windows System32 folder as DESKTOP.EXE when executed.

6/18: Backdoor.Nibu.H Opens Trojan

Backdoor.Nibu.H opens a backdoor Trojan horse on a compromised system.

6/18: Korgo L,M Exploit Buffer Flaw

W32.Korgo.L and M are the latest variants of the W32.Korgo.I worm and attempt to propagate by exploiting the Microsoft Windows LSASS Buffer Overrun Vulnerability (described in Microsoft Security Bulletin MS04-011) on TCP port 445.

6/18: Rbot-BC Runs in Background

W32/Rbot-BC is a worm that attempts to spread to remote network shares.

6/18: Sdbot-JB Allows Remote Access

W32/Sdbot-JB is a worm that attempts to spread to remote network shares.

6/18: Lovgate-V Spreading Widely

W32/Lovgate-V is a variant of the W32/Lovgate family of worms that spread via email, network shares and filesharing networks.

6/17: Agobot-KB Exploits Passwords

W32/Agobot-KB is a backdoor Trojan and worm that spreads to computers protected by weak passwords.

6/17: Argen Is Malware Joke

Argen is a malware type joke.

6/17: Sdbot.RZ Uses NetBEUI Functions

Worm_Sdbot.RZ is a memory-resident worm that spreads through network shares.

6/17: Download.Ject Installs File

Download.Ject is a Trojan horse that attempts to download and install a file by exploiting a vulnerability in Internet Explorer.

6/17: PWSteal.Bammer.A Steals Passwords

PWSteal.Bamer.A steals passwords when you visit Web sites the belong to certain banks.

6/17: Rbot-AY Exploits OS Vulnerabilities

W32/Rbot-AY is a worm and backdoor that spreads by exploiting various operating system vulnerabilities, weak passwords on shares and SQL servers and backdoors opened by other worms and Trojans.

6/17: Rbot-AX Spreads to Remote Shares

W32/Rbot-AX is a worm that attempts to spread to remote network shares.

6/16: Download.Ject Installs File

Download.Ject is a Trojan that attempts to download and install a file on a compromised system by exploiting a vulnerability in Internet Explorer.

6/16: Korgo-H Exploits LSASS Flaw

W32/Korgo-H is a member of the W32/Korgo family of network worms that propagates using the LSASS exploit (TCP port 445).

6/16: Boxed-A, B Launch DoS Attacks

Trojan.Boxed.A and B variants are Trojan horses that perform a Denial of Service (DoS) attack on certain Web sites.

6/16: Agobot-WR Attacks Weak Passwords

W32/Agobot-WR is an IRC backdoor Trojan and network worm.

6/16: Rbot-AV Spreads to Remote Shares

W32/Rbot-AV is a worm that attempts to spread to remote network shares.

615: Paps.A@mm Disguised as Attachment

W32.Paps.A@mm is a mass-mailing worm that sends itself as an attachment to the email addresses that it finds on a computer.

6/15: StartPage Changes Browser Settings

StartPage is a trojan that when executed, modifies certain Internet Browser settings.

6/15: EPOC.Cabir Spreads Via Bluetooth

EPOC.Cabir is a proof-of-concept worm that replicates on Nokia Series 60 phones.

6/15: Rbot-AS Attacks Weak Passwords

W32/Rbot-AS is a worm that attempts to spread to remote network shares.

6/15: Rbot-AQ Uses Remote Shares

W32/Rbot-AQ is a worm that attempts to spread to remote network shares.

6/14: Dansh.worm!irc an IRC Bot

W32/Dansh.worm!irc is an IRC bot that is intended to propagate via various mechanisms.

6/14: Qhosts.apd a Modified Hosts File

Qhosts.apd is a modified HOSTS file.

6/14: Plexus.a@mm, Plexus.b@mm Spreading

W32/Plexus.a@MM and its b variant are worms that propagate through different vectors.

6/14: Spybot-CO Spreads via KaZaA Network

W32/Spybot-CO is a P2P worm that spreads via the KaZaA file sharing network.

6/14: Korgo.G Exploits LSASS Flaw

Worm_Korgo.G, previously detected as Worm_Korgo.F, propagates by exploiting a flaw in the Windows LSASS (Local Security Authority Subsystem Service), which is a buffer overrun that allows remote code execution and enables an attacker to gain full control of the affected system.

Articles by eSecurityPlanet.com Staff

Topic Centers

Articles by Type

Contact Us

More Security