Articles by eSecurityPlanet.com Staff

7/30: Dropper-O a 'High Threat' Trojan

Panda Software has issued a high threat level for Dropper.O, a Trojan that drops and executes the adware detected by the security vendor as Adware/Nsearch, in the affected computer.

7/30: Backdoor-CHI Lifts MSMoney App Data

BackDoor-CHI is a remote access trojan bearing several characteristics.

7/30: Moridin Macro Virus Infects Word Docs

W97M.Moridin is a macro virus that infects Microsoft Word documents.

7/30: Rbot-FC Runs in Background

W32/Rbot-FC is a worm that attempts to spread to remote network shares.

7/30: Agobot-KM Exploits Weak Passwords

W32/Agobot-KM is a network worm that spreads to other computers by exploiting network services with either weak passwords or unpatched vulnerabilities.

7/30: Tompai-A Has Backdoor Functionality

W32/Tompai-A is a virus with backdoor functionality for the Windows platform.

7/29: Mabutu-B a Mass-Mailing Worm

W32/Mabutu.b@MM is a minor variant of W32/Mabutu.a@MM, a mass-mailing worm with several characteristics.

7/29: Sdbot-KU May Initiate SYNFlood Attacks

W32/Sdbot-KU is an IRC backdoor Trojan and network worm that can run in the background as a service process and allow unauthorized remote access to an intruder via the IRC network.

7/29: Berbew.I Steals Cached Passwords

Backdoor.Berbew.I attempts to steal cached passwords.

7/29: Lovgate-AK a Mass-Mailing Worm

W32.Lovgate.AK@mm is a variant of W32.Lovgate.W@mm.

7/29: Rbot-EW Worm Allows Remote Access

W32/Rbot-EW is a worm that attempts to spread to remote network shares.

7/28: Downloader-NE.dr a New Trojan

Downloader-NE.dr is a downloader dropper trojan packed with FSG and injects a DLL component in to the memory space of the Explorer.exe process.

7/28: Korgo-Z Worm Exploits LSASS Flaw

W32.Korgo.Z is a worm that attempts to propagate by exploiting the Microsoft Windows PCT Buffer Overrun Vulnerability (described in Microsoft Security Bulletin MS04-011) on TCP port 113.

7/28: Small-AO Trojan Allows Remote Control

Troj/Small-AO is a backdoor Trojan.

7/28: Toraja-I Macro Virus Attacks Office 97

OF97/Toraja-I is a macro virus for the Microsoft Office 97 platform.

7/27: Rbot-ET Worm Allows Remote Access

W32/Rbot-ET is a worm that attempts to spread to remote network shares

7/27: Zindos-A Performs DoS Attack on Microsoft.com

W32.Zindos.A is a worm that performs a Denial of Service (DoS) attack against the domain, microsoft.com.

7/27: Zindos Worm Uses MyDoom Backdoor

W32/Zindos.worm is a worm that uses the backdoor of W32/Mydoom.o@MM in order to infect a machine. It also launches a DoS attack against Microsoft.com.

7/27: MyDoom.N Raised to 'Amber Alert'

Panda Software has increased the threat of MyDoom.N to AMBER ALERT.

7/27: Lovgate-AE Worm Spreads Via Email

Lovgate.AE is a worm that propagates via email and network shares.

7/27: Mabutu-A Harvests Email Addresses

W32/Mabutu.a@MM is a mass-mailing with several characteristics.

7/26: MyDoom-M a Mass-Mailing Worm

The W32.MyDoom.M@mm mass-mailing worm performs multiple functions.

7/26: PatchLs-A Creates Exploitable Flaw

Troj/PatchLs-A is a Trojan that attempts to create an exploitable vulnerability within the active LSASS.EXE/LSASRV.DLL process by injecting malicious instructions, which must then be exploited via the normal LSASS interfaces.

7/26: Rbot-EQ Calls Up Remote IRC Server

W32/Rbot-EQ is a member of the W32/Rbot family of worms with backdoor capabilities.

7/26: MyDoom-O Spreads Using SMTP Engine

W32/MyDoom-O is a mass-mailing worm that spreads by emailing itself via its own SMTP engine.

7/26: Lovgate-AT Worm has Backdoor

Lovgate.AT is a worm with backdoor characteristics that uses several techniques in order to spread: e-mail messages, the peer-to-peer (P2P) file sharing program KaZaA, shared network resources, etc.

7/26: Seliuq-D Virus Infects Word Documents

W97M.Seliuq.D is a virus that infects Microsoft Word documents and templates.

7/26: Spybot-CZ Runs in Background

W32/Spybot-CZ is a network worm with backdoor Trojan functionality.

7/26: Rbot-EP is Both a Worm and a Trojan

W32/Rbot-EP is a network worm and an IRC backdoor Trojan.

7/23: Korgo.AC Uses LSASS Vulnerability

Worm_Korgo.AC is a memory-resident worm that propagates across the network by utilizing the LSASS vulnerability, which is a buffer overrun vulnerability that allows remote code execution and enables an attacker to gain full control of an affected system.

7/23: Dluca-CQ an Adware Application

Troj/Dluca-CQ is an adware application, according to Sophos.

7/23: Psyme-AI Downloads, Executes Trojan

Troj/Psyme-AI is a multi-component script Trojan that downloads and executes Troj/Multidr-Y.

7/23: Bagle-ak!proxy Connects to Foreign Sites

W32/Bagle.ak!proxy is a variant that does not mass-mail like previous variants.

7/22: W97M.Kuna Virus Modifies Office Settings

W97M.Kuna is a virus that modifies Microsoft Office configuration settings and infects Microsoft Word documents and the Normal.dot template.

7/22: Agent-B Trojan Hides in Web Sites

Backdoor.Agent.B is a backdoor Trojan that installs a DLL (Dynamic Link Library) on the affected computer when a user visits certain malicious Web sites.

7/22: Sdbot-KM Trojan Opens IRC Channel

W32/Sdbot-KM is an IRC backdoor Trojan and network worm that can run in the background as a service process and allow unauthorized remote access to a remote intruder via the IRC channel.

7/21: Downloader-MY Executes Remote File

Downloader-MY is a downloading trojan that serves only to download and execute a remote file.

7/21: Xordoor Trojan Allows Remote Access

Backdoor.Xordoor is a backdoor Trojan horse that allows unauthorized remote access to a compromised computer.

7/21: Delf-DU Tojan Copies Itself to Windows

Troj/Delf-DU is a backdoor Trojan.

7/21: W97M.Diperis-A a Macro Virus

W97M.Diperis.A is a macro virus that infects Microsoft Word documents and templates.

7/21: Lovgate-V Worm Provides Remote Access

W32/Lovgate-V is a variant of the W32/Lovgate family of worms that spread via email, network shares and filesharing networks.

7/21: MyDoom-N Emails Itself Via SMTP Engine

W32/MyDoom-N is a mass-mailing worm that spreads by emailing itself via SMTP using its own engine.

7/20: Wukill.E Arrives as Executable File

Worm_Wukill.E is a worm that usually arrives as an executable (.EXE) file that uses the folder icon.

7/20: Bancban-C a Password-Stealing Trojan

Troj/Bancban-C is a password stealing Trojan targeted at customers of a Brazilian bank.

7/20: Sdbot-KK Targets Weak Passwords

W32/Sdbot-KK is a worm that attempts to spread to remote shares that have weak passwords.

7/20: Mydoom.L@mm a Mass-Mailing Worm

The W32.Mydoom.L@mm mass-mailing worm performs several functions.

7/20: Mydoom.M Installs DLL to Open TCP Port

Mydoom.M is a worm that installs a dynamic link library (DLL) that opens TCP port 1042 and listens to it, thus behaving as a backdoor.

7/20: Lovgate-AJ Copies Itself to Win Folder

W32/Lovgate-AJ is a Windows worm that spreads via email, network shares and filesharing networks.

7/20: Bagle.AH Worm a 'Severe Threat'

PandaSoftware has issued a severe threat level alert for the new worm Bagle.AH (W32/Bagle.AH.worm).

7/20: Bagle-AL Searches for Email Addresses

W32/Bagle-AI is a member of the W32/Bagle family of email worms. W32/Bagle-AI spreads by emailing itself to addresses found on the infected computer's hard disk.

7/19: Worm_Agist.A Spreads Via Email

TrendLabs has received several infection reports regarding a new worm known as Worm_Agist.A, spreading via email.

7/19: Worm_Korgo.Y Exploits LSASS Vulnerability

Worm_Korgo.Y worm exploits the Windows LSASS vulnerability, which is a buffer overrun that allows remote code execution and enables an attacker to gain full control of the affected system.

7/19: Beagle.AC@mm Uses Own SMTP Engine to Spread

W32.Beagle.AC@mm is a mass-mailing worm that uses its own SMTP engine to spread through email and opens a backdoor on TCP port 1080.

7/19: Rbot-DX Spreads to Remote Shares

W32/Rbot-DX is a worm that attempts to spread to remote network shares.

7/19: Bagle.AG Affects Win XP/2000/NT

Several security vendors have issued high level threat alerts for Bagle.AG, a worm that affects Windows XP/2000/NT computers only.

7/19: Duts-A Infects Pocket PCs

Several security vendors have issued alerts for WCE/Duts-A, a proof-of-concept parasitic virus that infects EXE files for the Pocket PC environment.

7/19: Agobot-KW Worm Copies Itself

W32/Agobot-KW is a network worm that spreads by copying itself to computers protected by weak passwords and via IRC channels.

7/16: Rbot-DY an IRC Backdoor Worm

W32/Rbot-DY is an IRC backdoor worm.

7/16: Rbot-DP Trojan Has Spreading Capability

W32/Rbot-DP is an IRC backdoor Trojan with spreading capability.

7/16: Bagle-Zip is Series of Archived Files

W32/Bagle-Zip is the password-protected archive files created by W32/Bagle-F, W32/Bagle-G, W32/Bagle-H, W32/Bagle-I, W32/Bagle-J, W32/Bagle-K (ZIP archives), W32/Bagle-N, W32/Bagle-O (ZIP and RAR archives), W32/Bagle-W, W32/Bagle-AA and W32/Bagle-AF.

7/16: Bagle.AF a 'Medium Threat Alert'

Several security vendors have issued medium level threat alerts for Bagle.AF, a new variant of the well-known Bagle virus.

7/16: Backdoor.Doster Creates Remote Access

Backdoor.Doster is a Backdoor Trojan horse that attempts to give an attacker access to a computer.

7/16: Beagle.AB@mm Uses SMTP Engine to Spread

W32.Beagle.AB@mm is a mass-mailing worm that uses its own SMTP engine to spread through email and opens a backdoor on TCP port 1080.

7/16: Atak.B a Mass Mailing Worm

W32/Atak-B is a mass mailing worm.

7/16: Rbot-DT Spreads to Remote Shares

W32/Rbot-DT is a worm that attempts to spread to remote network shares.

7/15: AdClicker-AU Installs Itself on System

AdClicker-AU is a Win32 trojan written in Borland Delphi.

7/15: Agobot-KN Sets Up an IRC Channel

W32/Agobot-KN is an IRC backdoor Trojan and network worm that establishes an IRC channel to a remote server in order to grant an intruder access to the compromised computer.

7/15: Rbot-DS Spreads to Remote Shares

W32/Rbot-DS is a worm that attempts to spread to remote network shares.

7/14: Lovgate.AC@mm Exploits Buffer Overrun

W32.Lovgate.AC@mm is a mass-mailing worm that spreads using the Microsoft Windows DCOM RPC Interface Buffer Overrun Vulnerability (described in Microsoft Security Bulletin MS03-026), and through open network shares.

7/14: Cargao Trojan Emails Windows Contacts

Trojan.Cargao is a Trojan horse that sends emails to all contacts it finds in Windows address book.

7/14: Rbot-DR Worm Carries a Backdoor

W32/Rbot-DR is a worm that attempts to spread to remote network shares.

7/14: Agobot-KS Creates Registry Entries

W32/Agobot-KS is an IRC backdoor Trojan and network worm.

7/14: Agobot-KT Trojan Exploits Passwords

W32/Agobot-KT is a backdoor Trojan and worm that spreads to computers protected by weak passwords.

7/13: Korgo-U Worm Exploits LSASS Flaw

W32/Korgo-U is a network worm which uses the LSASS exploit to propagate.

7/13: Lovgate.AC@mm Infects Executable Files

W32.Lovgate.AC@mm is mass-mailing worm that spreads using the Microsoft Windows DCOM RPC Interface Buffer Overrun Vulnerability (described in Microsoft Security Bulletin MS03-026) and through open network shares.

7/13: Rbot-DP an IRC Backdoor Trojan

W32/Rbot-DP is an IRC backdoor Trojan with spreading capability.

7/13: Xebiz.A Trojan Connects to Web Site

Xebiz.A is a Trojan that connects to a specific web site in order to download another Trojan, Zerolin.A, to the affected computer.

7/13: PE-Lovgate.AH is a File Infector

PE-Lovgate.AH is a memory-resident file infector that spreads through email and network shares.

7/13: Lovgate.AG a Memory-Resident Worm

Worm_Lovgate.AG is a memory-resident worm that propagates via email and network shares.

7/13: Beagle.AA@mm Worm Uses SMTP Engine

W32.Beagle.AA@mm is a mass-mailing worm that uses its own SMTP engine to spread through email and opens a backdoor on TCP port 1234.

7/13: Lovgate.AD@mm Uses RPC Vulnerability

W32.Lovgate.AD@mm is mass-mailing worm that spreads using the Microsoft Windows DCOM RPC Interface Buffer Overrun Vulnerability (described in Microsoft Security Bulletin MS03-026) and through open network shares.

7/13: Rbot-DJ Has Backdoor Capabilities

W32/Rbot-DJ is a member of the W32/Rbot family of worms with backdoor capabilities.

7/13: Rbot-DL Empowers Remote Users

W32/Rbot-DL is a network worm and backdoor Trojan for the Windows platform.

7/12: Hardoc@mm Mass Emails Itself

W32.Hardoc@mm is a mass-mailing worm that sends itself to email addresses found in .html files and the Windows address book on the infected computer.

7/12: Lemoor.A Exploits FTP Server Vulnerability

W32.Lemoor.A is a worm that spreads by exploiting a vulnerability in the FTP server component of the W32.Sasser family of worms.

7/12 Atak.A Worm Low Threat but High Traffic

Atak.A is a worm without damaging effects that spreads via e-mail in a message with variable characteristics.

7/12: Lovgate.ah@MM Packed Multiple Times

W32/Lovgate.ah@MM is a new variant of W32/Lovgate that is packed multiple times.

7/12: Keylog-Q Trojan Steals Passwords

Troj/Keylog-Q is a password-stealing Trojan.

7/9: Lovgate.ag@mm Packed Multiple Times

W32/Lovgate.ag@mm, a new variant of W32/Lovgate is packed multiple times.

7/9: Berbew.H Trojan Steals Passwords

Backdoor.Berbew.H is a minor variant of Backdoor.Berbew.G.

7/9: VBS.Gaggle.E Overwrites Files

VBS.Gaggle.E is a variant of VBS.Gaggle.D--a mass-mailing worm that overwrites several files.

7/9: Korgo.X Worm Exploits LSASS Flaw

W32.Korgo.X is a worm that attempts to propagate by exploiting the Microsoft Windows LSASS Buffer Overrun Vulnerability (described in Microsoft Security Bulletin MS04-011) on TCP port 445.

7/9: Rbot-DE Spreads to Remote Shares

W32/Rbot-DE is a worm that attempts to spread to remote network shares.

7/9: HacDef-F a New Backdoor Trojan

Troj/HacDef-F is a backdoor Trojan that is targeted at NT/2000/XP operating systems.

7/8: BackDoor-CFB a DLL Component

BackDoor-CFB is a DLL component that may be installed automatically onto the victim's machine while visiting a web site.

7/8: BackDoor-BDJ Written in MSVC

BackDoor-BDJ is a remote access trojan written in MSVC.

7/8: Padodo-Fam Trojan Steals Passwords

Troj/Padodo-Fam is a family of proxy and backdoor trojans with password-stealing functionality.

7/8: Bagle. AD Worm a 'Medium Threat'

TrendLabs has declared a Medium Risk (YELLOW) alert for WORM_BAGLE.AD, the latest Bagle variant, to control the spread.

7/8: Lovgate.AB@mm Spreads Via Open Shares

W32.Lovgate.AB@mm is mass-mailing worm that also spreads through open network shares.

7/8: Agobot-KM Uses Weak Passwords

W32/Agobot-KM is a network worm that spreads to other computers by exploiting network services with either weak passwords or unpatched vulnerabilities.

Articles by eSecurityPlanet.com Staff

Topic Centers

Articles by Type

Contact Us

More Security