Malware: Archive: November 2004

11/30: Mugly-A Worm Executes Second Worm

Mugly.A is a worm that drops and executes another worm, detected by Panda Software as W32/Gaobot.BXG.worm.

11/30: SymbOS/Skulls-B is a Trojan

SymbOS/Skulls.b is a trojan that is similar to its predecessor, SymbOS/Skulls.a.

11/30: Jabbit-A Virus Infects HTML Files

Jabbit.A is a virus that infects the HTML files that are located in the directory where it is run.

11/30: Symb/Cabir-B Worm Targets Cell Phones

Symb/Cabir-B is a worm written specifically for Nokia Series 60 mobile phones running the Symbian operating system.

11/30: Dloader-EP a Downloader Trojan

Troj/Dloader-EP is a downloader Trojan.

Stemming the Flood of Patches

Some IT administrators and analysts say automation is the only answer when it comes to handling the deluge of software patches.

11/30: Mugly-B Second Variant of the Day

W32/Mugly.b@mm is another variant of the Mugly email worm that was discovered today.

Most Net users aren't aware that spammers use software programs called harvesters to gather the hundreds of millions of e-mail addresses they spam. Now a group of white hats want to make harvesting too risky -- and you can help.

11/29: Banker-AG Trojan Steals Bank Info

Troj/Banker-AG is a Trojan for the Windows platform that attempts to steal confidential information when a user visits banking-related websites.

11/29: QLowZones-2 Modifies IE Settings

QLowZones-2 is a detection for multiple Trojans, all of which have the same standard characteristics, according to McAfee.

11/29: Setclo Worm Copies Itself to Shares

W32.Setclo is a worm that propagates by copying itself to any open network shares it locates.

11/29: Garroch Worm Mails Itself to Contacts

W32.Garroch@mm is a simple worm that sends itself to all addresses it finds in the Microsoft Outlook address book.

11/29: Forbot-CW Worm Exploits Shares

W32/Forbot-CW is a worm that attempts to spread to remote network shares and computers vulnerable to common exploits.

11/29: Bancban-AH a Password-Stealing Trojan

Troj/Bancban-AH is a password-stealing Trojan targeted at customers of certain Brazilian banks.

11/29: Sality-H a Prepending Virus

W32/Sality-H is a prepending virus that also acts as a keylogger.

11/29: JS/Spawn-C an Encoded Worm

JS/Spawn-C is a version of the JS/Spawn-A worm, which is encoded to prevent detection.

When a Zero-Day Visits You

Do you know what to do when a zero-day exploit meanders onto your systems?

Be Better Prepared for the Coming Disaster

eSecurityPlanet's columnist Ken van Wyk says we should take a page from the history books -- the anniversary of the Morris Internet Worm to be exact. Heed these lessons when planning Incident Response.

11/29: Netsky-AE a Mass-Mailing Worm

W32/Netsky-AE is a mass-mailing worm of the Netsky family.

11/24: Anzae-C a Spanish Mass-Mail Worm

W32/Anzae-C is a Spanish mass-mailing worm.

11/23: Tasin-C Worm Spreads Via Email

Tasin.C is a worm that spreads via e-mail in a message with variable characteristics.

11/23: Yanz-B Worm Written in MSVC

W32/Yanz.b@mm is a mass-mailing worm written in MSVC that contains its own SMTP engine to construct outgoing messages.

11/23: Anzae-A a Spanish Mass-Mail Worm

W32/Anzae-A is a Spanish mass-mailing worm.

11/23: Tasin-B Worm Deletes Several File Types

Tasin.B is a worm that spreads via e-mail in a message with variable characteristics.

11/23: Backdoor.Sdbot.AH a Network-Aware Worm

Backdoor.Sdbot.AH is a network-aware worm with backdoor capabilities that spreads via network shares and allows a remote attacker to gain unauthorized access to the infected computer.

11/23: Tasin-A Worm a 'High-Level Threat'

Security vendor Panda Software has issued a high threat level for Tasin.A, a worm that spreads via e-mail in a message with variable characteristics.

11/23: Fasvsin-A a Peer-to-Peer Worm

W32/Favsin-A is a peer-to-peer and email worm for the Windows platform.

11/23: Agobot-OD Worm Lets Intruders In

W32/Agobot-OD is a network worm that allows unauthorized remote access to the computer via IRC channels.

11/23: Backdoor.Jupdate Lets Attacker In

Backdoor.Jupdate is a backdoor program that allows a remote attacker to download and execute files on an infected machine.

11/23: JS.Gynamed a JScript Virus

JS.Gynamed is a JScript virus that infects other JScript files.

11/23: BackDoor-CLK Trojan Copies Itself

BackDoor-CLK is a back door Trojan that when executed, copies itself to the %Sysdir% folder as CSMSS.EXE.

11/23: Exploit-DoubleExt Targets IE Flaw

Exploit-DoubleExt targets a vulnerability in Microsoft Internet Explorer (IE) allowing a malicious website to bypass the 'download security warning' feature in Microsoft Windows XP SP2.

Analysts: Expect More Ad Server Attacks

Security analysts say attacks via ad servers are likely to continue. Another reason not to use IE?

11/23: Anzae-B Worm Sends Spanish Email

W32/Anzae.B is a mass-mailing worm written in MSVB.

11/22: Sober-I a Mass-Mailing Worm

Security vendors have issued alerts for W32.Sober.I@mm, a mass-mailing worm that uses its own SMTP engine to spread by sending itself as an email attachment to addresses gathered from the infected computer.

11/22: Narod-D a Password-Stealing Trojan

Troj/Narod-D is a password stealing Trojan for the Windows platform.

11/22: Troj/Banker-AM Steals Bank Info

Troj/Banker-AM is a Trojan that steals bank details.

11/23: Trojan.Vundo Displays Pop-Ups

Trojan.Vundo is a component of an adware program that downloads and displays popup advertisements.

11/22: Trojan Exploits IE Flaw

Exploit-IEDobExt is a Trojan that exploits a vulnerability in Microsoft Internet Explorer (IE) that allows a malicious website to bypass the 'download security warning' feature in Microsoft Windows XP SP2.

11/22: Backdoor-CLK Trojan Copies Itself

BackDoor-CLK is a backdoor Trojan that is executed it copies itself to the %Sysdir% folder as CSMSS.EXE.

11/22: Trojan Targets Nokia Phones

Some security vendors have issued alerts for SymbOS/Skulls, a Trojan written for Nokia Series-60 phones.

11/22: Swizzor-BQ Trojan Downloads, Runs Files

Troj/Swizzor-BQ is a downloader Trojan that attempts to download and run executable files without the user's consent.

11/19: Forbot-CP Worm Opens Remote Access

W32/Forbot-CP is a worm that attempts to spread to remote network shares.

11/19: Agobot-OC a Trojan and Worm

W32/Agobot-OC is an IRC backdoor Trojan and network worm.

11/19: Rbot-QE Worm Spreads Via Shares

W32/Rbot-QE is a network worm that attempts to spread via network shares.

11/19: Alerts Go Out for Sober-I Worm

Several security vendors have issued an alert for Sober.I, a worm that does not have any destructive effects.

11/19: Backdoor.Sdbot-AF Spreads Via Shares

Backdoor.Sdbot.AF is a backdoor Trojan horse program that spreads via network shares and allows a remote attacker to gain unauthorized access to the compromised system.

11/19: Sober-J Another Mass-Mailer Worm

W32/Sober.j@MM is a new variant of this mass-mailer, compressed with UPX, which sends itself to harvested mail addresses found on an infected machine.

11/19: Sdbot-AG Trojan Lets Hacker In

Backdoor.Sdbot.AG is a network-aware worm with backdoor capabilities that spreads via network shares and allows a remote attacker to gain unauthorized access to the infected computer.

Father of Spam Speaks Out on His Legacy

In a one-on-one interview with the man known as the Father of Spam, he talks about the role he's played in the Internet's history, if he has any regrets, and if he would do it all over again.

11/18: Ng.695 a DOS Virus

Ng.695 is a DOS virus that infects .COM files.

11/18: Yanz-A Worm Spreads Via Email

Yanz.A is a worm that opens the TCP port 67 and listens to it.

11/18: Bagle-BG Worm Opens TCP Port

Bagle.BG is a worm that opens the TCP port 2002 and listens to it, waiting for remote connections.

11/18: Primat-C a Prepending Virus

W32/Primat-C is a prepending virus and network worm.

11/18: Rbot-PY Worm Lets Intruders In

W32/Rbot-PY is a network worm that contains IRC backdoor Trojan functionality, allowing unauthorized remote access to the infected computer.

11/18: Drew-A Worm Deletes Files

Drew.A is a worm that deletes all the files with a TXT and HTM extension.

Safety First With Latest AOL 9.0

The ISP launches another version of its latest software client with emphasis placed on security and lots of free stuff.

New Spiritual Spam Preys on the Faithful

An email security company is reporting that the amount of religious spam has jumped in the past few weeks, tempting the faithful to clog their company network.

11/17: Rbot-PX a Worm and Backdoor Trojan

W32/Rbot-PX is a network worm and IRC backdoor Trojan for the Windows platform.

11/17: Agobot-NZ Worm Targets Passwords

W32/Agobot-NZ is a backdoor Trojan and worm that spreads to computers protected by weak passwords.

11/17: Netjoe Trojan Grants Access

Backdoor.Netjoe is a backdoor Trojan horse program that allows a remote attacker to have unauthorized access to an infected computer.

11/7: Berbew-L Trojan Steals Passwords

Backdoor.Berbew.L is a Trojan horse program that steals passwords from an infected computer.

11/17: Wootbot-DI Worm Exploits Many Flaws

Worm_Wootbot.DI is a memory-resident worm that arrives and propagates through network shares.

11/17: Mofei-E Worm Hides Itself

W32/Mofei-E will attempt to spread to network shares protected by weak passwords.

Microsoft Irked With Security Firm's IE Alert

Secunia says XP SP2 users are at risk from new IE vulnerabilities.

Virus-Powered Phishing Unleashed

Security researchers are warning of a new Trojan that hijacks users' banking information, allowing hackers to empty their accounts.

11/16: Golten-A Worm Fakes Arafat Message

Trend Micro is reporting it has received several reports of Worm_Golten.A being mass-mailed to specific email addresses.

11/16: Vidlo-G a Downloader Trojan

Troj_Vidlo.G is a downloader Trojan that is either installed by a malicious Web site or by other malware and adware.

11/16: Rbot-PU Worm Lets Hackers In

W32/Rbot-PU is a worm that attempts to spread to remote network shares.

11/16: Agobot-NX an IRC Trojan & Worm

W32/Agobot-NX is an IRC backdoor Trojan and network worm.

11/16: Mirchack-D Reads Configuration Data

Troj/Mirchack-D is a hacked version of the mIRC32 application.

11/16: Beagle-AX Worm Opens Backdoor

W32.Beagle.AX@mm is a mass-mailing worm that also spreads through file-sharing networks.

Buying into SCM -- The Price of Protection

Increased security concerns, along with compliance needs, are pushing the adoption of Secure Content Management software. Why is it needed and what can it do?

Simplifying SCM with Appliances

11/15: Downloader-SH Trojan Written in Delphi

Downloader-SH is a Trojan that is UPX packed and written in Delphi.

11/15: Vundo.dldr Trojan Installed via HTML Page

Vundo.dldr is a Trojan that was recently installed via an HTML page that contained the Exploit-IframBO Trojan.

11/15: Rbot-NK Worm Spreads to Remote Shares

W32/Rbot-NK is a worm that attempts to spread to remote network shares.

11/15: Forbot-CJ Worm Scans Machines

W32/Forbot-CJ is a network worm that spreads by scanning for vulnerable machines.

11/15: Protoride-W a Windows Worm

W32/Protoride-W is a Windows worm that spreads to computers via network shares.

11/15: Ssik-A a Windows Worm

W32/Ssik-A is a worm for the Windows platform.

11/15: Envid-A a Mass-Mailing Worm

W32.Envid.A@mm is a mass-mailing worm that sends an email to all addresses in the Microsoft Outlook address book.

11/15: Backdoor.Selka Lets Attacker In

Backdoor.Selka is a backdoor program that allows a remote attacker to obtain unauthorized access to an infected computer.

11/15: Trojan.Webus-D Opens Backdoor

Trojan.Webus.D is a Trojan horse program that connects to an IRC server and opens a backdoor on the compromised system.

11/12: Trojan.Minuka Sends Messages

Trojan.Minuka is a Trojan horse that sends Short Message Service (SMS) messages to mobile phone users.

11/12: Banker-FA Trojan Steals Passwords

Troj/Banker-FA is a password-stealing Trojan aimed at customers of a Brazilian bank.

11/12: Rbot-PS a Windows Worm, Trojan

W32/Rbot-PS is a network worm and IRC backdoor Trojan for the Windows platform.

11/12: Scard Worm Attacks Via NetBIOS

W32.Scard is a worm with backdoor functionality that uses a NetBIOS attack to spread to systems that have weak passwords.

11/12: Forbot-CI an IRC Trojan and Worm

W32/Forbot-CI is an IRC backdoor Trojan and network worm for the Windows platform.

11/12: Cran.A Exploits Windows Flaw

The W32/Cran.worm.a spreads by exploiting a Microsoft Windows vulnerability [MS04-011 vulnerability (CAN-2003-0533)].

11/12: Bofra-G a Mass-Mailing Worm

W32/Bofra-G is a mass-mailing worm for the Windows platform.

11/11: Moo-B a Downloader Trojan

Trojan.Moo.B is a downloader Trojan that exploits Microsoft Internet Explorer Malformed IFRAME Remote Buffer Overflow Vulnerability (as described in Bugtraq ID 11515).

11/11: Krepper-L Downloads Components

Troj/Krepper-L is Trojan that attempts to download further components through Internet Explorer address space.

11/11: Bofra-E Worm Uses SMTP Engine

W32/Bofra-E is a mass-mailing worm for the Windows platform.

11/11: Delf-HA Trojan Sends Spam

Troj_Delf.HA uses affected machines as a platform to send out spam messages to mobile phones via SMS.

11/11: Mydoom-AJ Worm Exploits IE Flaw

W32.Mydoom.AJ@mm is a mass-mailing worm that exploits Microsoft Internet Explorer Malformed IFRAME Remote Buffer Overflow Vulnerability (BID 11515).

11/11: Bofra-D a Mass-Mailing Worm

W32/Bofra-D is a mass-mailing Worm for the Windows platform.

11/11: Trojan. Beagooz-D Steals Addresses

Trojan.Beagooz.D is a Trojan horse program that collects email addresses from the infected computer and sends them to a remote server.

Fraud Often Mistaken for Identity Theft

The buzz in the media and an advertising blitz have blurred the line between fraud and identity theft, according to TowerGroup. The result is an identity fraud epidemic that doesn't really exist.

11/11: Masteq-H Trojan Runs Silently

Troj/Mastseq-H is a backdoor Trojan that runs continuously in the background providing various services to a remote intruder.

11/10: Mydoom-AF Worm Opens Port

Mydoom.AF is a worm that opens the port 6667 and attempts to connect to several IRC servers.

11/10: IFRAME.BoF Trojan Uses IE Flaw

IFRAME.BoF is an exploit for a buffer overrun vulnerability that occurs in Internet Explorer v6.0 running on Windows XP/2000 computers.

11/10: Rbot-PJ Worm Also a Trojan

W32/Rbot-PJ is a network worm that attempts to spread via network shares.

11/10: Mydoom-AE Worm Links to Servers

Mydoom.AE is a worm that opens the port 6667 and attempts to connect to several IRC servers.

11/10: Rbot-PH Worm Allows Access

W32/Rbot-PH is a worm that attempts to spread to remote network shares and contains backdoor Trojan functionality, allowing unauthorized remote access to the infected computer.

11/10: Orpheus-A Worm Opens Backdoor

W32.Orpheus.A is a network-aware worm that opens a backdoor on the infected host.

11/10: Gavir-A Worm Runs Trojan

Gavir.A is a worm that downloads and runs the Trojan Legmir.BM in the affected computer.

11/10: Theug-B Worm Spreads Via Files

Theug.B is a worm that does not have direct destructive effects.

Security Vendors Stumping For Certification

Saying companies like Cisco, Symantec and McAfee are making claims they can't back up, four vendors ask them to prove it through certification.

11/9: Forbot-CF Worm Attacks Files

W32/Forbot-CF is a network worm and IRC backdoor Trojan for the Windows platform.

11/9: Mydoom-AI a Mass-Mailing Worm

W32.Mydoom.AI@mm is a mass-mailing worm that exploits the Microsoft Internet Explorer Malformed IFRAME Remote Buffer Overflow Vulnerability (BID 11515).

11/9: Bofra-B Worm Offers Webcam View

W32/Bofra-B is a Worm for the Windows platform that arrives via email.

11/9: Rbot-PG Worm also a Trojan

W32/Rbot-PG is a network worm and backdoor Trojan for the Windows platform.

11/9: Mydoom-AH Worm Exploits IE Flaw

W32.Mydoom.AH@mm is a mass-mailing worm that exploits the Microsoft Internet Explorer Malformed IFRAME Remote Buffer Overflow Vulnerability (BID 11515).

New MyDoom Variant Aims at IE Hole

New variant of the virus takes advantage of Iframe vulnerability in IE.

Microsoft Plugs ISA Vulnerability

11/9: StartPa-Do Trojan Attacks IE

Troj/StartPa-Do is a browser hijacking Trojan.

11/8: Rbot-PE Worm Has Trojan Functions

W32/Rbot-PE is a worm that attempts to spread via remote network shares.

11/8: Trojan.Beagooz Collects Addresses

Trojan.Beagooz is a Trojan that collects and sends email addresses to a remote server.

11/8: Linkbot-A Exploits LSASS Flaw

W32.Linkbot.A is a worm that exploits the Microsoft Windows LSASS Buffer Overrun Vulnerability (described in Microsoft Security Bulletin MS04-11) in order to propagate.

11/8: Rbot-PC Worm Targets Weak Shares

W32/Rbot-PC is a member of the W32/Rbot family of worms with a backdoor component that spreads on weakly protected network shares on the Windows platform.

11/8: Backdoor.Maxload Attacks Linux, Unix

Backdoor.Maxload is a backdoor Trojan horse that affects Linux and Unix computers and allows unauthorized remote access to an infected computer.

11/8: Getegold.A Trojan Eyes E-Gold Accounts

Troj_Getegold.A specifically targets users with e-gold accounts.

11/8: Randex-BTB Worm Targets Passwords

W32.Randex.BTB is a network aware worm that spreads to network shares protected by weak passwords.

11/8: Mydoom-AG Uses Zero Day Attack

W32/Mydoom.ag@MM makes use of a zero day attack targeting a Microsoft Internet Explorer IFRAME buffer overflow vulnerability.

11/8: VBS.Midfin an Encryped Worm

VBS.Midfin@mm is an encrypted VBScript mass-mailing worm.

11/8: Forbot-CD Network Worm and Trojan

W32/Forbot-CD is a network worm and IRC backdoor Trojan for the Windows platform.

11/8: IRC.Bifrut Trojan Lets Attacker In

Backdoor.IRC.Bifrut is a Trojan horse program that opens a backdoor and allows a remote attacker to control the compromised system through IRC and FTP channels.

11/8: Bofra-A Worm Arrives Via Email

W32/Bofra-A is a Worm for the Windows platform that arrives via email.

11/8: Bancban-AC Trojan Steals Passwords

Troj/Bancban-AC is a password-stealing Trojan targeted at customers of certain Brazilian banks.

11/8: Gaobot-BQJ a Network-Aware Worm

W32.Gaobot.BQJ is a network-aware worm that opens a backdoor and can be controlled through IRC channels.

11/5: Mitglieder.AY Worm Ends Processes

Mitglieder.AY is a worm that ends processes belonging to applications that provide updates for different antivirus programs.

11/5: Citifraud.A Trojan Exploits IE Flaw

Panda Software has issued a high threat alert for Citifraud.A, a Trojan that exploits the Internet Explorer vulnerability Improper URL Canonicalization.

11/5: Rbot-PA Worm Has Backdoor Functions

W32/Rbot-PA is a network worm with IRC backdoor functionality.

11/5: Backdoor.Hacarmy-F Lets Intruders In

Backdoor.Hacarmy.F is a backdoor server program that allows unauthorized remote access to an infected computer.

11/5: Rbot-OY Worm Targets Weak Passwords

W32/Rbot-OY is a network worm and IRC backdoor Trojan.

11/5: Sdbot-QX a Worm and Trojan

W32/Sdbot-QX is a network worm and a backdoor Trojan, which runs in the background as a service process and allows unauthorized remote access to the computer via IRC channels.

11/5: Backdoor.Ranky-L Enables Attacker

Backdoor.Ranky.L is a backdoor server program that allows a remote attacker to proxy HTTP traffic through a compromised system.

11/5: X97M.Avone-A an Excel Virus

X97M.Avone.A is a virus that infects Excel workbooks and deletes files.

11/5: Rbot-WI Worm Searches For Folders

Worm_Rbot.WI propagates via network shares.

11/4: Rbot-OX Worm Has IRC Functions

W32/Rbot-OX is a network worm with IRC backdoor functionality.

11/4: JS/QHosts21-A a Javascript Trojan

JS/QHosts21-A is a Javascript Trojan that redirects some banking websites to a bogus website for the purpose of gathering information.

11/4: Josam Worm Uses Own SMTP Engine

W32.Josam.Worm is a worm that spreads via email using its own SMTP engine.

11/4: Shodi-D Virus Infects .Exe Files

W32.Shodi.D is a virus that infects .exe files but does not infect system files.

11/4: Famus-F Worm Spreads Via Email

W32/Famus-F is a mass-mailing worm that spreads by sending email messages with itself as an attachment.

11/3: Bagz-H Worm Gathers Addresses

W32.Bagz.H@mm is a mass-mailing worm that uses its own SMTP engine to send itself to the email addresses gathered from a compromised system.

11/3: Backdoor.Alnica OKs Remote Access

Backdoor.Alnica is a Backdoor Trojan that allows unauthorized remote access to an infected computer.

11/3: Agobot-AAN Worm Attacks Passwords

Worm_Agobot.AAN is a memory-resident worm that spreads via network shares.

11/3: Rbot-OV a Worm and Trojan

W32/Rbot-OV is a network worm with IRC backdoor functionality.

11/2: Bagle-dldr Trojan Copies Itself

W32/Bagle.dldr is a Trojan that when executed, copies itself to the %windir%system32 as WINSHOST.EXE (7172 bytes).

11/2: Rbot-OR Worm Allows Remote Access

W32/Rbot-OR is a worm that attempts to spread to remote network shares.

11/2: Rbot-OP Worm Has Backdoor

W32/Rbot-OP is a network worm with IRC backdoor functionality.

11/2: VBS.Yeno-C a Mass-Mailing Worm

VBS.Yeno.C@mm is a mass-mailing worm that sends itself to all the email addresses in the Microsoft Outlook address book.

11/2: VBS.Yeno-B Worm Uses Outlook

VBS.Yeno.B@mm is a mass-mailing worm that sends itself to all the email addresses in the Microsoft Outlook address book.

11/2: Bagz-F Worm Uses Own Engine

Worm_Bagz.F mainly spreads via email.

11/1: Shodi-F Virus Infects .EXE Files

W32/Shodi-F is a prepending virus for the Windows platforms that attempts to infect all files with an EXE extension.

11/1: Leebad-A Worm Copies Files to Root Folder

W32/Leebad-A is a worm for the Windows platform that copies files to the root folder of all functional drives, including network drives.

11/1: Trojan.Ducky-C Exploits Microsoft Flaw

Trojan.Ducky.C is a Trojan horse program that exploits the Microsoft GDI+ Library JPEG Segment Length Integer Underflow vulnerability (described in the Microsoft Security Bulletin MS04-028).

11/1: Fakepatch-A an Elf Executable

Elf_Fakepatch.A is an Elf executable that arrives on a system via email.

AT&T Builds In Network Security

The network operator enhances its managed services with new worm and virus catchers.

11/1: Bagle-BE Worm Opens TCP Port

Bagle.BE is a worm that opens the TCP port 81 and listens to it, waiting for remote connections.

11/1: Rbot-VP Worm Spreads Via Shares

Worm_Rbot.VP is a memory-resident worm that arrives and propagates through network shares.