Malware: Archive: November 2006

tnegA.A is a backdoor that attempts to connect to a certain server, in order to gain remote access to the affected computer and take action that compromises user confidentiality.

11/29: Looked.BK Virus Spreads by Infecting Exe Files

W32.Looked.BK is a virus that spreads by infecting executable files.

11/29: Fujacks.A Worm Uses Weak Passwords to Spread

W32.Fujacks.A is a worm that spreads through network shares protected by weak passwords.

11/29: Mytob-IF Worm and Trojan Receives Remote Commands

W32/Mytob-IF is a worm and IRC backdoor Trojan for the Windows platform.

11/29: Rjump-H Worm Copies Itself to Mapped Drives

W32/RJump-H is a worm for the Windows platform.

11/29: Looked-BA Virus Infects Exe Files

W32/Looked-BA is a virus.

11/29: Zlob-WT a Downloader Trojan

Troj/Zlob-WT is a downloader Trojan for the Windows platform.

11/29: IrcBot.AIV Worm Receives Remote Control Commands

IrcBot.AIV is a worm that connects to several IRC servers in order to receive remote control commands, acting as a backdoor.

11/29: Nuwar.PO Worm Uses Own Engine to Send Mail

Worm_Nuwar.PO spreads copies of itself as an attachment to an email message, which it sends to target recipients using its own Simple Mail Transfer Protocol (SMTP) engine.

11/28: Stration-AJ Worm Downloads, Runs Software

For at least the second time this month, security vendor Sophos has issued an alert for W32/Stration-AJ, a worm for the Windows platform.

11/28: Spake-A Trojan Contacts Remote Server

Troj/Spake-A is a Trojan for the Windows platform.

11/28: Dloadr-AQN Trojan Downloads, Runs New Software

Troj/Dloadr-AQN is a Trojan for the Windows platform.

11/28: Banker.FLO Trojan Monitors Internet Traffic

Banker.FLO is a Trojan that monitors Internet traffic generated when the user accesses web pages related to certain online banking entities: Banco do Brasil, Bradesco, Itau and Santander Banespa.

11/28: Agent-DSF Trojan Contacts Remote Server

Troj/Agent-DSF is a Trojan for the Windows platform.

11/28: Zlob-WQ Trojan Contacts Remote Server

Troj/Zlob-WQ is a Trojan for the Windows platform.

11/28: Clagger-AN a Downloading Trojan

For the second time this month, security vendor Sophos has issued an alert for Troj/Clagger-AN, a downloading Trojan for the Windows platform.

11/28: Stration-CD a Mass-Mailing Worm

W32/Stration-CD is a mass-mailing worm for the Windows platform.

11/28: Spybot.ACYR Worm Spreads Via mIRC

W32.Spybot.ACYR is a worm that spreads through mIRC and to network shares protected by weak passwords.

11/27: Strat.GT Worm Mass-Mails Copies of Trojan

Worm_Strat.GT propagates by mass-mailing copies of TROJ_STRAT.GT to target recipients using its own Simple Mail Transfer Protocol (SMTP) engine.

11/27: NtRootK-AX Trojan Installs Two Drivers

Troj/NtRootK-AX is a backdoor Trojan with rootkit functionality.

11/27: Strat.GT Trojan Arrives as Email Attachment

Troj_Strat.GT is a Trojan that arrives as an attachment to email messages mass-mailed by the malware detected by Trend Micro as WORM_STRAT.GT.

11/27: Rbot-FWY Worm Exploits Buffer Overflow Flaws

W32/Rbot-FWY is a worm for the Windows platform that includes IRC Backdoor functionality.

11/27: Nebuler-N Trojan Targets Windows

Troj/Nebuler-N is a Trojan for the Windows platform.

Oracle Facing Zero-Day Onslaught?

Security researcher warns that he's got at least week's worth of Oracle bugs and he's going to start releasing one a day.

11/22: Looked-AY Virus and Worm Spreads to Network Systems

W32/Looked-AY is a virus and worm for the Windows platform.

11/22: Dloadr-AQK a Downloading Trojan

Troj/Dloadr-AQK is a downloading Trojan for the Windows platform.

11/22: Strat.GN Part of Infectious Trojan-Worm Partnership

Troj_Strat.GN is part of a Trojan-worm partnership that creates a vicious infection cycle.

11/22: Looked-A a Windows Executable Virus and Worm

W32/Looked-A is a Windows executable virus and network worm.

11/21: Clagger-AK Trojan Downloads, Runs New Software

Troj/Clagger-AK is a Trojan for the Windows platform.

11/21: Backdoor.Singu.C Trojan Opens Back Door

Backdoor.Singu.C is a Trojan horse that opens a back door on the compromised computer.

11/21: Pardona-B Virus Continues Wreaking Havoc on Files

For the second time this month, security vendor Sophos has issued an alert for W32/Pardona-B, a virus for the Windows platform.

11/21: Looked-AX Virus Gives Intruder Remote Access

W32/Looked-AX is a virus that can also spread via network shares.

11/21: Stration-AJ Worm Downloads, Runs New Software

W32/Stration-AJ is a worm for the Windows platform.

11/21: Pardona.A Worm Gathers Email Addresses

W32.Pardona.A@mm is a mass-mailing worm that gathers email addresses from the compromised computer.

11/21: Banker.FJI Trojan Displays Fake Login Screens

Banker.FJI is a Trojan that displays fake login screens when the user accesses the online banking entities Banco do Brasil, Brad. Juridico, Bradesco, CEF, GERENCIADOR or Itau.

11/21: Vixup-BZ Trojan Targets Windows

Troj/Vixup-BZ is a Trojan for the Windows platform.

11/21: Banload.BHP Trojan May Arrive as Spam Attachment

Troj_Banload.BHP is a Trojan that may arrive on a system as a file attached to a spammed email message, dropped by other malware, or downloaded by an unsuspecting user when visiting malicious Web sites.

11/22: QQRob-ABA Trojan Targets Windows

Troj/QQRob-ABA is a Trojan for the Windows platform.

11/20: Stration.EC Worm Downloads Files from Internet

W32.Stration.EC@mm is a mass-mailing worm that attempts to download files from the Internet.

11/20: Rbot-FWM Worm has IRC Backdoor Functions

W32/Rbot-FWM is a worm with IRC backdoor functionality for the Windows platform.

11/20: VB-CRJ Trojan Targets Windows

Troj/VB-CRJ is a Trojan for the Windows platform.

11/20: Strat.GG Worm Uses Other Malware to Spread

Worm_Strat.GG is a worm that attains its full propagation potential by employing another malware, specifically TROJ_STRAT.GG.

11/20: Mixor.I Worm Disables Security Programs

W32.Mixor.I@mm is a mass-mailing worm that also disables security related programs.

11/20: Strat.GG Trojan Creates Vicious Infection Cycle

Troj_Strat.GG Trojan is part of a Trojan-worm partnership that creates a vicious infection cycle.

1/20: HLLP.Philis.Br a File-Infecting Virus

W32/HLLP.Philis.br is a file infecting virus.

11/17: Bloodhound.KillAV Detects Malicious Software

Bloodhound.KillAV is a heuristic detection for malicious software that attempts to end security-related processes.

11/17: Pardona-B Virus Infects .Exe Files, Modifies Others

W32/Pardona-B is a virus for the Windows platform.

11/17: Spybot.ALRD Worm Opens Back Door

W32.Spybot.ALRD is a network-aware worm that opens a back door on the compromised computer.

11/17: Silly-E Worm Spreads to Other Network Systems

W32/Silly-E is a worm for the Windows platform.

11/17: Tilebot-HN Worm Exploits Flaws

W32/Tilebot-HN is a worm for the Windows platform.

11/17: Pagipef Virus Infects .Exe Files, Copies Itself

W32.Pagipef is a virus that infects .exe files and copies itself to remote drives and removable drives.

11/17: Backdr-C Trojan Gives Intruder Remote Access

Troj/Backdr-C is a backdoor Trojan for the Windows platform.

11/17: DwnLdr-FVG a Downloader Trojan

Troj/DwnLdr-FVG is a downloader Trojan for the Windows platform.

11/17: Zlob-NW a Downloader Trojan

Troj/Zlob-NW is a downloader Trojan for the Windows platform.

11/17: BatKill-A Trojan Targets Windows

Troj/BatKill-A is a Trojan for the Windows platform.

11/17: USBAgent Virus Copies Itself to Floppys, Flash Drives

W32/USBAgent is a virus that copies itself into floppy drives and flash drives.

11/17: Trojan.Realor Infects RealMedia .Rmvb Files

Trojan.Realor is a Trojan horse that spreads by infecting RealMedia .rmvb files.

11/17: Realor.A Worm Targets Real Media Player Files

Worm_Realor.A employs a unique way of affecting systems.

New Worm Counts On Admins Being Slow To Patch

Virus creators reverse engineer Microsoft patch and hope you haven't plugged the hole yet.

11/17: Sality.V!inf Detects Files Infected by Sality.V Virus

W32.Sality.V!inf is a detection for files that are infected by the W32.Sality.V virus.

11/17: Sality.V Virus Infects Executable Files to Spread

W32.Sality.V is a virus that spreads by infecting executable files.

11/16: Popwin Trojan Displays Ads on Compromised System

Trojan.Popwin is a Trojan horse that opens a back door and displays advertisements on the compromised computer.

11/16: Looked-AV Virus Gives Intruder Remote Access

W32/Looked-AV is a virus that can also spread via network shares.

11/16: Lineag-AEG Trojan Still in the Wild

For the second time this month, security vendor Sophos has issued an alert for Troj/Lineag-AEG, a Trojan for the Windows platform.

Automated Patching Helping Zero-Day Exploits

Latest SANS Institute top 20 list puts IE and Office squarely in hackers crosshairs. Are efforts to protect them fueling the rise?

11/16: QQPass-AKL a Password-Stealing Trojan

Troj/QQPass-AKL is a password stealing Trojan for the Windows platform.

11/15: USBAgent Virus Copies Itself Onto Drives

W32/USBAgent is a virus that copies itself into floppy drives and flash drives.

11/15: Proxy-EU Trojan Lets Attacker Route Traffic

Troj/Proxy-EU is a Trojan for the Windows platform.

11/15: Mona-B an Instant Messenger and Email Worm

W32/Mona-B is an instant messenger and email worm for the Windows platform.

11/15: Wantok Worm Copies Itself, Displays Message

W32.Wantok is a worm that copies itself to all local drives on the compromised computer and displays a message when executed.

11/15: WinSpy-L Trojan Contacts Remote Server

Troj/WinSpy-L is a Trojan for the Windows platform.

11/15: Kibik.Dr Virus Overwrites Explorer.exe, Injects Files

W32/Kibik.dr is a virus that overwrites explorer.exe, injects a DLL file into system processes and stays memory resident.

11/15: Semail.B Worm Arrives as Email Attachment

Worm_Semail.B arrives on a system as an attachment to an email message.

11/15: Yabi.AI Trojan May be Downloaded, Dropped, Spammed

Trend Micro has received reports of Troj_Yabi.AI Trojan being in the wild.

11/15: Sevensaw Trojan Drops Filter, Logs Strokes

Trojan.Sevensaw is a Trojan horse that drops a keyboard filter driver to log keystrokes and sends the stolen information to the author.

11/14: Pardona-A Virus Infects .Exe Files, Modifies Others

W32/Pardona-A is a virus for the Windows platform.

11/14: Psyme-DD an HTML-Based Trojan

Troj/Psyme-DD is a HTML-based downloader Trojan that exploits the ADODB stream vulnerabilty associated with Microsoft Internet Explorer to silently download a file from a remote website to the affected computer.

11/14: Sniffer-M Trojan Monitors Network Traffic

Troj/Sniffer-M is a Trojan for the Windows platform.

11/14: Realor Worm Inserts Malicious Hyperlink on System

W32/Realor.worm scans the infected machine for existing RealMedia (*.rmvb) files and insert a malicious external hyperlink.

11/14: DelSpy-E Trojan May Inject Code Into Processes

For at least the second time this month, security vendor Sophos has issued an alert for Troj/DelSpy-E, a Trojan for the Windows platform.

11/14: Lewor.A a Parasitic File Infector

W32/Lewor.a is a parasitic file infector that can spread over USB storage devices, network drives, shared folders and QQ instant messenging.

11/14: Bancos-API Trojan Targets Windows

Troj/Bancos-API is a Trojan for the Windows platform.

11/14: Tilebot-HX Worm Exploits Flaws

W32/Tilebot-HX is a worm for the Windows platform.

11/14: Madangel.B Virus Infects Local Drives, Network Shares

W32/Madangel.b is a parasitic file infector and network virus that searches local drives and network shares for executable files and infects them with the exception of windows system files.

11/14: Tellsky Worm Spreads Via Mapped Drives

W32.Tellsky is a worm that spreads through mapped drives.

11/14: Fujacks.A Worm Uses Weak Passwords to Spread

W32.Fujacks.A is a worm that spreads through network shares protected by weak passwords.

11/14: Backdoor.Bias Trojan Downloads Other Risks

Backdoor.Bias is a Trojan horse that downloads other risks onto the compromised computer.

11/14: Abul 64-Bit Windows Virus Compresses Files

W64.Abul is a 64-bit Windows virus that compresses infected files so that the file size is not increased.

11/14: Clagger-AJ Trojan Contacts Remote Server

Troj/Clagger-AJ is a Trojan for the Windows platform.

11/13: Levona-B Worm Also a Backdoor Trojan

W32/Levona-B is a worm and backdoor Trojan for the Windows platform.

11/13: Dloadr-APL Trojan Still in the Wild

For the second time this month, security vendor Sophos has issued an alert for Troj/Dloadr-APL, a Trojan for the Windows platform.

11/13: Lineag-AEG Trojan Continues to Spread

Less than a week after it first surfaced, security vendor Sophos has issued another alert for Troj/Lineag-AEG, a Trojan for the Windows platform.

11/13: Infostealer.Gampass Trojan Steals Game Information

Infostealer.Gampass is a generic detection for a Trojan Horse that steals online game accounts, such as Lineage, Ragnarok online and Rexue Jianghu.

11/13: Dropper-MA Trojan Drops Other Trojan

Troj/Dropper-MA is a Trojan for the Windows platform.

11/13: Sohanad.AE Worm Arrives as Download

TrendLabs has received reports about Worm_Sohanad.AE propagating in the wild.

11/13: Lecna.D Worm Spreads Exploiting Windows Flaw

W32.Lecna.D is a worm that spreads by exploiting the Microsoft Windows LSASS Buffer Overrun Vulnerability (as described in Microsoft Security Bulletin MS04-011).

11/13: Pitkom-C Trojan Performs Multiple Functions

Troj/Pitkom-C is a Trojan for the Windows platform.

11/10: Vanity-A Trojan Injects Code Into Remote Processes

Troj/Vanity-A is a Trojan for the Windows platform.

11/10: Agent-DGY Trojan Targets Windows

Troj/Agent-DGY is a Trojan for the Windows platform.

11/10: Dref-O Worm and Parasitic Virus Infects Files

W32/Dref-O is a mass-mailing worm and parasitic virus for the Windows platform.

11/10: SymbOS.Romride.J Trojan Drops Corrupt Files

SymbOS.Romride.J is a Trojan horse that runs on the Symbian OS, which is used as the operating system for Nokia Series 60 cellular telephones.

11/10: Tilebot-FY Worm and Trojan Exploits Flaws

W32/Tilebot-FY is a worm and IRC backdoor Trojan for the Windows platform.

11/10: Rbot-FUO Worm Has IRC Backdoor Functions

W32/Rbot-FUO is a network worm with IRC backdoor functionality.

11/10: Tibs-PF a Downloading Windows Trojan

Troj/Tibs-PF is a downloading Trojan for the Windows platform.

11/10: SymbOS.Romride.I Trojan Drops Files, Component

SymbOS.Romride.I is a Trojan horse that runs on the Symbian OS, which is used as the operating system for Nokia Series 60 cellular telephones.

11/10: Mancsyn.AI Trojan Downloads Malicious Files

Troj_Mancsyn.AI is a Trojan that usually arrives as a file dropped by other malware.

Six Fixes Due From Microsoft

No Office problems this time, just Windows-related issues.

11/10: Horst.GF Trojan is Downloaded or Dropped

Troj_Horst.GF is a Trojan that usually arrives as a file downloaded unknowingly by a user when visiting malicious Web sites or as a file dropped by other malware, specifically by WORM_MEDBOT.AI.

11/9: Lineag-AED a Backdoor Trojan

Troj/Lineag-AED is a backdoor Trojan for the Windows platform.

11/9: Nordex-A Trojan Contacts Remote Server

Troj/Nordex-A is a downloading Trojan for the Windows platform.

1/9: Medbot-B a Multi-Component Windows Worm

W32/Medbot-B is a multi-component worm for the Windows platform.

11/9: Psyme-DD an HTML-Based Downloader Trojan

Troj/Psyme-DD is a HTML-based downloader Trojan that exploits the ADODB stream vulnerability associated with Microsoft Internet Explorer to silently download a file from a remote website to the affected computer.

11/9: Etyb-A Virus Overwrites Windows System Files

W32/Etyb-A is a virus for the Windows platform.

11/9: Zlob-NW a Downloader Trojan

Troj/Zlob-NW is a downloader Trojan for the Windows platform.

11/9: Backterra-F Worm Targets Peer-to-Peer File Networks

W32/Backterra-F is a worm for the Windows platform that targets peer-to-peer file share networks.

11/9: Vanebot-F Trojan Spreads Multiple Ways

W32/Vanebot-F is a Trojan for the Windows platform.

11/9: Spamta.LZ Worm Sends Trojan Via Email

Spamta.LZ is a worm that sends the Trojan detected as SpamtaLoad.BE via email in a message that contains a double-extension file as an attachment.

11/9: Stration.BO Worm Downloads, Runs New Software

W32/Stration-BO is a worm for the Windows platform.

11/9: Small.FAD Trojan is Downloaded or Dropped

Trend Micro has received reports about Troj_Small.FAD Trojan spreading in the wild.

11/9: Usbalex Worm Spreads Via Mapped Drives

W32.Usbalex is a worm that spreads through mapped drives.

11/8: DwnLdr-FVC Trojan Targets Windows

Troj/DwnLdr-FVC is a Trojan for the Windows platform.

11/8: Lowzone-DP a Windows Trojan

Troj/Lowzone-DP is a Trojan for the Windows platform.

11/8: Mytob-JJ Worm Still in the Wild

For the second time in less than a month, security vendor Sophos has issued an alert for W32/Mytob-JJ, a worm for the Windows platform.

11/8: Rungbu-C a Companion Virus

W32/Rungbu-C is a companion virus for the Windows platform.

11/8: Lineag-AEG Trojan Targets Windows

Troj/Lineag-AEG is a Trojan for the Windows platform.

11/8: Tibs-PD Email Relaying Trojan Still Flourishing

For the second time in less than a month, security vendor Sophos has issued an alert for Troj/Tibs-PD, an email relaying Trojan for the Windows platform.

11/8: Backdoor.Bifrose.G Trojan Sends Information to Server

Backdoor.Bifrose.G is a Trojan horse that opens a back door and sends information to a remote server.

11/8: BagleDL-BQ Trojan Contacts Remote Server

Troj/BagleDL-BQ is a Trojan for the Windows platform.

11/8: Nordex Trojan Masquerades as Windows Patch

Nordex is a Trojan that is delivered via a spammed fake email directing users to visit a fixed Wikipedia article that claims to contain a patch for a new variant of the Blaster worm.

11/8: Infostealer.Huaxiat Trojan Steals Game Passwords

Infostealer.Huaxiat is a Trojan horse that steals passwords to the Chinese online game 'Huaxia II ONLINE.'

11/8: Pintae.A Worm Spreads Through Network Shares

W32.Pintae.A@mm is a mass-mailing worm that also spreads through network shares.

11/7: Clerix-B an Information-Stealing Trojan

Troj/Clerix-B is an information-stealing Trojan for the Windows platform.

11/7: Dref-N Worm Also a Parasitic Virus

W32/Dref-N is a mass-mailing worm and parasitic virus with IRC backdoor functionality for the Windows platform.

11/7: DelSpy-E Trojan May Inject Code Into Other Processes

For the second time in less than a month, security vendor Sophos has issued an alert for Troj/DelSpy-E, a Trojan for the Windows platform.

11/7: Nubys-A Virus Infects .Exe Files

W32/Nubys-A is a virus for the Windows platform.

11/7: Stration.DW Worm Emails Itself to Other Computers

W32.Stration.DW@mm is a worm that spreads by emailing itself to other computers.

11/7: Dloadr-APL Trojan Continues to Spread

For the second time in less than a week, security vendor Sophos has issued an alert for Troj/Dloadr-APL, a Trojan for the Windows platform.

11/7: RJump-G Worm May Copy Itself to Devices

W32/RJump-G is a worm for the Windows platform.

11/7: HTML_Agent.GKS a Proof-of-Concept HTML File

HTML_Agent.GKS is the Trend Micro detection for a proof-of-concept HTML file, hosted on a certain Web site, which exploits a new vulnerability in Internet Explorer (IE) that allows the execution of possibly malicious files using the account of the currently logged on user.