Malware: Archive: April 2009

4/30: Troj/Agent-JRR Creates Registry Entries

Troj/Agent-JRR is a Trojan for the Windows platform. When first run it copies itself to \Contacts\svchost.exe.

4/30: PW Inspector 1.2 is Password Cracker

PW Inspector 1.2 is a password cracker that uses executable files.

4/30: CoreGuardAntivirus2009 is a Misleading App

CoreGuardAntivirus2009 is a misleading application that may give exaggerated reports of threats on the computer.

4/29: Mal/BHODrop-A is Windows Malware

Mal/BHODrop-A is malware for the Windows platform.

4/29: Troj/Agent-JRM Sets Registry Entries

When run Troj/Agent-JRM copies itself to \twext.exe and sets a registry entry.

4/29: Troj/Dldr-T Connects to a Remote Server.

Troj/Dldr-T attempts to connect to a remote server.

4/28: W32/AutoRun-AGA Copies Itself to the Registry

4/28: W32/AutoRun-AGA copies itself to the registry.

4/28: Troj/Inject-GT is Windows Trojan

Troj/Inject-GT is a trojan on the Windows platform.

4/27: Bancos LOQ Installs Without User Permission

Bancos LOQ is a program that downloads and may execute or install software without user permission.

4/27: W32.Mocon Logs Keystrokes

W32.Mocon is a worm that logs keystrokes and steals information from the infected computer. It spreads by copying itself to removable drives.

Conficker Starts Attacking PCs

Three weeks later than expected, the conficker malware program is gradually starting to attack personal computers.

Defending Firefox from Interest-based Ad Cookies

Although enabling cookies in your browser gives you a lot of advantages, you may still want to block certain cookies. Here’s a guide.

4/24: W32/Anig-B Copies Itself over Network Shares

W32/Anig-B is a worm that can spread by copying itself over network shares. W32/Anig-B can also be used to steal passwords.

4/24: Exp/MS06048-A detects Malicious PowerPoint Presentations

Exp/MS06048-A detects malicious Microsoft PowerPoint presentations that exploit CVE-2006-3590.

4/23: Trojan.Regsubdat.A Attempts to Open a Back Door

Trojan.Regsubdat.A is a Trojan horse that modifies system files and attempts to open a back door on the compromised computer.

4/23: W32.Regsubdat.A!inf is a Detection for Executable Files

W32.Regsubdat.A!inf is a detection for executable files modified by Trojan.Regsubdat.A

4/23: Troj/Boaxxe-K is Windows trojan

Troj/Boaxxe-K is a Windows trojan.

4/23: Troj/DwnLdr-HQE Copies Itself to \winlogon.exe

When run Troj/DwnLdr-HQE copies itself to \winlogon.exe and sets a registry entry.

4/22: MalwareCleaner is Misleading App

MalwareCleaner is a misleading application that may give exaggerated reports of threats on the computer.

4/22: Mal/JSRedir-B is Windows Malware

Mal/JSRedir-B is Windows malware.

4/21: Mal/PDFJs-G uses JavaScript

Mal/PDFJs-G uses JavaScript to install other malicious software.

Mac Botnet Still a Danger, Symantec says

Although there's been negligible activity since the January warning, Mac systems aren't safe.

4/21: Troj/Agent-JPM sets Registry Entries

Troj/Agent-JPM copies itself to \winlogon.exe and sets a number of registry entries.

4/20: Troj/ExpPPT-C is Malicious Powerpoint

Troj/ExpPPT-C is a malicious Powerpoint presentation that attempts to exploit PC vulnerability.

4/20: Virus Melts is Spyware

Virus Melts is rogue "security" software.

4/20: Trojan.Neprodoor Steals Information

Trojan.Neprodoor is a Trojan horse that steals information and downloads files on to the compromised computer.

Phishers Getting More Cunning

McColo is offline, yet phishers are finding a way to continue to score victories.

4/17: Troj/Agent-JPA is Windows Trojan

Troj/Agent-JPA is a Windows Trojan.

4/17: Packed.Generic.221 Detects Encrypted Files

Packed.Generic.221 is a heuristic detection for files that may have been obfuscated or encrypted in order to conceal them from antivirus software.

4/16: Waledac SMS Spy Theme

The new campaign uses a theme whereby the user is enticed to download an application that will permit them to view other people's SMS messages online.

4/16: Troj/Agent-JOL Compromises Windows Computers

Troj/Agent-JOL compromises Windows computers.

4/16: Mal/EncPk-HZ is Windows Malware

Mal/EncPk-HZ is windows malware with low prevalence.

4/15: Mal/FakeAV-AK Installs Fake Anti-Virus

Mal/FakeAV-AK dowloads and installs a fake Anti-Virus application that fraudulently reports a users system as infected and will not clean up these fraudulent reports until the users pays and registers the application.

4/15: W32.SillyPrep Infects .Exe Files

W32.SillyPrep is a generic detection for file infectors that infect .exe files on the compromised computer.

4/15: WORM_NEERIS.A Propagates via Network Shares

WORM_NEERIS.A propagates via network shares.

Twitter Worm Attack Continues

With yet another new variant, the malicious scripting attack still plagues Twitter.

4/14: JS_TWETTIR.A Spreads Via Twitter Profile

JS_TWETTIR.A spreads via Twitter profile.

4/14: W32.Dizan.F Opens Backdoor

W32.Dizan.F is a virus that spreads by infecting executable files. It also opens a back door on the compromised computer.

4/14: Mal/PDFJs-F Use Malicious PDF

Mal/PDFJs-F is a malicious PDF the uses JavaScript to exploit system security.

4/14: Troj/Agent-JNT Delivers Malware via Trojan

Troj/Agent-JNT delivers malware via Trojan.

4/13: JS/Twitter-A is JavaScript Worm

JS/Twitter-A is a JavaScript worm for the Windows platform.

4/13: Troj/Dload-GD Infects Compromised PC

Troj/Dload-GD infects compromised PC.

4/13: Twitter Worm Attack Spreads 10,000 Spam Tweets

According to Twitter, nearly 200 accounts were compromised and some 10,000 messages in total were pegged as being worm spam generated.

4/10: Bancos LIM Installs Software

Bancos LIM, which installs software on a compromised PC, is also know as Generic Downloader.s [McAfee], Trojan-Downloader.Win32.Banload.cdn [Kaspersky], TrojanDownloader:Win32/Agent [MS OneCare], W32/Downldr2.LGD (exact) [F-Prot]

4/10: WORM_WALEDAC.ED Sends Spam

WORM_WALEDAC.ED makes multiple changes to the Windows registry, some of which allow its automatic execution at every system startup.

4/10: Troj/Dloadr-CKI Modifies Registry

The Troj/Dloadr-CKI modifies the registry.

4/10: Troj/DelfInj-C is Windows Trojan

Troj/DelfInj-C is a Windows trojan.

Microsoft says Most File Exploits Avoidable

Consumers need to take responsibility for their PC safety, explains Microsoft.

4/9: W32.Downadup.E Exploits MSFT Windows Server Service

W32.Downadup.E spreads by exploiting the Microsoft Windows Server Service RPC Handling Remote Code Execution Vulnerability.

4/9: Mal/PDFJs-D Uses JavaScript Installs Malware

Mal/PDFJs-D uses JavaScript to install other malicious software.

Conficker a Fake, Mafiaboy Claims

The notorious hacker says "the Internet is still broken" and that the confusion around Conficker proves it.

4/8: Mal/Pandex-B is Windows Malware

Mal/Pandex-B is windows malware.

4/8: Mal/Kouto-B is Rootkit Trojan

Mal/Kouto-B is a family of rootkit Trojans for the Windows platform.

4/8: Mal/Rootkit-J has Three Aliases

Rootkit-J has three aliases: Trojan.Win32.Agent.brxr, Trojan:Win32/Rotker.A, and Infostealer.Gampass

Microsoft: Fear Could be Driving PC Attacks

Consumers have become so concerned about PC virus attacks that they are rushing to install security apps -- many of which are fake and actually install malware.

4/7: Mal/TDSSPack-G is Low Prevalence Malware

Mal/TDSSPack-G is a low prevalence malware.

4/7: Mal/Psyme-G Exploits IE Hole

Mal/Psyme-G is a malicious script that exploits an old Internet Explorer vulnerability to download and execute remote content.

Free Download: Bluecoat Debuts Consumer Web Filtering App

Known for its enterprise-class Web filtering software, Bluecoat releases a free version for consumers. Here's the link to the free download of K9.

Pending Legislation to Combat Mobile Spam

A proposed bill will fight spam by enlarging the powers of the Do-Not-Call registry and the CAN-SPAM Act.

4/6: W32.Woospi Modifies Windows Files

W32.Woospi is a worm that modifies certain Windows system files.

4/6: PHP/C99Shell-D is Trojan with PHP Support

PHP/C99Shell-D is a backdoor Trojan for platforms with PHP support, such as web servers.

4/6: Mal/Psyme-G Exploits IE Hole

Mal/Psyme-G is a malicious script that exploits an old Internet Explorer vulnerability to download and execute remote content.

4/3: Troj/PSW-GT Creates Registry Entries

Troj/PSW-GT is a Trojan for the Windows platform.

4/3: Troj/Iframe-BT Loads Remote Content

When a web page compromised with Troj/Iframe-BT is browsed, the malicious iframe will attempt to load further malicious content from a remote site.

4/3: Troj/MDrop-CAY is Windows Trojan

Troj/MDrop-CAY is Windows Trojan

4/3: Troj/FakeVir-LT is Low Level Trojan

Troj/FakeVir-LT is a Trojan with a low level of prevalence.

4/2: Mal/ObfJS-AV is JavaScript Trojan

Mal/ObfJS-AV is a malicious JavaScript Trojan within a web page.

4/2: Mal/BHO-O is a malicious Browser Helper

Mal/BHO-O is a malicious Browser Helper Object.

Conficker: Did all The Hype Help?

The damage that some predicted from Conficker has failed to materialize, yet the risks haven't gone away.

4/1: Conficker Free Cleanup Offered by Sophos

The free solution for eliminating Conficker infections enables the detection, isolation, and removal of the Conficker virus on your network.

Conficker Prompts New Efforts

The Conficker.C worm has infected about 10 million Windows-based computers in 150 countries, with China's level of infection estimated at 3 million, Brazil at 1 million and Russia at 800,000. In the United States, researchers suspect about 200,000 computers have been infected.

Malware: Archive: April 2009

Topic Centers

Articles by Type

Contact Us

More Security