If you came to this page directly, click the icon at the left to be taken to our Home Page |
|
| If you came to this page directly, click the icon at the left to be taken to our Home Page |
|
|
|
|||
|
|
January 2005 Select the links for detailed information and removal tools for the latest viruses
Backdoor.Sdbot.AI Backdoor.Sdbot.AI is a network-aware worm with back door capabilities. It allows a remote attacker to gain unauthorized access to the infected computer and spreads via network shares. Compromises
security settings: Opens a back door on the infected computer. Read
the full Symantec report here
W32.Rahack W32.Rahack is a worm that spreads to computers running Radmin software by exploiting weak passwords to connect to the Radmin server. Payload:
Allows unauthorized remote access Read
the full Symantec report here
W32.Looked.B W32.Looked.B is a worm that downloads a file and then infects .exe files. The worm also spreads through shared folders. Modifies
files: Prepends itself to .exe files. Read
the full Symantec report here
W32.Spybot.HUR W32.Spybot.HUR is a worm that has distributed denial of service and back door capabilities. The worm spreads to network shares protected by weak passwords and by exploiting system vulnerabilities. Payload:
Opens a back door. Read the full Symantec report here Backdoor.Sdbot.AJ Backdoor.Sdbot.AJ is a network-aware worm with back door capabilities that spreads via network shares and allows a remote attacker to gain unauthorized access to the compromised computer. Payload:
Opens a back door. Read the full Symantec report here W32.Kobot.B W32.Kobot.B is a worm that spreads through open network shares, telnet, dameware, realserv, VNC, and niprint. This worm also uses three remotely exploitable Windows vulnerabilities to propagate. The worm can also function as an email relay and as a proxy for HTTP and SOCKS. The worm uses multiple vulnerabilities to spread, including:
Payload:
Allows unauthorized remote access. Read the full Symantec report here W32.Linkbot.H
W32.Linkbot.H is a worm that exploits the Microsoft Windows LSASS Buffer Overrun Vulnerability (Microsoft Security Bulletin MS04-011) in order to propagate. It also creates a back door on the system accessible through IRC. Payload:
Allows unauthorized remote access. Read the full Symantec report here W32.Mugly.D@mm W32.Mugly.D@mm is a worm that uses its own SMTP engine to spread by sending itself as an email attachment to addresses gathered from the compromised computer. The worm also drops and runs a W32.Randex variant. Large scale
e-mailing: Sends a copy of itself to all addresses found on the compromised
computer. Read the full Symantec report here W32.Mugly.F@mm W32.Mugly.F@mm is a worm that uses its own SMTP engine to spread by sending itself as an email attachment to addresses gathered from the compromised computer. The worm also drops and runs a W32.Spybot.Worm variant. Large scale e-mailing: Sends a copy of itself to all addresses found on the compromised computer.Name of attachment: attached.zip Read the full Symantec report here W32.Mugly.E@mm W32.Mugly.E@mm is a worm that uses its own SMTP engine to spread by sending itself as an email attachment to addresses gathered from the compromised computer. The worm also drops and runs a W32.Spybot.Worm variant. Due to the
threat potential and increased prevalance in the wild, Symantec Security
Response has upgraded W32.Mugly.E@mm from a Category 1 to a Category 2
as of January 14, 2005. Large scale
e-mailing: Sends a copy of itself to all addresses found on the compromised
computer. Read the full Symantec report here Backdoor.Sdbot.AK Backdoor.Sdbot.AK is a network-aware worm that opens a back door and allows a remote attacker to gain unauthorized access to the compromised computer. Payload:
Opens a back door. Read the full Symantec report here W32.Mydoom.AI@mm W32.Mydoom.AI@mm is a mass-mailing worm that uses its own SMTP engine to send itself to email addresses that it finds on an infected computer. Read the full Symantec report here VBS.Rowam.A VBS.Rowam.A is a Trojan horse that attempts to delete files and perform various nuisance actions, including sending email to all addresses in the Microsoft Outlook address book. The email is not a method of propagation. Large scale
e-mailing: May send non-viral email to all addresses in the Outlook address
book. Read the full Symantec report here W32.Zar.A@mm W32.Zar.A@mm is a mass-mailing worm that uses MAPI to send an email to all addresses in the Microsoft Outlook Address Book. This threat is written in Visual Basic. Payload:
Performs a denial of service attack on the domain www.hacksector.de. Read the full Symantec report here Downloader.Admincash Downloader.Admincash is a Trojan horse program that infects the Explorer.exe file, lowers security settings in Windows, and downloads adware and dialers. Payload:
Downloads remote files, which may include adware and dialers. Read
the full Symantec report here
W32.Bropia W32.Bropia is a worm that spreads via Microsoft's MSN Messenger instant message program and drops a variant of W32.Spybot.Worm. Target of infection: Attempts to spread to MSN Messenger contacts. Read the full Symantec report here W32.Mydoom.AL@mm W32.Mydoom.AL@mm is a mass-mailing worm that uses its own SMTP engine to send itself to email addresses that it finds on a compromised computer. It also spreads by using ICQ instant messenger. The worm attempts to exploit the Microsoft Internet Explorer Malformed IFRAME Remote Buffer Overflow Vulnerability (as described in Microsoft Security Bulletin MS04-040). This worm
downloads and runs a copy of Backdoor.Nemog.D. Large scale
e-mailing: Sends a copy of itself to email addresses gathered from the
compromised computer Read the full Symantec report here W32.Mirsa.A@mm W32.Mirsa.A@mm is a mass-mailing worm that uses MAPI to send an email to all addresses in the Microsoft Outlook Address Book. Large scale
e-mailing: Sends emails to addresses in the Outlook Address Book. Read
the full Symantec report here
W32.Nodmin@mm W32.Nodmin@mm is a mass-mailing worm that alters computer settings and spreads via file sharing networks. The worm also attempts to lower security settings by terminating and disabling various anti-virus and security related programs. Large scale
e-mailing: Sends itself to addresses harvested from files on the local
system. Read the full Symantec report here W32.Blatic.A W32.Blatic.A is a worm that spreads through network shares and has back door functionality allowing it to receive commands from a remote attacker through IRC channels. Payload:
Opens a back door. Read the full Symantec report here W32.Salga.B@mm W32.Salga.B@mm is a mass-mailing worm that uses Microsoft Outlook to send itself to all the email addresses that it finds in the Outlook Address Book. It also attempts to spread through mIRC, file sharing networks, and network shares. Large scale
e-mailing: Sends itself to email addresses it finds in the Microsoft Outlook
Address Book. Read
the full Symantec report here
W32.Crowt.A@mm W32.Crowt.A@mm is a mass-mailing worm that opens a back door, logs keystrokes and emails itself to all addresses in the Microsoft Outlook Address Book. The email has a variable subject and attachment name. The attachment has a .exe file extension. Payload:
Allows unauthorized remote access. Read
the full Symantec report here
Backdoor.Berbew.O Backdoor.Berbew.O is a Trojan horse program that steals passwords from a compromised computer. The Trojan opens a back door and allows a remote attacker to have unauthorized access to the compromised computer. The Trojan also attempts to lower security settings in Internet Explorer. Payload:
Opens a back door and allows the computer to be used as a covert proxy.
Read the full Symantec report here W32.Mydoom.AM@mm W32.Mydoom.AM@mm is a mass-mailing worm that uses its own SMTP engine to send itself to the email addresses that it finds on the infected computer. It also propagates through popular peer-to-peer networks. The email will have a variable subject and attachment name. The attachment will have a .bat, .cmd, .exe, .pif, .scr, or .zip file extension. W32.Mydoom.AM@mm is a minor variant of W32.Mydoom.AG@mm. Large scale
e-mailing: Sends itself to addresses harvested from the infected machine.
Read the full Symantec report here W32.Ahker.B@mm W32.Ahker.B@mm is a mass-mailing worm that sends itself to all addresses in the Windows Address Book. The worm also disables several Widnows security features. Large scale e-mailing: Sends email to all addresses in the Windows Address Book.Modifies files: Modifies the hosts file. Compromises security settings: Disables several Windows security features. Subject of email: Service Pack 2 BUG!! Name of attachment: Fix_SP2.zip Read the full Symantec report here W32.Beagle.AY@mm W32.Beagle.AY@mm is a mass-mailing worm that also spreads through file-sharing networks. The email will have a variable subject and attachment name. The attachment will have a .com, .cpl, .exe, or .scr file extension. Large scale
e-mailing: Sends email to addresses collected from the infected computer.
Read
the full Symantec report here
W32.Mugly.G@mm W32.Mugly.G@mm is a worm that uses its own SMTP engine to spread by sending itself as an email attachment to addresses gathered from the compromised computer. The email will have a variable subject line and a variable attachment name. The attachment will have a .scr file extension. Payload:
Drops and executes a W32.Spybot.Worm variant. Read the full Symantec report here W32.Bropia.C W32.Bropia.C is a worm that propagates using MSN Messenger and drops a variant of W32.Spybot.Worm. Payload:
Drops and executes a W32.Spybot.Worm variant. Read the full Symantec report here W32.Beagle.AZ@mm W32.Beagle.AZ@mm is a mass-mailing worm that also spreads through file-sharing networks. The email will have a variable subject and attachment name. The attachment will have a .com, .cpl, .exe, or .scr file extension. Large scale
e-mailing: Sends email to addresses collected from the infected computer. Read
the full Symantec report here
W32.Spybot.IVQ W32.Spybot.IVQ is a worm that has distributed denial of service and back door capabilities. The worm spreads to network shares, MySQL servers, and Microsoft SQL servers protected by weak passwords and by exploiting system vulnerabilities. Payload:
Allows unauthorized remote access. Read the full Symantec report here W32.Beagle.BA@mm W32.Beagle.BA@mm
is a mass-mailing worm that uses its own SMTP engine to spread to peer-to-peer
and file sharing networks. It opens a back door on the compromised computer
and attempts to lower security settings. The worm may also download and
execute remote files. Payload:
Downloads remote files. Read
the full Symantec report here
Backdoor.Sdbot.AM Backdoor.Sdbot.AM is a network-aware worm with back door and denial of service capabilities. The worm spreads via network shares and allows a remote attacker to gain unauthorized access to the compromised computer. Releases
confidential info: Allows unauthorized remote access. Read the full Symantec report here Backdoor.Sdbot.AN Backdoor.Sdbot.AN is a worm with back door capabilities that gives an attacker remote access to the compromised computer via IRC channels. Releases
confidential info: Allows unauthorized remote access. Read
the full Symantec report here W32.Cissi.W W32.Cissi.W is an IRC bot worm with back door capabilities that propagates through Windows network shares. Compromises
security settings: Allows unauthorized remote access. Read the full Symantec report here W32.Mydoom.AN@mm W32.Mydoom.AN@mm is a mass-mailing worm that downloads a copy of Backdoor.Nemog.D. The email has a variable subject and attachment name. The attachment will have a .cpl, .exe, .pif, .scr, or .zip file extension. The worm can also spread using ICQ instant messenger. The worm attempts to lower security settings by terminating and disabling various antivirus and security-related programs. Payload: Downloads Backdoor.Nemog.D.Large scale e-mailing: Sends an email to addresses gathered from the compromised computer. Modifies files: Modifies the Hosts file. Compromises security settings: Lowers security settings by blocking access to Web sites and ending processes. Subject of email: Varies Name of attachment: Varies with a .cpl, .exe, .pif, .scr, or .zip file extension Size of attachment: 61,385 bytes Target of infection: Attempts to spread via ICQ messenger. Read
the full Symantec report here
Backdoor.Sdbot.AO Backdoor.Sdbot.AO is a worm with back door capabilities that gives an attacker remote access to the compromised computer via IRC channels. Payload:
Allows unauthorized remote access. Read the full Symantec report here VBS.Gormlez@mm VBS.Gormlez@mm is a mass-mailing worm that sends a copy of itself to all email addresses in the Windows Address Book and attempts to spread through file-sharing networks. The worm deletes files with a .dll, .vbs, .exe, or .wsh extension. Large scale
e-mailing: Sends email to every contact in the Windows Address Book. Read the full Symantec report here W32.Mugly.H@mm W32.Mugly.H@mm is a worm that uses its own SMTP engine to spread by sending itself as an email attachment to addresses gathered from the compromised computer. The email will have a variable subject line and a variable attachment name. The attachment will have a .scr file extension. The worm also drops and runs a variant of W32.Spybot.Worm. Payload:
Drops and executes a W32.Spybot.Worm variant. Read the full Symantec report here W32.Sober.J@mm W32.Sober.J@mm is a mass-mailing worm that uses its own SMTP engine to send itself to email addresses it gathers from the compromised computer. The subject of the email varies and is in either English or German. The email sender address is spoofed. The name of the email attachment varies, and it has a .bat, .com, .pif, .scr, or .zip file extension. The attachment may also have a double extension. Large scale
e-mailing: Sends an email to addresses found on the compromised computer.
Read
the full Symantec report here
W32.Mydoom.AO@mm W32.Mydoom.AO@mm is a mass-mailing worm that uses its own SMTP engine to send itself to the email addresses that it finds on the infected computer. It also propagates through popular peer-to-peer networks. The email will have a variable subject and attachment name. The attachment will have a .bat, .cmd, .exe, .pif, .scr, or .zip file extension. Large scale e-mailing: Sends itself to addresses harvested from the infected machine.Modifies files: Modifies the hosts file. Compromises security settings: Disables anti-virus and firewall applications. Subject of email: Varies Name of attachment: Varies with a .bat, .cmd, .exe, .pif, .scr, or .zip file extension Read the full Symantec report here |
|
©
Copyright 1999 - 2005 The Computer Wizard
|
||||
