If you came to this page directly, click the icon at the left to be taken to our Home Page |
|
| If you came to this page directly, click the icon at the left to be taken to our Home Page |
|
|
|
|||
|
|
February 2005 Select the links for detailed information and removal tools for the latest viruses
W32.Bropia.J W32.Bropia.J is a worm that propagates using MSN Messenger and drops a variant of W32.Spybot.Worm. Payload:
Drops and executes a W32.Spybot.Worm variant. Read
the full Symantec report here
W32.Dopbot W32.Dopbot is a worm that has distributed denial of service and back door capabilities. The worm spreads by exploiting the Microsoft Windows DCOM RPC Interface Buffer Overrun Vulnerability, (described in Microsoft Security Bulletin MS03-026). Payload:
Allows unauthorized remote access. Read the full Symantec report here W32.Gaobot.CII W32.Gaobot.CII is a network-aware worm that has back door capabilities and can be controlled through IRC channels. It attempts to lower security settings by blocking access to security-related Web sites and terminating processes. It spreads by exploiting vulnerabilities. Payload Trigger:
Allows unauthorized remote access. W32.Bropia.L W32.Bropia.L is a worm that propagates using MSN Messenger and drops a variant of W32.Spybot.Worm. Payload:
Drops and executes a W32.Spybot.Worm variant. Read
the full Symantec report here
W32.Mydoom.AR@mm W32.Mydoom.AR@mm is a mass-mailing worm that that uses its own SMTP engine to send itself to the email addresses that it finds on an infected computer. It also attempts to spread through file-sharing networks. Large scale
e-mailing: Sends itself to addresses gathered from the compromised computer.
Read
the full Symantec report here
W32.Kipis.J@mm W32.Kipis.J@mm is a mass-mailing worm that that uses its own SMTP engine to send itself to the email addresses that it finds on an infected computer. It also attempts to spread through file-sharing networks. Large scale
e-mailing: Sends itself to addresses gathered from the compromised computer.
Read the full Symantec report here W32.Mydoom.AS@mm W32.Mydoom.AS@mm is a mass-mailing worm that uses its own SMTP engine to send itself to email addresses that it finds on the compromised computer. It also propagates through file sharing networks. The email will have a variable subject and attachment name. The attachment will have a .bat, .cmd, .exe, .pif, .scr, or .zip file extension. Large scale
e-mailing: Sends itself to email addresses gathered from the compromised
computer. Read the full Symantec report here W32.Mydoom.AU@mm W32.Mydoom.AU@mm is a mass-mailing worm that uses its own SMTP engine to send itself to email addresses that it gathers from a compromised computer. This worm is a minor variant of W32.Mydoom.AM@mm. Large scale
e-mailing: Sends a copy of itself to email addresses gathered from the
compromised computer. Read the full Symantec report here W32.Aimdes.A@mm W32.Aimdes.A@mm is a simple worm that propagates via AOL Instant Messenger and email. Large scale
e-mailing: Sends itself via email to all addresses in the Microsoft Outlook
address book. W32.Randex.COX W32.Randex.COX is a network-aware worm that spreads to network shares protected by weak passwords. The worm also opens a back door on the compromised computer and may be remotely controlled via IRC channels. Payload:
Allows unauthorized remote access. Read the full Symantec report here W32.Bropia.N W32.Bropia.N is a worm that drops a variant of W32.Spybot.Worm and propagates using MSN Messenger. Ports: TCP port 6667. Read the full Symantec report here W32.Spybot.JPB W32.Spybot.JPB is a network-aware worm that has distributed denial of service and back door capabilities. The worm spreads to network shares protected by weak passwords and by exploiting vulnerabilities. Payload:
Allows unauthorized remote access. Read the full Symantec report here W32.Ahker.D@mm W32.Ahker.D@mm is a mass-mailing worm that uses MAPI to send a copy of itself to email addresses gathered from the compromised computer. The email has a variable subject and an attachment named patch.zip. The worm lowers security settings, prevents access to several Web sites, and blocks access to several programs. Payload:
Downloads a remote file. Read the full Symantec report here W32.Aimdes.C@mm W32.Aimdes.C@mm is a simple worm that propagates via AOL Instant Messenger and email. The email has a variable subject and an attachment named patch.zip. Payload:
Ends system processes, sends mails. Read the full Symantec report here W32.Mydoom.AX@mm W32.Mydoom.AX@mm is a mass-mailing worm that uses it own SMTP engine to send email to addresses that it retrieves from the Windows Address Book on the infected computer. Payload:
Drops a back door Trojan. Downloads and executes a back door Trojan. Read the full Symantec report here Download the Removal Tool here W32.Kipis.K@mm W32.Kipis.K@mm is a mass-mailing worm that lowers security settings and opens a back door on the compromised computer. The email has a variable subject and attachment name. The attachment will have a .exe, .scr, or .zip file extension. Payload:
Allows unauthorized remote access. Read
the full Symantec report here W32.Doxpar W32.Doxpar is a network-aware worm that has distributed denial of service and back door capabilities. The worm spreads by exploiting vulnerabilities. Note: Further investigation has revealed that the Microsoft Windows Server Message Block Handlers Remote Buffer Overflow Vulnerability (as described in the Microsoft Security Bulletin MS05-011) is not exploited by this threat. This information has been removed. Payload:
Performs denial of service attacks, downloads remote files, acts as a
covert proxy. W32.Derdero.A@mm W32.Derdero.A@mm is a mass-mailing worm that uses it own SMTP engine to send email to addresses that it retrieves from the Windows Address Book. The email will have a variable subject and attachment name. The attachment will have It also attempts
to spread through file-sharing programs and infects all .exe files on
the C drive. Large scale
e-mailing: Sends itself to addresses found in the Windows Address Book.
Read the full Symantec report here W32.Mydoom.AZ@mm W32.Mydoom.AZ@mm is a mass-mailing worm that uses it own SMTP engine to send an email to addresses that it retrieves from Windows Address book on the infected computer. Payload:
Downloads and executes a back door Trojan Read the full Symantec report here Download the Removal Tool here W32.Kipis.L@mm W32.Kipis.L@mm is a mass-mailing worm that lowers security settings, opens a back door on the compromised computer and exploits the Microsoft Internet Explorer ITS Protocol Zone Bypass Vulnerability (BID 9658). Read
the full Symantec report here W32.Derdero.B@mm W32.Derdero.B@mm
is a mass-mailing worm that uses its own SMTP engine to send an email
to addresses that it retrieves from the Windows Address Book. Large scale
e-mailing: Sends itself to addresses found in the Windows Address Book.
Read the full Symantec report here W32.Derdero.C@mm W32.Derdero.C@mm is a mass-mailing worm that uses it's own SMTP engine to send an email to addresses that it retrieves from the Windows Address Book. It also attempts to spread through file-sharing programs. Large scale
e-mailing: Sends itself to addresses found in the Windows Address Book.
Read the full Symantec report here W32.Jumpred.A W32.Jumpred.A is a worm that spreads through IRC channels using the MIRC client. The worm also copies itself to the A drive and attempts to copy itself to file-sharing networks. Payload:
Modifies the Internet Explorer start page and closes windows. Read the full Symantec report here W32.Mydoom.BA@mm W32.Mydoom.BA@mm is a mass-mailing worm that uses it own SMTP engine to send email to addresses that it gathers from the Windows Address Book on a compromised computer. Payload:
Downloads and executes a back door Trojan. Read the full Symantec report here Download the Removal Tool here W32.Sober.K@mm W32.Sober.K@mm is a mass-mailing worm that uses its own SMTP engine to send itself to email addresses gathered from a compromised computer. The email will be in either English or German. Large scale
e-mailing: Sends an email to addresses gathered from a compromised computer.
Read the full Symantec report here W32.Bropia.P W32.Bropia.P is a worm that drops a variant of W32.Spybot.Worm and propagates using MSN Messenger. Degrades
performance: May affect network performance by consuming bandwidth. Read
the full Symantec report here
W32.Bropia.Q W32.Bropia.Q is a worm that propagates using MSN Messenger. Degrades
performance: May affect network performance by consuming bandwidth. Read
the full Symantec report here
W32.Mydoom.BB@mm W32.Mydoom.BB@mm is a mass-mailing worm that uses it own SMTP engine to send email to addresses that it gathers from the Windows Address Book on a compromised computer. This worm is a minor varinat of W32.Mydoom.BA@mm. Payload:
Downloads and executes a back door Trojan. Read the full Symantec report here W32.Dumaru.Y@mm!enc W32.Dumaru.Y@mm!enc is an .enc detection for MIME-encoded files that contain the W32.Dumaru.Y@mm worm. Read the full Symantec report here W32.Bropia.R W32.Bropia.R is a worm that spreads via MSN Messenger and drops a variant of W32.Spybot.Worm. Payload:
Dropped W32.Spybot.Worm allows unauthorized remote access. Read the full Symantec report here W32.Assiral@mm W32.Assiral@mm is a mass-mailing worm that sends a copy of itself to email addresses gathered from a compromised computer. Large scale
e-mailing: Sends an email to addresses gathered from the compromised computer.
Read the full Symantec report here W32.Ahker.E@mm W32.Ahker.E@mm is a mass-mailing worm that uses MAPI to send a copy of itself to email addresses gathered from the compromised computer. The worm lowers security settings, prevents access to several Web sites, and blocks access to several programs. Payload:
Performs a denial of service attack. Read the full Symantec report here W32.Stang W32.Stang is a worm that spreads via Microsoft's MSN Messenger instant message program, and attempts to terminate processes and lower security settings. The worm also disables the Task Manager and Registry Editor. Causes system
instability: Ends Lsass.exe may cause the system to shut down. Read the full Symantec report here W32.Spybot.KAI W32.Spybot.KAI is a worm that propagates through file sharing networks. The worm opens a back door on the compromised computer allowing a remote attacker to have unauthorized access via IRC channels. Payload:
Allows unauthorized remote access. Read the full Symantec report here W32.Looked.C W32.Looked.C is a worm that downloads a remote file and infects .exe files. The worm lowers security settings and spreads through network shares protected by weak passwords. Payload:
Downloads a PWSteal.Trojan. Read the full Symantec report here W32.Derdero.E@mm W32.Derdero.E@mm is a mass-mailing worm that uses it own SMTP engine to send an email to addresses gathered from a compromised computer. The worm lowers security settings and attempts to spread through file-sharing programs. Large scale
e-mailing: Sends an email to addresses gathered from the compromised computer.
Read the full Symantec report here W32.Randex.CST W32.Randex.CST is a network aware worm that spreads to network shares protected by weak passwords. The worm also opens a back door on the compromised computer and may be remotely controlled via IRC channels. Payload:
Allows unauthorized remote access. Read the full Symantec report here W32.Inforyou.A@mm W32.Inforyou.A@mm is a mass-mailing worm that sends itself to email addresses gathered from the compromised computer using its own SMTP engine. Payload Trigger:
Performs denial of service attacks. Read the full Symantec report here W32.Kipis.M@mm W32.Kipis.M@mm is a mass-mailing worm that spreads by sending an email to addresses it finds on a compromised computer and by copying itself to network shares. Large scale e-mailing: Sends an email to addresses gathered from the compromised computer. Read the full Symantec report here W32.Mytob@mm W32.Mytob@mm is a mass-mailing worm that uses it own SMTP engine to send an email to addresses that it retrieves from the Windows Address Book on the infected computer. The worm also has W32.Spybot.Worm functionalities such as a IRC Back door and the capability to spread through the network by exploiting the Microsoft Windows LSASS Buffer Overrun Vulnerability (described in Microsoft Security Bulletin MS04-011). Large scale
e-mailing: Sends itself to email addresses gathered from the compromised
computer Read the full Symantec report here W32.Conycspa.G@mm W32.Conycspa.G@mm is a mass mailing worm that downloads and executes files from the Internet. Payload:
Downloads and executes remote content. Read
the full Symantec report here
W32.Holcas.A@mm W32.Holcas.A@mm is a mass-mailing worm that uses MAPI commands to send itself to all addresses found in the Microsoft Outlook Address book. It also attempts to send itself via IRC. The email has the following characteristics: Subject:
hola como estas, ;o) Read the full Symantec report here W32.Elitper.A@mm W32.Elitper.A@mm is a mass-mailing worm that spreads using MAPI and through file-sharing networks. It also lowers Windows security settings by preventing access to antivirus-related Web sites. Large scale
e-mailing: Sends a copy of itself to email addresses gathered from the
compromised computer. Read the full Symantec report here W32.Mytob.B@mm W32.Mytob.B@mm is a mass-mailing worm that uses it own SMTP engine to send an email to addresses that it gathers from the Windows Address Book on the compromised computer. The worm also has the ability to open a back door and spread through the network by exploiting the Microsoft Windows Local Security Authority Service Remote Buffer Overflow (described in Microsoft Security Bulletin MS04-011). Payload:
Opens a back door. Read
the full Symantec report here
Download
the Removal Tool here W32.Mytob.C@mm W32.Mytob.C@mm is a mass-mailing worm that uses it own SMTP engine to send an email to addresses that it gathers from the Windows Address Book on the compromised computer. The worm also has the ability to open a back door and spread through the network by exploiting the Microsoft Windows Local Security Authority Service Remote Buffer Overflow (described in Microsoft Security Bulletin MS04-011). Payload:
Opens a back door. Read
the full Symantec report here
W32.Spybot.KHC W32.Spybot.KHC is a worm that has distributed denial of service and back door capabilities. The worm spreads to network shares protected by weak passwords and by exploiting vulnerabilities. Payload:
Allows unauthorized remote access. Read the full Symantec report here Trojan.Tooso.B Trojan.Tooso.B is a Trojan horse that attempts to disable security-related software by terminating processes, stopping services, removing registry entries, and deleting files. It has been reported that Trojan.Tooso.B is being emailed out by copies of W32.Beagle.BG@mm and W32.Beagle.BH@mm. Payload:
Downloads and executes arbitrary code. Read the full Symantec report here |
|
©
Copyright 1999 - 2005 The Computer Wizard
|
||||
