MWBLOG.ORG

Virus Malware and Threat News for 20080426

Infostealer.Gamler

- Infostealer.Gamler at Norton Symantec

Infostealer.Gamler is a Trojan horse that attempts to steal passwords on the compromised computer.
...

TROJ_KILLWIN.AM

- TROJ_KILLWIN.AM at Trend Micro

This Trojan may be dropped by TROJ_SHEZAN.C.When executed, it modifies the system's HOSTS files to prevent
users from accessing certain Web sites. It also redirects users to certain Web sites, possibly to download
files....

Troj/Dload-CA

- Troj/Dload-CA at Sophos

...

Troj/VB-DZK

- Troj/VB-DZK at Sophos

Troj/VB-DZK is a Trojan for the Windows platform. When Troj/VB-DZK is
installed the following files are created: <Windows>\Config\csrss.exe
<System>\mswinsck.ocx The following registry entry is changed to run Troj/VB-DZK
on startup...

W32/Looked-L

- W32/Looked-L at Sophos

W32/Looked-L is a virus for the Windows platform.The virus includes functionalities to - access the internet
and communicate with a remote server via HTTP - silently download, install and run new software - terminate
processes related to AVWhen first run W32/Looked-L copies itself to <Windows>\rundl132.exe and
<Windows>\...

Troj/FakeVir-AZ

- Troj/FakeVir-AZ at Sophos

Troj/FakeVir-AZ claims to be a malware removal tool named "AntiSpywareMaster".
The Trojan scans the computer and reports malware in files that are in reality clean system components. If
the user clicks the "Remove Now" button, they are taken to the registration page in the hope that they will
pay to...

Troj/Agent-GXE

- Troj/Agent-GXE at Sophos

...

Troj/Dloadr-BLB

- Troj/Dloadr-BLB at Sophos

...

Troj/Dloadr-BLC

- Troj/Dloadr-BLC at Sophos

...

Troj/FakeVir-AY

- Troj/FakeVir-AY at Sophos

Troj/FakeVir-AY pretends to be an anti-spyware program called MalwareBell. It detects clean files
on the victim computer as infected with malware, then attempts to scare the user into purchasing "the full
version" of MalwareBell. When run Troj/FakeVir-AY creates the following files:
...

Troj/Mdrop-BSA

- Troj/Mdrop-BSA at Sophos

Troj/Mdrop-BSA drops the file <System>\run32.dll (detected as Mal/LineDLL-B) and registers
it as a browser helper object.
...