MWBLOG.ORG

Virus Malware and Threat News for 20081030

Infostealer.Hibik.A

- Infostealer.Hibik.A at Norton Symantec

Infostealer.Hibik.A is a Trojan horse that steals confidential information from the compromised computer.
...

PWS-OnlineGames.cp!43108E10

- PWS-OnlineGames.cp!43108E10 at McAfee

File PropertyProperty ValueFileNamezz.exeMcAfee DetectionPWS-OnlineGames.cpLength119,556
bytesCRC43108E10MD50F6B989FECB973832EB862DA9EE1D862SHA1A1C9EBCA387F11A9D6A89C3C06E62E4569446765Other Common
Detection AliasesCompany NameDetection Namemicrosofttrojandropper:win32/frethogAvert® Labs has observed the
following system activities...

PWS-OnlineGames.cp!6453E20C

- PWS-OnlineGames.cp!6453E20C at McAfee

File PropertyProperty ValueFileNamehelp.exeMcAfee DetectionPWS-OnlineGames.cpLength109,828
bytesCRC6453E20CMD5C9362A047703966E543EF1BD0A145132SHA15A04E1D8C14116222C39E2C8FE91912A68968466Other Common
Detection AliasesCompany NameDetection Namemicrosofttrojandropper:win32/frethogAvert® Labs has observed the
following system activiti...

Adware-Cinmus!C874CE83

- Adware-Cinmus!C874CE83 at McAfee

This software is not a virus or a Trojan. It is detected as a "potentially unwanted program" (PUP). PUPs are
any piece of software that a reasonably security- or privacy-minded computer user may want to be informed of
and, in some cases, remove. PUPs are often made by a legitimate corporate entity for some beneficial purpose,
but th...

Adware-Cinmus!C1F27A9B

- Adware-Cinmus!C1F27A9B at McAfee

This software is not a virus or a Trojan. It is detected as a "potentially unwanted program" (PUP). PUPs are
any piece of software that a reasonably security- or privacy-minded computer user may want to be informed of
and, in some cases, remove. PUPs are often made by a legitimate corporate entity for some beneficial purpose,
but th...

Downloader-BKW!56818C16

- Downloader-BKW!56818C16 at McAfee

File PropertyProperty ValueFileNamesyscon~1.exeMcAfee DetectionDownloader-BKWLength974,336
bytesCRC56818C16MD56A16F88151CB733C45E1A8688BE03A85SHA18218F666B0A412E58A033E1C9A65A95A6ED85EE2Other Common
Detection AliasesCompany NameDetection NameAviraTR/Crypt.XPACK.GeneSafe (Alladin)suspicious Trojan/Worm
[101]Sophos~Sus/UnkPackerAvert&r...

StartPage-KI!06F91978

- StartPage-KI!06F91978 at McAfee

File PropertyProperty ValueFileNametrojan~1.exeMcAfee DetectionStartPage-KILength172,544
bytesCRC06F91978MD54B32FA4EA56FC9DEA07B7FCF815F8D47SHA1DB36850719A6573D96BC5EDE7D505E67A43D042COther Common
Detection AliasesCompany NameDetection NameahnlabWin-Trojan/Buzus.172544avastWin32:Delf-LDA
[Drp]AviraDR/Delphi.GenBitDefenderTrojan.Dropp...

P2PShared.P

- P2PShared.P at Panda

It steals passwords from all type of programs, applications, email services that could be stored in
the affected computer. It spreads via peer-to-peer (P2P) file sharing programs and through
removable drives....

Troj/Agent-IBG

- Troj/Agent-IBG at Sophos

...

Troj/Drop-BG

- Troj/Drop-BG at Sophos

...

Troj/FakeVir-GV

- Troj/FakeVir-GV at Sophos

...

Troj/FakeAV-FP

- Troj/FakeAV-FP at Sophos

...

Mal/BHO-N

- Mal/BHO-N at Sophos

...

Mal/EncPk-FR

- Mal/EncPk-FR at Sophos

...

Mal/Zlob-AA

- Mal/Zlob-AA at Sophos

...

Troj/Agent-IBT

- Troj/Agent-IBT at Sophos

...

Troj/AgLght-A

- Troj/AgLght-A at Sophos

...

Troj/Bckdr-QQE

- Troj/Bckdr-QQE at Sophos

Troj/Bckdr-QQE is a Trojan for the windows platform.
...

PWS-Gamania.gen.c!E918AB27

- PWS-Gamania.gen.c!E918AB27 at McAfee

File PropertyProperty ValueFileNametta584~1.exeMcAfee DetectionPWS-Gamania.gen.cLength106,299
bytesCRCE918AB27MD5DA87639E0018697C320981E6F475931ESHA1B57A00CBC18D41C6B690D7FBF8D4F6B2A4FEEDFEOther Common
Detection AliasesCompany NameDetection NameAviraTR/Crypt.XPACK.GenBitDefenderPacker.Malware.NSAnti.
1FortiNetSuspiciousF-ProtW32/Onlin...

PWS-OnlineGames.cp!915D565C

- PWS-OnlineGames.cp!915D565C at McAfee

File PropertyProperty ValueFileNamezz.exeMcAfee DetectionPWS-OnlineGames.cpLength122,116
bytesCRC915D565CMD5B8708D4C8ABB554CB7A12DBC0FAA03A1SHA15DD4670011391774F78B1685EF4CCA329572C279Other Common
Detection AliasesCompany NameDetection Namemicrosofttrojandropper:win32/frethogSymantecW32.Gammima.AGAvert®
Labs has observed the follo...

Generic Downloader.x!AFFF0BCD

- Generic Downloader.x!AFFF0BCD at McAfee

File PropertyProperty ValueFileNamea.exeMcAfee DetectionGeneric Downloader.xLength60,932
bytesCRCAFFF0BCDMD52F65F8C98888978596CC32A7911B4E71SHA1A9882C105FFE6059048A5AB3962EF6DFDD240C80Other Common
Detection AliasesCompany NameDetection NameavastWin32:Trojan-gen {Other}AVG (GriSoft)SHeur.
CLEVAviraTR/Obfuscated.vfpeSafe (Alladin)Suspic...

Generic.dx!A8826717

- Generic.dx!A8826717 at McAfee

Avert® Labs has observed the following system activities:ActivityRisk LevelRegisters
DLLsInformationalSystem ChangesThese are general defaults for typical path variables. (Although they may
differ, these examples are common.):%WinDir% = \WINDOWS (Windows 9x/ME/XP/Vista), \WINNT (Windows
NT/2000)%SystemDir% = \WINDOWS\SYSTEM (Windo...

W32/Wplugin!E6D00D3B

- W32/Wplugin!E6D00D3B at McAfee

File PropertyProperty ValueFileNamed4f711~1.exeMcAfee DetectionW32/WpluginLength2,019,811
bytesCRCE6D00D3BMD5EA052A259525ECF5CF2CA07508271C97SHA1D751C5B3119D8C150D33D2636AE6233D63441B46Other Common
Detection AliasesCompany NameDetection NameAVG (GriSoft)agent.4.gKasperskyTrojan-Spy.Win32.Agent.
eqimicrosoftvirus:win32/slugin.anormanw3...

W32/Wplugin!CE14BB6D

- W32/Wplugin!CE14BB6D at McAfee

File PropertyProperty ValueFileNameacfdd9~1.exeMcAfee DetectionW32/WpluginLength132,727
bytesCRCCE14BB6DMD5F5323A42F160ED436E8852A2488F8894SHA1FB2189BF993B6823EEFDF13F17F6E0AECD0D8E81Other Common
Detection AliasesCompany NameDetection NameKasperskyTrojan-Dropper.Win32.Agent.yatmicrosoftvirus:win32/slugin.
anormansandbox: w32/agent.iyj...

W32/Wplugin!E4923C0F

- W32/Wplugin!E4923C0F at McAfee

File PropertyProperty ValueFileNamewinhos~1.exeMcAfee DetectionW32/WpluginLength864,739
bytesCRCE4923C0FMD579C28AC645BEB57C4AA9A5F9BF738581SHA1FF58549FE681628EAECE11D772F465C019621ACAOther Common
Detection AliasesCompany NameDetection NameAVG (GriSoft)generic_c.zkeKasperskyBackdoor.Win32.ceBot.
cmicrosoftvirus:win32/slugin.anormansand...

Generic AdClicker.d!D9A8A1AD

- Generic AdClicker.d!D9A8A1AD at McAfee

File PropertyProperty ValueFileName54e9c4~1.exeMcAfee DetectionGeneric AdClicker.dLength40,450
bytesCRCD9A8A1ADMD52307D60A6C0276CF205E3085DDA19062SHA1C3B487ED0CAC3F3C2F14C9AC7BF6647905F764A2Other Common
Detection AliasesCompany NameDetection NameahnlabWin32/NSAnti.suspiciousAVG (GriSoft)Clicker.TJQAviraTR/Crypt.
ULPM.GenBitDefenderTro...

Puper!95CA0F76

- Puper!95CA0F76 at McAfee

File PropertyProperty ValueFileName3ce7a5~1.exeMcAfee DetectionPuperLength20,480
bytesCRC95CA0F76MD5C2CF4A1245DB7DAA679ACAB4CFA74D21SHA11E704B91D41CF7BEA0453F43CD2217AC562F1956Other Common
Detection AliasesCompany NameDetection NameAVG (GriSoft)downloader.zlob.afpiAviraTR/Dropper.GenEMSI
SoftwareVirus.Win32.Zlob.AJG!IKEsetWin32/Troja...

Generic FakeAlert.a!42F9C9CA

- Generic FakeAlert.a!42F9C9CA at McAfee

File PropertyProperty ValueFileNamebrastk.exeMcAfee DetectionGeneric FakeAlert.aLength10,240
bytesCRC42F9C9CAMD555E12BDA8167AE95DC13B3ADA76684D9SHA1E9A2654F5FB41D37E6389F30110BB1B32535C072Other Common
Detection AliasesCompany NameDetection NameAVG (GriSoft)sheur.crcoBitDefenderPacker.Malware.Lighty.ODr.
WebTrojan.Packed.1208KasperskyH...

Generic Dropper!A99565CD

- Generic Dropper!A99565CD at McAfee

File PropertyProperty ValueFileNamee25328.exeMcAfee DetectionGeneric DropperLength1,515,975
bytesCRCA99565CDMD5552EEA5A98F30024F6246577FC662BFESHA16F6073DB36292A4F0BE61901AFFBDCF2F4412DA5Other Common
Detection AliasesCompany NameDetection NameahnlabWin-Trojan/Xema.variantavastWin32:Trojan-gen {Other}AVG
(GriSoft)SHeur.CLANBitDefender...

Generic Downloader.x!42F9C9CA

- Generic Downloader.x!42F9C9CA at McAfee

File PropertyProperty ValueFileNamebrastk.exeMcAfee DetectionGeneric Downloader.xLength10,240
bytesCRC42F9C9CAMD555E12BDA8167AE95DC13B3ADA76684D9SHA1E9A2654F5FB41D37E6389F30110BB1B32535C072Other Common
Detection AliasesCompany NameDetection NameAVG (GriSoft)sheur.crcoBitDefenderPacker.Malware.Lighty.ODr.
WebTrojan.Packed.1208microsoft...

TROJ_GAMETHI.DDV

- TROJ_GAMETHI.DDV at Trend Micro

This Trojan may arrive bundled with malware packages as a malware component. It may arrive as a .DLL file that
exports functions used by other malware.It is a component file of TSPY_LINEAGE/WORM_LINEAGE variants in their
malicious routines. It is used by other malware for its information theft. However, it requires its main
component...

TROJ_ZBOT.AJR

- TROJ_ZBOT.AJR at Trend Micro

This Trojan arrives as a file downloaded from a certain URL.Upon execution, it drops a copy of itself and its
components in the system. It modifies the system registry to enable its automatic execution at every system
startup.It then attempts to access a certain Web site to download its configuration file. The said file
contains info...

Troj/Agent-ICM

- Troj/Agent-ICM at Sophos

Troj/Agent-ICM is a Trojan for the Windows platform. When run the Trojan
copies itself to: <Application Data>\Facegame\Facegame.exe
Troj/Agent-ICM sets the following registry entry:
HKCU\Software\Microsoft\CurrentVersion\Run ...

Troj/Agent-ICN

- Troj/Agent-ICN at Sophos

...

Troj/Bankr-C

- Troj/Bankr-C at Sophos

Troj/Bankr-C is a banking Trojan for the Windows platform. When run, the
Trojan modifies the host file to point certain banking URLS to a remote site hosting a phishing site.
...

Troj/Dloadr-BXM

- Troj/Dloadr-BXM at Sophos

...

Troj/DwnLdr-HJV

- Troj/DwnLdr-HJV at Sophos

...

Troj/Spy-BH

- Troj/Spy-BH at Sophos

...

W32/Yahlov-A

- W32/Yahlov-A at Sophos

W32/Yahlov-A is a worm for the Windows platform. W32/Yahlov-A speads by
copying itself to network shares and removable drives. W32/Yahlov-A copies itself to
the root folder of removeable drives with a randomly generated filename and creates an autorun.inf file in the
root fold...

Mal/Zlob-AC

- Mal/Zlob-AC at Sophos

Mal/Zlob-AC is a malicious program for the Windows platform. Detection for
members of Mal/Zlob-AC is behavior based. It is extremely important that customers report detections of
Mal/Zlob-AC to Sophos and send a sample for analysis.
...

Troj/Dwnldr-HJU

- Troj/Dwnldr-HJU at Sophos

Troj/Dwnldr-HJU is a Trojan for the windows platform. Troj/Dwnldr-HJU
attempts to download an executable file from a remote website. Troj/Dwnldr-HJU copies
the executable file as <Windows>\N0tepad.exe and tries to execute it.
...