Viruses

From NetworkWorld newsletter.

Today’s roundup of virus alerts:

Trj/Briz.A — A custom virus written for hackers to steal personal data, particularly banking information, from an infected machine. The virus also tries to disable anti-virus applications. (Panda Software)

Troj/Banker-AKW — Another virus targeting banking information. This one is installed as "iewq32.exe" in the Windows System directory. (Sophos)

Troj/Torpig-AI — A Trojan that logs keystrokes, steals e-mail login information and connects with remote machines via HTTP. It drops a number of files in "<Common Files>\Microsoft Shared\Web Folders\", including "ibm00001.exe". (Sophos)

W32/Alcra-E — A virus that spreads through peer-to-peer networks disguised as a Windows Media file. Upon infecting a host, it will display the error message "Message text: Codec Error : 60034 Please Check Codec Exists". It installs a number of files on the infected host, including "\MsMovies\MsMovies.exe" in the Program Files folder. (Sophos)

Troj/Banload-RT — This Trojan is installed as "xsmith.scr" in the Windows System folder and displays the error message "Erro de Leitura do Arquivo.Endereco Invalido fff:0d5f". No word on what malicious purposes it can be used for. (Sophos)

Troj/FeebDl-G and H — An HTML file that can be used to download additional malicious code from remote sites. It installs "userinit.exe" in the Recycled folder. (Sophos)

W32/Tilebot-DL — A Trojan that spreads through network shares by exploiting weak passwords and known Windows vulnerabilities. It places "SAMSvc.exe" in the Windows System folder and communicates with remote sites via HTTP. (Sophos)

Troj/Clagger-H — A new e-mail worm that spreads through a message claiming to be from PayPal and titled "Your Account Temporally Limited". It tries to download "suhoy.exe" to the Windows System folder. (Sophos)

Troj/Spywad-AE — A downloader application that connects with remote servers via HTTP. It drops "winstall.exe" in the root directory. (Sophos)

W32/Maslan-J — Another virus that tries to overwrite a number of file types on the infected host. It’s installed as a randomly named file in the Windows System folder. (Sophos)

Troj/Bancos-PV — A password stealing Trojan that is installed as "sampaerio.exe" in the Windows System directory. No word on how it spreads between machines. (Sophos)

Troj/LdPinch-FC — Another password stealing Trojan. This one gathers data through keystroke logging and the collection of other system information. An attacker can access the captured data through a backdoor. It is installed as "ield.dll" in the Windows System folder. (Sophos)

Stix