DRS Georgia

Downloader.Tibs

A new Downloader.Tibs variant is spreading today thanks to massive spamming. Infected emails contains about 130-140kB long attachment, usually with name happy2008.exe, which is trojan horse itself. There are also emails with links directing users to a malicious web pages. The files are already detected as Downloader.Tibs.

Win32/Mabezat.A

In last few days we`ve registered a larger amount of PE files infected by this virus. Win32/Mabezat is polymorphic file infector which infects PE files. More information could be found in our Virus Encyclopedia.

I-Worm/Nuwar

We have a new wave of spammed mail messages containing link directing users to website where the worm could be downloaded. Emails contains short text and IP address of currently working pages with worm. In this case downloaded filename is withlove.exe and it's about 115kB in size. Websites and worm files changes every few minutes. AVG detects withlove.exe as I-Worm/Nuwar.L.

I-Worm/Nuwar

New Nuwar variant spreading method is similar to Nuwar.L last month propagation. Spammed emails are brief containing link in IP format to currently working pages with worm. Compromised page code is changed and as a result user is prompted to download file with worm. Downloaded filename is valentine.exe it's about 110 - 130kB long and it's detected by AVG as I-Worm/Nuwar.N.

I-Worm/Stration downloader

Latest Stration downloader spreads by email in messages with randomly generated subject and body with one EXE and one PDF file attached. EXE file is 20992B in size and it`s downloader itself which is detected by AVG as I-Worm/Stration.FJA. The file downloader tryes to download is already detected as I-Worm/Stration. More information about Stration worm familly can be found in the Virus Encyclopedia.

Trojan Downloader.Agent.UZM

A new Trojan Downloader was spammed today. Trojan is attached in zip archive to emails in HTML format with subject "Hot game" and body text that claims some Angelina Jolie or Lara Croft undressing game. xgame.zip attachment contains xgame.exe (20992B) which drops executes and deletes kernel driver C:\WINDOWS\System32\drivers\runtime.sys and downloads another downloader smartdrv.exe. runtime.sys runs injects and hides Iexplore.exe process and downloads another components. xgame.exe is detected as Trojan Downloader.Agent.UZM, smartdrv.exe is detected as Trojan Downloader.Agent.UZN, runtime.sys is detected as Trojan Downloader.Agent.THW and other downloaded components are detected as several variants of Trojan Backdoor.Ntrootkit.

I-Worm/Nuwar

Propagation method of new Nuwar variant is still similar to its precedessors. Spammed mails with link in IP format directs users to the worm web pages where the users are prompted to download one of the worm files with the name funny.exe. Names of other downloadable files are kickme.exe and foolsday.exe. AVG detects this threat as I-Worm/Nuwar.R.

Downadup/Conficker worm

First version of this worm is known from december 2008. Nowadays it has 300+ several variants. More information could be found in Virus Lab Blog.

Stration downloader

A new Stration downloader was seeded during todays morning using mail messages where subject and body are variable and which contains two attachments, one with pdf extension and second with exe extension which is 4096B in size and it`s downloader itself. AVG detect this threat as Trojan horse Downloader.Generic6.PFM. Downloader tryes to download and install Stration to affect system, but Stration download link is no longer active. More information about Stration worm familly can be found in the Virus Encyclopedia.

I-Worm/Stration downloader

Next Stration downloader variant spreads by email in messages with randomly generated subject and body with two attachments. PDF attachment is harmless but EXE attachment which is 18708B long is downloader itself and AVG detects it as I-Worm/Stration. More information about Stration worm familly can be found in the Virus Encyclopedia.

Backdoor.Win32.Bredolab.eua

The program connects to the server: http://*****lo.ru where it sends the following request (some of the data may vary): GET...

Trojan.Win32.Oficla.w

This malicious program is intended for the unauthorized downloading and launching of other malware on a computer. Installation When launched, the malicious program extracts from itself and creates...

Trojan-PSW.Win32.Qbot.mk

This Trojan is designed to steal the user's confidential data, as well as providing a remote malicious user with access to the victim machine. It is a Windows PE EXE file. It is approximately 85...

Trojan.Win32.Vilsel.ato

This Trojan is designed to install and launch other malicious programs on the victim machine without the user’s knowledge or consent. It is a Windows PE EXE file. It is 1083904 bytes in size....

Trojan-Banker.Win32.Banz.cri

This malicious program is designed to steal user data that has to do with banking systems, e-money and plastic cards issued by Brazilian banks. It is a Windows PE EXE file. It is 942047 bytes in...

Virus.Win32.Virut.ce

This file virus infects Windows executable files. It is a malicious code contained in Windows PE EXE files. The virus body is about 17 Kb, though the use of polymorphic encryption means its size may...

Virus.Win32.Sality.ag

This malicious program infects files on the victim computer. It is designed to download and launch other malicious programs on the victim computer without the user’s knowledge or consent. It is...

Trojan-Downloader.JS.Gumblar.x

This Trojan downloads and runs malicious scripts on the victim machine without the user's knowledge or consent. It is a JavaScript scenario. It is 809 bytes in size.

Backdoor.Win32.Clampi.a

If your computer does not have an up-to-date antivirus, or does not have an antivirus solution at all, follow the instructions below to delete the malicious program: Use Task Manager to terminate...

Trojan-Dropper.Win32.Agent.alb...

This Trojan has a malicious payload. It is a Windows PE EXE file. It is 23552 bytes in size. Installation The Trojan copies its executable file as follows: %WinDir%\system\svhost.exe In order to...

AndroidOS.Ewalls

Risk Level: Very Low. Type: Trojan.

W32.Yimfoca!gen3

Risk Level: Very Low. Type: Worm.

W32.Changeup!gen5

Risk Level: Very Low. Type: Trojan, Virus, Worm.

Bloodhound.Exploit.346

Risk Level: Very Low. Type: Trojan, Virus, Worm.

Trojan.Sinslog!inf

Risk Level: Very Low. Type: Trojan.

W32.Queneethan

Risk Level: Very Low. Type: Worm.

W32.Changeup.C

Risk Level: Low. Type: Worm.

Bloodhound.Exploit.343

Risk Level: Very Low. Type: Trojan, Virus, Worm.

Bloodhound.Exploit.341

Risk Level: Very Low. Type: Trojan, Virus, Worm.

Trojan.FakeAV!gen36

Risk Level: Very Low. Type: Trojan.

Trojan.Komplexad!gen

Risk Level: Very Low. Type: Trojan.

Bloodhound.Exploit.340

Risk Level: Very Low. Type: Trojan, Virus, Worm.

Packed.Negmuru

Risk Level: Very Low. Type: Trojan, Virus, Worm.

Trojan.FakeAV!gen35

Risk Level: Very Low. Type: Trojan.

Packed.Generic.306

Risk Level: Very Low. Type: Trojan, Virus, Worm.

W32.Stuxnet!lnk

Risk Level: Low. Type: Virus, Worm.

Trojan.Milicenso

Risk Level: Very Low. Type: Trojan.

Packed.Generic.305

Risk Level: Very Low. Type: Trojan, Virus, Worm.

W32.Phiskap.A

Risk Level: Very Low. Type: Virus.

W32.Kodom

Risk Level: Very Low. Type: Virus.