DRS Georgia

Downloader.Tibs

A new Downloader.Tibs variant is spreading today thanks to massive spamming. Infected emails contains about 130-140kB long attachment, usually with name happy2008.exe, which is trojan horse itself. There are also emails with links directing users to a malicious web pages. The files are already detected as Downloader.Tibs.

Win32/Mabezat.A

In last few days we`ve registered a larger amount of PE files infected by this virus. Win32/Mabezat is polymorphic file infector which infects PE files. More information could be found in our Virus Encyclopedia.

I-Worm/Nuwar

We have a new wave of spammed mail messages containing link directing users to website where the worm could be downloaded. Emails contains short text and IP address of currently working pages with worm. In this case downloaded filename is withlove.exe and it's about 115kB in size. Websites and worm files changes every few minutes. AVG detects withlove.exe as I-Worm/Nuwar.L.

I-Worm/Nuwar

New Nuwar variant spreading method is similar to Nuwar.L last month propagation. Spammed emails are brief containing link in IP format to currently working pages with worm. Compromised page code is changed and as a result user is prompted to download file with worm. Downloaded filename is valentine.exe it's about 110 - 130kB long and it's detected by AVG as I-Worm/Nuwar.N.

I-Worm/Stration downloader

Latest Stration downloader spreads by email in messages with randomly generated subject and body with one EXE and one PDF file attached. EXE file is 20992B in size and it`s downloader itself which is detected by AVG as I-Worm/Stration.FJA. The file downloader tryes to download is already detected as I-Worm/Stration. More information about Stration worm familly can be found in the Virus Encyclopedia.

Trojan Downloader.Agent.UZM

A new Trojan Downloader was spammed today. Trojan is attached in zip archive to emails in HTML format with subject "Hot game" and body text that claims some Angelina Jolie or Lara Croft undressing game. xgame.zip attachment contains xgame.exe (20992B) which drops executes and deletes kernel driver C:\WINDOWS\System32\drivers\runtime.sys and downloads another downloader smartdrv.exe. runtime.sys runs injects and hides Iexplore.exe process and downloads another components. xgame.exe is detected as Trojan Downloader.Agent.UZM, smartdrv.exe is detected as Trojan Downloader.Agent.UZN, runtime.sys is detected as Trojan Downloader.Agent.THW and other downloaded components are detected as several variants of Trojan Backdoor.Ntrootkit.

I-Worm/Nuwar

Propagation method of new Nuwar variant is still similar to its precedessors. Spammed mails with link in IP format directs users to the worm web pages where the users are prompted to download one of the worm files with the name funny.exe. Names of other downloadable files are kickme.exe and foolsday.exe. AVG detects this threat as I-Worm/Nuwar.R.

Downadup/Conficker worm

First version of this worm is known from december 2008. Nowadays it has 300+ several variants. More information could be found in Virus Lab Blog.

Stration downloader

A new Stration downloader was seeded during todays morning using mail messages where subject and body are variable and which contains two attachments, one with pdf extension and second with exe extension which is 4096B in size and it`s downloader itself. AVG detect this threat as Trojan horse Downloader.Generic6.PFM. Downloader tryes to download and install Stration to affect system, but Stration download link is no longer active. More information about Stration worm familly can be found in the Virus Encyclopedia.

I-Worm/Stration downloader

Next Stration downloader variant spreads by email in messages with randomly generated subject and body with two attachments. PDF attachment is harmless but EXE attachment which is 18708B long is downloader itself and AVG detects it as I-Worm/Stration. More information about Stration worm familly can be found in the Virus Encyclopedia.

Backdoor.Win32.Clampi.a

This Trojan spy program is designed to steal confidential user data and remotely manage the victim machine. It is a Windows PE EXE file. It is 470 bytes in size. Installation When launched, the Trojan creates the following file: %AppData%\<name>.exe <name&gr; is chosen at random from...

Trojan-Dropper.Win32.Agent.alb...

This Trojan has a malicious payload. It is a Windows PE EXE file. It is 23552 bytes in size. Installation The Trojan copies its executable file as follows: %WinDir%\system\svhost.exe In order to ensure that the Trojan is launched automatically when the system is rebooted, the Trojan adds a link...

Backdoor.Win32.Agent.abgg

This Trojan provides a remote malicious user with access to the victim machine. It is a Windows PE EXE file. It is 22528 bytes in size. Installation Once launched, the Trojan copies its body to the Windows system directory as "digeste.dll": %System%\digeste.dll In order to ensure that the Trojan...

Trojan-Dropper.Win32.Kido.a

This Trojan is designed to install and launch other programs on the victim machine without the knowledge or consent of the user. It is a Windows PE EXE file. It is 78848 bytes in size. It is written in C++.

Trojan-Downloader.Win32.Kido.a

This malicious program is a Windows DLL file. Installation The malware copies its executable file with random names to the following directories: %Program Files%\Internet Explorer\<rnd>.dll %Program Files%\Windows Media Player\<rnd>.dll %Program Files%\WindowsNT\<rnd>.dll %Program...

Email-Worm.Win32.Merond.a

This worm spreads as an attachment to infected emails and also via file-sharing networks and removable media. The worm itself is a Windows PE EXE file. The worm’s executable file can vary between 150KB to 400KB in size. Installation The worm copies its executable file to the Windows system...

Trojan.Win32.Agent.azsy

This malicious program is a Trojan. It is a Windows PE EXE file. It is 417792 bytes in size. It is packed using UPX. The unpacked file is approximately 439KB in size. It is written in C++. Installation Once launched, the Trojan copies its body to the current user’s Windows startup...

Trojan.Win32.Agent2.dtb

This Trojan calls premium rate numbers without the knowledge or consent of the user. It is a Windows PE EXE file. It is 25131 bytes in size. It is written in Delphi.

Trojan-Downloader.Win32.Small....

This Trojan downloads other files via the Internet and launches them for execution on the victim machine without the user’s knowledge or consent. It is a Windows PE EXE file. It is 34816 bytes in size. It is not packed in any way. It is written in C++. Installation Once launched, the Trojan...

Trojan-Downloader.Win32.Agent....

This Trojan downloads another malicious program via the Internet and launches it on the victim machine without the user’s knowledge or consent. It is a Windows PE EXE file. It is 9216 bytes in size. It is packed using UPX. The unpacked file is approximately 38KB in size. It is written in...

Bloodhound.PDF.22

Risk Level: Very Low. Type: Trojan.

Trojan.FakeAV!gen21

Risk Level: Very Low. Type: Trojan.

Bloodhound.Exploit.238

Risk Level: Very Low. Type: Trojan, Virus, Worm.

Trojan.Zbot!gen6

Risk Level: Very Low. Type: Trojan, Virus, Worm.

Packed.Generic.294

Risk Level: Very Low. Type: Trojan.

VirusProtector

Type: Misleading Application.

Packed.Generic.293

Risk Level: Very Low. Type: Trojan.

Trojan.Arugizer

Risk Level: Very Low. Type: Trojan.

Packed.Generic.292

Risk Level: Very Low. Type: Trojan.

Trojan.Mozipowp

Risk Level: Very Low. Type: Trojan.

W32.Pilleuz!gen4

Risk Level: Very Low. Type: Worm.

Packed.Generic.290

Risk Level: Very Low. Type: Trojan, Virus, Worm.

W32.Scrshotvid

Risk Level: Very Low. Type: Trojan, Worm.

SymbOS.Exy.E

Risk Level: Very Low. Type: Worm.

Suspicious.SecTool

Risk Level: Very Low. Type: Trojan, Virus, Worm.

W32.Gammima.AG!gen4

Risk Level: Very Low. Type: Virus, Worm.

Trojan.Digitala

Risk Level: Very Low. Type: Trojan.

Bloodhound.Exploit.314

Risk Level: Very Low. Type: Trojan, Virus, Worm.

W32.Xpiro.B

Risk Level: Very Low. Type: Virus.

W32.Spybot.AVEO

Risk Level: Low. Type: Worm.