Swash.A
This malware was reported by: Panda Software
Swash.A is a worm that prevents the affected user from accessing websites belonging to the main antivirus companies.Additionally, it also ends processes belonging to antivirus programs and firewalls, among others. This leaves the affected computer vulner
Famus.B
This malware was reported by: Panda Software
Famus.B is a worm that sends private data of the affected computer to its author. The data include mail account, server, company, user name, Windows version, computer name, etc.Famus.B reaches the computer in a message with the subject Iraq and the crime
Spydeleter
This malware was reported by: Panda Software
Spydeleter is a spyware program that downloads and installs other spyware programs.Additionally, Spydeleter changes the home page of the browser Internet Explorer. The modified home page contains a link that points to the website www.spydeleter.com, in w
Buchon.B
This malware was reported by: Panda Software
Buchon.A
This malware was reported by: Panda Software
W32/Rbot-NY
This malware was reported by: Sophos
JS/Scob-A
This malware was reported by: Sophos
SH.Renepo.B
This malware was reported by: Symantec
SH.Renepo.B is a data-collecting script virus that only runs on Mac OS X systems.
Note: Virus definitions dated prior to October 26, 2004 may detect this threat as MacOS.Renepo.B or Hacktool.Openerscript.
Trojan.Ceegar
This malware was reported by: Symantec
Trojan.Ceegar is a downloader Trojan horse program that exploits the Microsoft Internet Explorer HTML Help Control Local Zone Security Restriction Bypass Vulnerability.
W32/Rbot-NZ
This malware was reported by: Sophos
W32/Bagz-D
This malware was reported by: Sophos
W32/MyDoom-AG
This malware was reported by: Sophos
W32/Forbot-BW
This malware was reported by: Sophos
W32/Agobot-NS
This malware was reported by: Sophos
W32/Rbot-NK
This malware was reported by: Sophos
W32/Rbot-NV
This malware was reported by: Sophos
W32/Forbot-BU
This malware was reported by: Sophos
Unix/Opener.worm
This malware was reported by: Network Associates Inc
-- Update October 27th 2004 --
The risk assessment of this threat has been deemed Low-Profiled due to the following media attention:
http://www.arnnet.com.au/index.php/id;1771656169;fp;2;fpid;1
The worm is referred to as Renep
W32/Rbot-OB
This malware was reported by: Sophos
SH/Renepo-A
This malware was reported by: Sophos
Famus.C
This malware was reported by: Panda Software
Famus.C is a worm that sends private data of the affected computer to its author. The data include mail account, server, company, user name, Windows version, computer name, etc.Famus.C reaches the computer in a message with the subject Més terrorism
W32.Anpes@mm
This malware was reported by: Symantec
W32.Anpes@mm is a mass-mailing worm that uses Microsoft Outlook to send itself to email addresses gathered from the infected computer. It also attempts to lower security settings, modify Explorer settings, and create a user account.
WORM_BAGZ.E
This malware was reported by: Trendmicro
Like earlier BAGZ variant, this worm spreads via email using SMTP (Simple Mail Transfer Protocol). It harvests target email addresses from certain files found in the system but noticeably avoids sending itself to addresses that contain certain strings.
Zafi.C
This malware was reported by: F-Secure
Zafi.C is a variant of the Zafi mass-mailing worm family.
This worm sends email messages with infected attachments in several
different languages.
The payload of Zafi.C is a Distributed Denial-of-Service attack against
google.com, microsoft.com and w
MyDoom.AG
This malware was reported by: F-Secure
A new variant of MyDoom worm - Mydoom.AG, was found on October
27th, 2004. The worm is similar to previous variants.
Agobot.VS
This malware was reported by: F-Secure
The Agobot.VS variant was found on October 27th, 2004. We
received several reports about it from the field. This backdoor
is functionality similar to previous Agobot variants.
W32/Myfip.worm.g
This malware was reported by: Network Associates Inc
Zafi.C
This malware was reported by: Panda Software
W32/Zafi.c@MM
This malware was reported by: Network Associates Inc
-- Update October 27, 2004
--
The risk assessment of this threat has been updated to Low-Profiled due to media attention at: http://news.zdnet.co.uk/internet/0,39020369,39171748,00.htm
--
This variant bears similarities to its predece
Trojan.Watsoon.A
This malware was reported by: Symantec
Trojan.Watsoon.A is a polymorphic Trojan horse that opens a backdoor on a compromised computer. By default is uses TCP port 19381
NOTE:. Definitions prior to 27th October 2004 may detect this threat as W32.Watsoon.A
W32/Chilly.a@MM
This malware was reported by: Network Associates Inc
W32/Agobot-NU
This malware was reported by: Sophos
W32/Rbot-NS
This malware was reported by: Sophos
W97M.Inamo
This malware was reported by: Symantec
W97M.Inamo is a macro virus that is triggered when a Microsoft Word document is opened or closed. It can infect Word 97, 2000, and 2002 documents.
W32.Gaobot.BOW
This malware was reported by: Symantec
W32.Gaobot.BOW is a network-aware worm that has backdoor capabilities and can be controlled through IRC channels.
W32.Bagz.F@mm
This malware was reported by: Symantec
W32.Bagz.F@mm is a mass-mailing worm that uses its own SMTP engine to send itself to email addresses gathered from the compromised system. The email will have a variable subject and attachment name. The attachment will have a .exe or .zip file extension.
Backdoor.Futro
This malware was reported by: Symantec
Backdoor.Futro is a typical backdoor server program. Presence of the file Isass.exe (not to be confused with Lsass.exe) is an indication of a possible infection.
W32.Randex.BRD
This malware was reported by: Symantec
W32.Randex.BRD is a network-aware worm that spreads to network shares protected by weak passwords. It also opens a backdoor and may be remotely controlled via IRC channels.
Bagz.C
This malware was reported by: Computer Associates
Win32.Bagz.C is a worm that spreads via e-mail, modifies the Hosts file and downloads and executes arbitrary files. It has been distributed as a 155,138-byt
Bagz.D
This malware was reported by: Computer Associates
Win32.Bagz.D is a worm that spreads via e-mail. It has been distributed as a 157,197-byte, UPX-packed, Win32 executable.
Siboco.A
This malware was reported by: Computer Associates
Win32.Siboco.A is a downloading trojan. It has been distributed as a 61,440 byte Win32 executable.
W32/Forbot-BZ
This malware was reported by: Sophos
W32/Rbot-NT
This malware was reported by: Sophos
W32/Korgo.worm.v
This malware was reported by: Network Associates Inc
This new variant is a repacked version of its predecessor. Kindly refer to W32/Korgo.worm.p.
for more information.
Top of Page
Exploit-ZIP.b
This malware was reported by: Network Associates Inc
Exploit-RealSkin
This malware was reported by: Network Associates Inc
Backdoor.Ranky.K
This malware was reported by: Symantec
Backdoor.Ranky.K is a backdoor server program that allows an infected computer to be used as a covert proxy.
Backdoor.Ranky.J
This malware was reported by: Symantec
Backdoor.Ranky.J is a backdoor server program that allows a remote attacker to use the infected computer as a covert proxy.
W32.Erkez.C@mm
This malware was reported by: Symantec
W32.Erkez.C@mm is a mass-mailing worm that sends itself to email addresses it finds on the infected computer. It also copies itself to folders that are likely to be shared on file-sharing networks.
When this worm infects a computer, it attempts to ove
WORM_ZAFI.C
This malware was reported by: Trendmicro
This memory-resident worm spreads via email and network shares.
Backdoor.Singu.B
This malware was reported by: Symantec
Backdoor.Singu.B is a Trojan horse program that allows unauthorized remote access. The presence of the file diskcheck.exe is an indication of a possible infection.
W32.Gregcenter
This malware was reported by: Symantec
W32.Gregcenter is a virus that prepends itself to the files with the .exe extension.
Pcclient.E
This malware was reported by: Computer Associates
Win32.Pcclient.E is a backdoor trojan, controlled through outgoing HTTP connections.
Zafi.C
This malware was reported by: Computer Associates
Bagle.AT
This malware was reported by: F-Secure
Bagle.AT is a mass-mailing worm with Peer-to-Peer spreading
capabilities. In email Bagle.AT spreads using different subjects,
email bodies and attachments. The attachment is an executable
file with one the following extensions: .EXE .SCR .COM .CPL
Th
Trojan.Disabler
This malware was reported by: Symantec
Trojan.Disabler is a Trojan horse that closes open applications and may cause unsaved data to be lost.
Bagle.AQ
This malware was reported by: Computer Associates
Win32.Bagle.AQ is a worm that spreads via e-mail and peer-to-peer file sharing. The worm itself is a PeX-packed executable that is approximately 17,000 byte
Bagle.AP
This malware was reported by: Computer Associates
Win32.Bagle.AP is a worm that spreads via e-mail and peer-to-peer file sharing. The worm itself is a PeX-packed executable that is approximately 17,000 byte
Pcclient.D
This malware was reported by: Computer Associates
Win32.Pcclient.D is a backdoor trojan, controlled through outgoing HTTP connections.
Pcclient
This malware was reported by: Computer Associates
Win32.Pcclient is a family of backdoor trojans, controlled through outgoing HTTP connections.
Bagle.BC
This malware was reported by: Panda Software
WORM_BAGLE.AT
This malware was reported by: Trendmicro
As of October 29, 2004, 2:07 AM (GMT -07:00; Daylight Saving Time) TrendLabs has declared a MEDIUM risk virus alert to control the spread of this worm. It has been found spreading via email and through network shares in Japan, China, Sweden, Taiwan, Italy
W32.Beagle.AU@mm
This malware was reported by: Symantec
Bagle.AR
This malware was reported by: Computer Associates
Win32.Bagle.AR is a worm that spreads via e-mail and peer-to-peer file sharing. The worm itself is a PeX-packed executable that is approximately 17,000 byte
W32.Beagle.AW@mm
This malware was reported by: Symantec
W32.Beagle.AW@mm is a mass-mailing worm that also spreads through file-sharing networks. The worm will open a backdoor on TCP port 81.
Note: Live Update definitions with sequence number 37860 or greater will detect this threat.
W32.Beagle.AV@mm
This malware was reported by: Symantec
W32/Bagle-AU
This malware was reported by: Sophos
W32/Rbot-NU
This malware was reported by: Sophos
W32/Bagle.bd@MM
This malware was reported by: Network Associates Inc
W32/Bagle.bb@mm
This malware was reported by: Network Associates Inc
W32/Bagle.bc
This malware was reported by: Network Associates Inc
W32.Beagle@mm!cpl
This malware was reported by: Symantec
W32.Beagle@mm!cpl is a generic detection for variants of W32.Beagle@mm that use Control Panel applets as droppers. These files contain a copy of the worm and usually arrive as email attachments with .cpl file extensions.
The following W32.Beagle@mm vari
W32/Bagle.bc@MM
This malware was reported by: Network Associates Inc
W32/Mydoom.af@MM
This malware was reported by: Network Associates Inc
This virus was detected as W32/Mydoom.gen@MM from the 4390 DATs. Name specific detection was added to the 4401 DATs
Top of Page
Bagle.AU
This malware was reported by: F-Secure
Bagle.AU is a minor variant of Bagle.AT. These two worms are
functionally identical. Please read the description of Bagle.AT
for more information:
http://www.f-secure.com/v-descs/bagle_at.shtml
WORM_BAGLE.AN
This malware was reported by: Trendmicro
Like other BAGLE variants, this worm attempts to spread via email. The email it sends out has the following details:
WORM_BAGLE.AU
This malware was reported by: Trendmicro
As of October 29, 2004, 9:40 AM (GMT -07:00; Daylight Saving Time) TrendLabs has declared a MEDIUM risk virus alert to control the spread of this worm. It has been found spreading via email and through network shares in the US, Japan, Sweden, Germany, Mex
Bagle.BE
This malware was reported by: Panda Software
W32/Bagle-AV
This malware was reported by: Sophos
W32/Rbot-NZ
This malware was reported by: Sophos
WORM_RBOT.VP
This malware was reported by: Trendmicro
This memory-resident worm arrives and propagates through network shares. Upon execution, it drops a copy of itself as the file DEAMON.EXE in the Windows system folder. It may attempt to use its own list of user names and passwords to gain access and furth
WORM_MYDOOM.AG
This malware was reported by: Trendmicro
This memory resident worm spreads via email through Simple Mail Transfer Protocol (SMTP), gathering target recipients from the local hard disk. It also generates email addresses by selecting a user name from its own list, and appending it to a selected do
W32/Shodi-F
This malware was reported by: Sophos
W32/MyDoom-AG
This malware was reported by: Sophos
Trojan.Ducky.C
This malware was reported by: Symantec
Trojan.Ducky.C is a Trojan horse program that exploits the Microsoft GDI+ Library JPEG Segment Length Integer Underflow vulnerability (described in the Microsoft Security Bulletin MS04-028).
ELF_FAKEPATCH.A
This malware was reported by: Trendmicro
This Elf executable arrives on a system via email with the following details:
W32/Leebad-A
This malware was reported by: Sophos
W32/Agobot-NS
This malware was reported by: Sophos
VBS.Yeno.C@mm
This malware was reported by: Symantec
VBS.Yeno.C@mm is a mass-mailing worm that sends itself to the email addresses in the Microsoft Outlook address book. It also infects .vbs, .vbe, .htm, and .html files on drives C, D and E.
VBS.Yeno.B@mm
This malware was reported by: Symantec
VBS.Yeno.B@mm is a mass-mailing worm that sends itself to email addresses in the Microsoft Outlook address book. It also infects .vbs, .vbe, .htm, and .html files on drives C, D and E.
W32/Rbot-OP
This malware was reported by: Sophos
W32/Rbot-NV
This malware was reported by: Sophos
W32/Bagle.dldr
This malware was reported by: Network Associates Inc
Bagz.G
This malware was reported by: F-Secure
Bagz.G worm variant was found on November 2nd, 2004. The first
report from the field was received from Japan. The worm spreads
itself in e-mails with various subject and body texts. The
attachment is either an executable file or a ZIP archive.
Additio
Bagz.A
This malware was reported by: F-Secure
Bagz is an e-mail worm that was first found in the beginning of
October 2004. The worm spreads itself in e-mails with various
subject and body texts. The attachment is either an executable
file with double extension or a ZIP archive. Additionally the
W32/Rbot-OR
This malware was reported by: Sophos
W32/Rbot-OB
This malware was reported by: Sophos
WORM_BAGZ.F
This malware was reported by: Trendmicro
This worm mainly spreads via email. Using its own SMTP (Simple Mail Transfer Protocol) engine, it sends out email to all addresses it has gathered from certain files found in the system, virtually using the affected system as propagation launch pad.
W32/Bagz-F
This malware was reported by: Sophos
W32/Rbot-NY
This malware was reported by: Sophos