MS05-012
This malware was reported by: Panda Software
Troj/Chimo-A
This malware was reported by: Sophos
MS05-013
This malware was reported by: Panda Software
MS05-014
This malware was reported by: Panda Software
MS05-015
This malware was reported by: Panda Software
W32/Agobot-PR
This malware was reported by: Sophos
W32/Rbot-VO
This malware was reported by: Sophos
W32/Rbot-VX
This malware was reported by: Sophos
W32/Rbot-ALO
This malware was reported by: Sophos
W32/MyDoom-AR
This malware was reported by: Sophos
W32.Bropia.M
This malware was reported by: Symantec
W32.Bropia.M is a worm that spreads via MSN Messenger and connects to a Web site to display an image on the compromised computer. The worm may also disable many functions on the compromised computer, including the Task Manager and Registry Editor.
W32.Aimdes.A@mm
This malware was reported by: Symantec
W32.Aimdes.A@mm is a simple worm that propagates via AOL Instant Messenger and email.
Downloader-ME.dr
This malware was reported by: Network Associates Inc
W32/Sdbot-UZ
This malware was reported by: Sophos
W32/MyDoom-AQ
This malware was reported by: Sophos
Troj/LowZone-O
This malware was reported by: Sophos
W32/Agobot-PQ
This malware was reported by: Sophos
PWSteal.Bancos.P
This malware was reported by: Symantec
PWSteal.Bancos.P is a Trojan horse program that logs keystrokes and steals information entered into certain banking Web sites. It also steals cached passwords from Microsoft Outlook.
PWSteal.Bancos.O
This malware was reported by: Symantec
PWSteal.Bancos.O is a Trojan horse program that logs keystrokes and steals information entered into certain banking Web sites. It also steals cached passwords from Microsoft Outlook.
Note: Virus definitions released prior to February 13, 2005 may detect
Mydoom.AM
This malware was reported by: Computer Associates
Win32.Mydoom.AM is a worm that spreads via e-mail and P2P file sharing networks.
Mugly Family
This malware was reported by: Computer Associates
Win32.Mugly is a family of worms that spread via e-mail. Members of this family may also carry a variant of the Win32.Rbot family of worms. the worm may be
Faxbat
This malware was reported by: Computer Associates
Win32.Faxbat are a family of worms that spread via P2P file sharing networks.
MS05-009!exploit
This malware was reported by: Computer Associates
W32/Bropia-J
This malware was reported by: Sophos
W32/Rbot-VQ
This malware was reported by: Sophos
Bropia.J
This malware was reported by: Panda Software
Bropia.J is a worm that prevents the user from accessing the Task Manager and the Windows Registry Editor (REGEDIT.EXE file).Once it is run, Bropia.J attempts to display an HTML page that contains a link to a certain web page hosted in the website www.fr
Mydoom.AM
This malware was reported by: Panda Software
Mydoom.AM is a worm that ends processes belonging to certain security tools, such as several antivirus programs and firewalls. This leaves the affected computer vulnerable to the attack of other malware.Mydoom.AM also ends processes belonging to other wo
Trojan.Rplay.A
This malware was reported by: Symantec
Trojan.Rplay.A is a Trojan horse that downloads a remote file and lowers security settings on a compromised computer.
W32.Randex.COX
This malware was reported by: Symantec
W32.Randex.COX is a network-aware worm that spreads to network shares protected by weak passwords. The worm also opens a back door on the compromised computer and may be remotely controlled via IRC channels.
W32/Dopbot-A
This malware was reported by: Sophos
W32/Sdbot-UW
This malware was reported by: Sophos
W97M.Lebani
This malware was reported by: Symantec
W97M.Lebani is a macro virus that infects Microsoft Word documents and the MS Word global template. The virus also lowers the Microsoft Word macro security settings, deletes certain files, and inserts text into other Word documents.
W97M.MJ
This malware was reported by: Symantec
W97M.MJ is a macro worm that attempts to spread using mIRC, the Windows Internet Relay Chat (IRC) client.
Trojan.KillAV.E
This malware was reported by: Symantec
Trojan.KillAV.E is a Trojan horse that installs a Browser Helper Object (BHO) and disables security software. The installed BHO causes the browser to download pornographic dialers. The Trojan may also attempt to download a password stealer for financial
Gaobot.CYX
This malware was reported by: Panda Software
Gaobot.CYX is a worm with backdoor characteristics that belongs to the Gaobot worm family. This family has the following common characteristics:It affects Windows 2003/XP/2000/NT computers only, as it attempts to exploit the LSASS vulnerability to spread
W32/Codbot-B
This malware was reported by: Sophos
W32/Rbot-VT
This malware was reported by: Sophos
W32/Forbot-EC
This malware was reported by: Sophos
Downloader-VA
This malware was reported by: Network Associates Inc
W32.Spybot.JPB
This malware was reported by: Symantec
W32.Spybot.JPB is a network-aware worm that has distributed denial of service and back door capabilities. The worm spreads to network shares protected by weak passwords and by exploiting vulnerabilities.
Backdoor.Spyboter.A
This malware was reported by: Symantec
Backdoor.Spyboter.A is a Trojan horse program that opens a back door on the compromised computer and may be remotely controlled via IRC channels.
PWSteal.Bancos.Q
This malware was reported by: Symantec
PWSteal.Bancos.Q is a password stealing Trojan horse program that logs keystrokes and steals information entered into certain banking Web sites. The Trojan may also take screenshots of certain banking Web pages in an attempt to collect passwords and othe
QLowZones-12
This malware was reported by: Network Associates Inc
Trojan.Tabela.A
This malware was reported by: Symantec
Trojan.Tabela.A is a Trojan horse program that steals email addresses from the compromised computer.
Mydoom.AN
This malware was reported by: Computer Associates
Win32.Mydoom.AN is a worm that spreads via e-mail and P2P file sharing networks.
Mydoom.AO
This malware was reported by: Computer Associates
Win32.Mydoom.AO is a worm that spreads via e-mail and P2P file sharing networks.
Bropia.K
This malware was reported by: Computer Associates
Win32.Bropia.K is a worm that spreads via MSN Messenger. It may also be able to spread using Windows Messenger.
W32.Bropia.N
This malware was reported by: Symantec
Rishp
This malware was reported by: Network Associates Inc
Reigndar.C
This malware was reported by: Computer Associates
Win32.Reigndar.C is a trojan that downloads and executes arbitrary files.
Grams.I
This malware was reported by: Computer Associates
Win32.Grams.I is a trojan that attempts to steal e-Gold funds.
Mazocker.A
This malware was reported by: Computer Associates
Win32.Mazocker.A is a backdoor trojan that allows unauthorized access to an affected machine. It can also function as a SOCKS proxy.
AdClicker-BW
This malware was reported by: Network Associates Inc
Troj/PurScan-V
This malware was reported by: Sophos
W32/Agobot-PR
This malware was reported by: Sophos
PWS-Lineage
This malware was reported by: Network Associates Inc
BackDoor-CKB
This malware was reported by: Network Associates Inc
Bropia.G
This malware was reported by: F-Secure
Bropia.G is a new variant of Bropia worm. Like the previous variants,
it uses MSN messenger for spreading. It also drops a variant of Rbot
on the infected system.
DlDer
This malware was reported by: F-Secure
W32/Bropia.worm.n
This malware was reported by: Network Associates Inc
Gaobot.DAC
This malware was reported by: Panda Software
Gaobot.DAC is a worm with backdoor characteristics that allows hackers to gain remote control over the affected computer and carry out actions such as command execution, download and execute files, log keystrokes, obtain different information on the comp
W32/Codbot-C
This malware was reported by: Sophos
W32/Rbot-VX
This malware was reported by: Sophos
Bat/dt137
This malware was reported by: Network Associates Inc
Backdoor.Wortbot
This malware was reported by: Symantec
Backdoor.Wortbot is a Trojan horse program that opens a back door and allows unauthorized remote access to a compromised computer.
Trojan.Anicmoo
This malware was reported by: Symantec
Trojan.Anicmoo is a downloader Trojan that exploits the Windows User32.DLL ANI File Header Handling Stack-Based Buffer Overflow Vulnerability (as described in the Microsoft Security Bulletin MS05-002). The Trojan exists as a malformed animated cursor (
Troj/Lineage-D
This malware was reported by: Sophos
W32.Ahker.D@mm
This malware was reported by: Symantec
W32.Ahker.D@mm is a mass-mailing worm that uses MAPI to send a copy of itself to email addresses gathered from the compromised computer. The email has a variable subject and an attachment named patch.zip.
The worm lowers security settings, prevents acce
W32.Ahker.C@mm
This malware was reported by: Symantec
W32.Ahker.C@mm is a mass-mailing worm that uses MAPI to send an email to all addresses in the Microsoft Outlook Address Book. The email has the following characteristics:
Subject: Paris Hilton...download it!
Attachment: ParisXXX.zip
This threat is writ
W32/Sdbot-UZ
This malware was reported by: Sophos
W32/Sdbot-VH
This malware was reported by: Sophos
Troj/LowZone-O
This malware was reported by: Sophos
W32/Mydoom.bb@MM
This malware was reported by: Network Associates Inc
This variant W32/Mydoom is similar to previous variants, it bears the following characteristics:
mass-mailing worm constructing messages using its own SMTP engine
harvests email addresses from the victim machine
spoofs the From: address
W32/Bropia-J
This malware was reported by: Sophos
BackDoor-CEB.f
This malware was reported by: Network Associates Inc
W32.Aimdes.B
This malware was reported by: Symantec
W32.Aimdes.B is a simple worm that propagates via AOL Instant Messenger. The worm disables the use of various system utilities and disables security notifications.
Trojan.Goldun.B
This malware was reported by: Symantec
Trojan.Goldun.B is a Trojan horse program that attempts to log keystrokes and steal account information entered into forms on the www.e-gold.com domain.
W32.Mydoom.AX@mm
This malware was reported by: Symantec
Mydoom.AU
This malware was reported by: Computer Associates
Win32.Mydoom.AU is a worm that spreads via e-mail; it has been distributed as a 25,771-byte, MEW-packed, Win32 executable.
W32.Aimdes.C@mm
This malware was reported by: Symantec
W32.Aimdes.C@mm is a simple worm that propagates via AOL Instant Messenger and email. The email has a variable subject and an attachment named patch.zip.
Bropia.G
This malware was reported by: Computer Associates
Win32.Bropia.G is a worm that spreads via MSN Messenger. It may also be able to spread using Windows Messenger. It drops a variant of the Rbot worm family,
MyDoom.BB
This malware was reported by: F-Secure
MyDoom.BB appeared on February 17th, 2005. Like the previous variants,
it is a massmailer that sends infected messages with various subject
lines and body messages.
Rbot.BSM
This malware was reported by: Computer Associates
ForBot.ME
This malware was reported by: Computer Associates
Bropia.M
This malware was reported by: Computer Associates
Win32.Bropia.M is a worm that spreads via MSN Messenger. It may also be able to spread using Windows Messenger. It drops a variant of the Rbot worm family,
Bropia.N
This malware was reported by: Computer Associates
Win32.Bropia.N is a worm that spreads via MSN Messenger. It may also be able to spread using Windows Messenger. It drops a variant of the ForBot worm family
Mydoom.AO
This malware was reported by: Panda Software
Mydoom.AO is a worm that affects Windows 2003/XP/2000/NT computers only. It opens the TCP port 1034 and listens to it, acting as a backdoor.Mydoom.AO downloads a file called MODULELOG.PNG from the Internet. In fact, this file is not a PNG image, but an e
W32/Poebot-A
This malware was reported by: Sophos
W32/Dopbot-A
This malware was reported by: Sophos
W32/Sdbot.worm!70250
This malware was reported by: Network Associates Inc
This is a variant of W32/Sdbot.worm
which bears strong resemblance to the many other members of this rapidly growing family.
It is detected as W32/Sdbot.worm.gen.y
with the specified engine and DATs, and bears the following characteris
W32/Sdbot.worm!47616
This malware was reported by: Network Associates Inc
This is a variant of W32/Sdbot.worm
which bears strong resemblance to the many other members of this rapidly growing family.
It is detected as W32/Sdbot.worm.gen
with the specified engine and DATs, and bears the following characteristi
W32/Rbot-WB
This malware was reported by: Sophos
W32/Codbot-B
This malware was reported by: Sophos
W32.Kipis.K@mm
This malware was reported by: Symantec
W32.Kipis.K@mm is a mass-mailing worm that lowers security settings and opens a back door on the compromised computer. The email has a variable subject and attachment name. The attachment will have a .exe, .scr, or .zip file extension.
Bloodhound.Exploit.27
This malware was reported by: Symantec
Bloodhound.Exploit.27 is a heuristic detection for the Vulnerability in Windows SharePoint Services and SharePoint Team Services Could Allow Cross-Site Scripting and Spoofing Attacks as described in Microsoft Security Bulletin MS05-006.
W32.Derdero.A@mm
This malware was reported by: Symantec
W32.Derdero.A@mm is a mass-mailing worm that uses it own SMTP engine to send email to addresses that it retrieves from the Windows Address Book. The email will have a variable subject and attachment name.
It also attempts to spread through file-sharin
W32.Doxpar
This malware was reported by: Symantec
W32.Doxpar is a network-aware worm that has distributed denial of service and back door capabilities. The worm spreads by exploiting vulnerabilities.
Note: Further investigation has revealed that the Microsoft Windows Server Message Block Handlers Remot
W32/Kipis-I
This malware was reported by: Sophos
W32/Forbot-EC
This malware was reported by: Sophos
Trojan.Startpage.I
This malware was reported by: Symantec
Trojan.StartPage.I is a Trojan horse program that attempts to modify settings in Internet Explorer and redirects the home page.