http://www.fortiguard.com/ en Copyright 2010 Fortinet Inc. All Rights Reserved Sun, 14 Mar 2010 14:20:02 -0800 Visible Symptoms

The following file exist:

• %system%\googleupdtr.exe

]]> http://www.fortiguard.com/ve?vn=W32/VBKrypt.FP!tr http://www.fortiguard.com/ve?vn=W32/VBKrypt.FP!tr Wed, 10 Mar 2010 16:17:33 -0800 Visible Symptoms

• The following file exists:
  
  
  %UserProfile%\Local Settings\Application Data\av.exe


• It deletes itself from the current directory.


• Possible firewall alert that an executable program attempts to connect to the Internet.

]]> http://www.fortiguard.com/ve?vn=W32/Fakealert.GIJ!tr http://www.fortiguard.com/ve?vn=W32/Fakealert.GIJ!tr Wed, 10 Mar 2010 10:37:03 -0800 Visible Symptoms

There are no visible symptoms. ]]> http://www.fortiguard.com/ve?vn=W32/Genome.AJO!tr.dldr http://www.fortiguard.com/ve?vn=W32/Genome.AJO!tr.dldr Tue, 09 Mar 2010 11:24:58 -0800 Visible Symptoms

Sometimes it can pop up one or several browser windows to display advertisements. ]]> http://www.fortiguard.com/ve?vn=Misc/CnsMin http://www.fortiguard.com/ve?vn=Misc/CnsMin Mon, 08 Mar 2010 18:39:13 -0800 Visible Symptoms

The following files exist:

• %SYSTEM%\{5 Random characters}.exe

Possible firewall alert that an executable attempting to connect to the Internet.

It deletes itself from the current directory.

]]> http://www.fortiguard.com/ve?vn=W32/Agent.DFVR!tr http://www.fortiguard.com/ve?vn=W32/Agent.DFVR!tr Mon, 08 Mar 2010 10:10:39 -0800 Visible Symptoms

The phone attempts to send an SMS to a short code such as 1141.
]]> http://www.fortiguard.com/ve?vn=Dial/SmsBox!java http://www.fortiguard.com/ve?vn=Dial/SmsBox!java Tue, 02 Mar 2010 09:39:20 -0800 Visible Symptoms

The malware attempts to send SMS messages to short numbers such as 4124. ]]> http://www.fortiguard.com/ve?vn=Java/Iconsuf.A!tr.dial http://www.fortiguard.com/ve?vn=Java/Iconsuf.A!tr.dial Tue, 02 Mar 2010 09:38:55 -0800 Visible Symptoms

The malware tries to send an SMS to a premium phone number. ]]> http://www.fortiguard.com/ve?vn=Java/SmsSlide.A!tr.dial http://www.fortiguard.com/ve?vn=Java/SmsSlide.A!tr.dial Tue, 02 Mar 2010 09:34:55 -0800 Visible Symptoms

The phone attempts to send an SMS to a short code such as 1141.
]]> http://www.fortiguard.com/ve?vn=Dial/SmsBoxer http://www.fortiguard.com/ve?vn=Dial/SmsBoxer Tue, 02 Mar 2010 08:59:50 -0800 Visible Symptoms

The repeated attempts by the worm to send SMS messages may yield:

• abnormally high bill
• rapid battery power loss

Presence of the following files:

• c:\sys\bin\LanPackage.exe
• c:\sys\bin\Installer_SV.exe

]]> http://www.fortiguard.com/ve?vn=SymbOS/Yxes.H!worm http://www.fortiguard.com/ve?vn=SymbOS/Yxes.H!worm Tue, 02 Mar 2010 07:40:34 -0800 Visible Symptoms

• Possible firewall alert that an executable program is attempting to connect to the Internet.

]]> http://www.fortiguard.com/ve?vn=W32/Krap.X http://www.fortiguard.com/ve?vn=W32/Krap.X Tue, 23 Feb 2010 16:00:51 -0800 Visible Symptoms

The following file exists:

• %SYSTEM%\wudb.dll

]]> http://www.fortiguard.com/ve?vn=W32/Agent.BQW!tr http://www.fortiguard.com/ve?vn=W32/Agent.BQW!tr Tue, 23 Feb 2010 15:56:18 -0800 Visible Symptoms

The following file may exists:

• %Temp%ex-08.exe

]]> http://www.fortiguard.com/ve?vn=W32/Bredolab.DP!tr http://www.fortiguard.com/ve?vn=W32/Bredolab.DP!tr Tue, 23 Feb 2010 15:53:24 -0800 Visible Symptoms

• The following file exists:
  
  
  • %XLStart%\StartUp.xls

]]> http://www.fortiguard.com/ve?vn=X97M/Laroux.BK http://www.fortiguard.com/ve?vn=X97M/Laroux.BK Wed, 17 Feb 2010 16:40:36 -0800 Visible Symptoms

• The following files exist:
  
  
  • %Windows%freddy101.exe
  
  
  • %Windows%ld16.exe
  
  
  • %Windows%pp14.exe
  
  

]]> http://www.fortiguard.com/ve?vn=W32/Koobface.FEL!worm.im http://www.fortiguard.com/ve?vn=W32/Koobface.FEL!worm.im Wed, 17 Feb 2010 15:45:02 -0800 Visible Symptoms

• The following file exists:
  
  
  • %WINDOWS%\Temp\_ex-[RANDOM].exe

]]> http://www.fortiguard.com/ve?vn=W32/Genome.AITB!tr.dldr http://www.fortiguard.com/ve?vn=W32/Genome.AITB!tr.dldr Wed, 17 Feb 2010 12:34:27 -0800 Visible Symptoms

• The following file exists:
  
  
  • %SYSTEM%\gmb.exe

]]> http://www.fortiguard.com/ve?vn=W32/PackAntiEm.A!tr http://www.fortiguard.com/ve?vn=W32/PackAntiEm.A!tr Wed, 17 Feb 2010 11:59:08 -0800 Visible Symptoms

• The following file exists:
  
  
  • %WINDOWS%\Temp\_ex-{RANDOM}.exe

]]> http://www.fortiguard.com/ve?vn=W32/PackAgent.A!tr.dldr http://www.fortiguard.com/ve?vn=W32/PackAgent.A!tr.dldr Wed, 17 Feb 2010 11:26:19 -0800 Visible Symptoms

• The following files exist:
  
  
  • %Windows%\invanovt.exe.exe
  • %Temp%\01.exe


• A fake error message box is displayed.

]]> http://www.fortiguard.com/ve?vn=W32/IRCBot.MSM!tr.bdr http://www.fortiguard.com/ve?vn=W32/IRCBot.MSM!tr.bdr Thu, 11 Feb 2010 13:55:19 -0800 Visible Symptoms

The malware attempts to send SMS messages to premium phone numbers.
]]> http://www.fortiguard.com/ve?vn=Java/Smex.A!tr http://www.fortiguard.com/ve?vn=Java/Smex.A!tr Thu, 11 Feb 2010 03:23:15 -0800 Visible Symptoms

• A midlet named "SMS-Shot" is installed.
• The phone attempts to send an SMS to short number 7565.

]]> http://www.fortiguard.com/ve?vn=Java/SmsShot.A!tr.dial http://www.fortiguard.com/ve?vn=Java/SmsShot.A!tr.dial Wed, 10 Feb 2010 10:53:57 -0800 Visible Symptoms

Sends SMS to short code numbers.
]]> http://www.fortiguard.com/ve?vn=HackerTool/FullBox http://www.fortiguard.com/ve?vn=HackerTool/FullBox Wed, 10 Feb 2010 10:49:30 -0800 Visible Symptoms

The phone attempts to send SMS messages to premium numbers.
]]> http://www.fortiguard.com/ve?vn=Java/SmsBoxer.N!tr http://www.fortiguard.com/ve?vn=Java/SmsBoxer.N!tr Wed, 10 Feb 2010 10:12:14 -0800 Visible Symptoms

The legitimate web server of the iPhone application Serversman is killed. Consequently, the iPhone is no longer accessible via HTTP.
]]> http://www.fortiguard.com/ve?vn=HackerTool/IPhoneSmandos http://www.fortiguard.com/ve?vn=HackerTool/IPhoneSmandos Wed, 10 Feb 2010 09:51:48 -0800 Visible Symptoms

• The mobile attempts to send SMS messages to short numbers

]]> http://www.fortiguard.com/ve?vn=Java/Konov.N!tr http://www.fortiguard.com/ve?vn=Java/Konov.N!tr Wed, 10 Feb 2010 09:14:40 -0800 Visible Symptoms

• The phone requests user's consent to send SMS messages to premium phone numbers

]]> http://www.fortiguard.com/ve?vn=Java/ZoomSms.A!tr http://www.fortiguard.com/ve?vn=Java/ZoomSms.A!tr Wed, 10 Feb 2010 09:09:53 -0800 Visible Symptoms


This is a screen saver. This screen saver shows a fake BSOD (Blue Screen of Death). After that, it shows a Windows boot screen.

]]> http://www.fortiguard.com/ve?vn=Joke/Bluescreen http://www.fortiguard.com/ve?vn=Joke/Bluescreen Tue, 09 Feb 2010 15:43:45 -0800 Visible Symptoms


There are no visible symptoms.

]]> http://www.fortiguard.com/ve?vn=LNK/Agent.JHB!tr.dldr http://www.fortiguard.com/ve?vn=LNK/Agent.JHB!tr.dldr Tue, 09 Feb 2010 15:43:19 -0800 Visible Symptoms

• The following files exist:
  
  
  • %SYSTEM%\wsrv.sys
  • %SYSTEM%\wsrv.dll

]]> http://www.fortiguard.com/ve?vn=W32/Small.AY!tr http://www.fortiguard.com/ve?vn=W32/Small.AY!tr Tue, 09 Feb 2010 12:10:44 -0800 Visible Symptoms

• The computer may be unstable.

]]> http://www.fortiguard.com/ve?vn=WPAKill!tr http://www.fortiguard.com/ve?vn=WPAKill!tr Tue, 09 Feb 2010 12:04:44 -0800