http://www.f-secure.com These are F-Secure malware descriptions en Copyright, F-Secure Fri, 04 November 2011 10:00:00 +0800 Wed, 16 November 2011 13:34:00 +0800 http://blogs.law.harvard.edu/tech/rss webmaster@f-secure.com webmaster@f-secure.com http://www.f-secure.com/v-descs/rootkit_w32_zaccess.shtml Rootkit:W32/ZAccess constantly displays advertisements on the infected machine and may silently contact remote servers to retrieve additional advertising information. http://www.f-secure.com/v-descs/backdoor_osx_devilrobber_a.shtml Backdoor:OSX/DevilRobber.A silently installs applications related to Bitcoin-mining; it may also harvest data from the infected machine and listen for additional commands from a remote user. http://www.f-secure.com/v-descs/backdoor_osx_tsunami_a.shtml Backdoor:OSX/Tsunami.A is a distributed denial-of-service (DDoS) flooder that is also capable of downloading files and executing shell commands in an infected system. http://www.f-secure.com/v-descs/trojan-downloader_osx_flashback_c.shtml Trojan-Downloader:OSX/Flashback.C poses as a Flash Player installer and connects to a remote host to obtain further installation files and configuration. http://www.f-secure.com/v-descs/trojan-downloader_osx_flashback_b.shtml Trojan-Downloader:OSX/Flashback.B poses as a Flash Player installer, and connects to a remote host to obtain further installation configuration and files. http://www.f-secure.com/v-descs/trojan-dropper_osx_revir_b.shtml Trojan-Dropper:OSX/Revir.B drops and executes a backdoor program onto the system, while camouflaging its activity by opening a JPG file to distract the user. http://www.f-secure.com/v-descs/monitoring-tool_android_simchecker_a.shtml Monitoring-Tool:Android/SimChecker.A collects geolocation and other device information, and sends out this information via SMS messages and e-mails. http://www.f-secure.com/v-descs/trojan-downloader_osx_flashback_a.shtml Trojan-Downloader:OSX/Flashback.A poses as a Flash Player installer, and connects to a remote host to obtain further installation configuration and files. http://www.f-secure.com/v-descs/backdoor_osx_imuler_a.shtml Backdoor:OSX/Imuler.A contacts a remote server for instructions; it may then steal files or capture a screenshot of the infected computer system, which is then forwarded to the remote server. http://www.f-secure.com/v-descs/trojan-dropper_osx_revir_a.shtml Trojan-Dropper:OSX/Revir.A drops a downloader component that downloads a backdoor program onto the system, while camouflaging its activity by opening a PDF file to distract the user. http://www.f-secure.com/v-descs/worm_w32_morto_a.shtml Worm:W32/Morto.A propagates through Remote Desktop Services on Windows servers by brute-forcing the login credentials of the server. http://www.f-secure.com/v-descs/trojan_android_ginmaster_a.shtml Trojan:Android/GinMaster.A steals confidential information from the device and sends it to a remote website. http://www.f-secure.com/v-descs/trojan_w32_yakes.shtml Trojan:W32/Yakes variants attempt to connect to and download files from remote servers. http://www.f-secure.com/v-descs/trojan_android_droidkungfu_c.shtml Trojan:Android/DroidKungFu.C forwards confidential details to a remote server. http://www.f-secure.com/v-descs/trojan_android_autospsubscribe_a.shtml Trojan:Android/AutoSPSubscribe.A is a malicious app that targets Android users in China, and is distributed through unofficial markets. http://www.f-secure.com/v-descs/trojan_bash_qhost_wb.shtml Trojan:BASH/QHost.WB hijacks web traffic by modifying the hosts. http://www.f-secure.com/v-descs/trojan_android_yzhcsms_a.shtml Trojan:Android/YZHCSMS.A sends SMS/MMS messages to premium rate numbers, potentially incurring unexpected/unwanted usage charges. http://www.f-secure.com/v-descs/monitoring-tool_android_spybubble_a.shtml Monitoring-Tool:Android/SpyBubble.A is a commercially available tracking tool. http://www.f-secure.com/v-descs/trojan_android_basebridge_a.shtml Trojan:Android/BaseBridge.A forwards confidential details to a remote server. http://www.f-secure.com/sw-desc/spyware_android_flexispy_k.shtml Spyware:Android/Flexispy.K is a commercially available monitoring program. http://www.f-secure.com/v-descs/rogue_osx_fakemacdef_a.shtml Dishonest antivirus software which tricks users into buying or installing it, usually by infecting a user's computer, or by pretending the computer is infected. http://www.f-secure.com/v-descs/trojan_w32_murofet_a.shtml This trojan attempts to download a file (presumably malicious) from a randomly generated domain. http://www.f-secure.com/v-descs/virus_w32_ramnit_n.shtml A program that secretly and maliciously integrates itself into program or data files. It spreads by integrating itself into more files each time the host program is run. http://www.f-secure.com/v-descs/backdoor_w32_knockex_a.shtml A remote administration utility that bypasses normal security mechanisms to secretly control a program, computer or network. http://www.f-secure.com/v-descs/trojan-downloader_w32_kazy17907.shtml This type of trojan secretly downloads malicious files from a remote server, then installs and executes the files. http://www.f-secure.com/v-descs/trojan-downloader_w32_kdv176347.shtml This type of trojan secretly downloads malicious files from a remote server, then installs and executes the files. http://www.f-secure.com/v-descs/exploit_w32_msword6_gen.shtml The Generic Detection Exploit.msword.gen.6 identifies a Microsoft Word document that has been modified to perform an unauthorized, malicious action. http://www.f-secure.com/v-descs/exploit_w32_d-encrypted_gen.shtml A program or technique that takes advantage of a vulnerability to remotely access or attack a program, computer or server. http://www.f-secure.com/v-descs/trojan_w32_antiav.shtml Also known as a trojan horse program, this is a deceptive program that performs additional actions without the user's knowledge or permission. It does not replicate. http://europe.f-secure.com/v-descs/worm_acad_kenilfe_a.shtml The worm is a malicious AutoCAD program that propagates via removable drives. It also attempts to download Visual Basic Scripts from remote servers, if certain conditions are met. http://europe.f-secure.com/sw-desc/adware_w32_clickpotato_a.shtml This program delivers advertising content to the user. It is usually annoying but harmless, unless it is combined with spyware or trackware. http://europe.f-secure.com/v-descs/backdoor_w32_spyrat_d.shtml A remote administration utility that bypasses normal security mechanisms to secretly control a program, computer or network. http://europe.f-secure.com/v-descs/rogue_w32_systemtool.shtml This detection identifies a malicious roguewareprogram, typically used to deceive users into purchasing a fake application. http://europe.f-secure.com/v-descs/backdoor_w32_bohu_a.shtml This program installs various files onto the system. Among the components installed are: a backdoor which connects to an external site to optain updates and other settings; and a component that monitors web traffic to various search engines in China and the domains of certain antivirus (AV) vendors. http://europe.f-secure.com/v-descs/packed_w32_pecan_a.shtml This program is packed using a packer program associated with numerous other malware. http://www.f-secure.com/v-descs/rootkit_w32_zxshell_b.shtml Rootkit:W32/Zxshell.B is dropped by Backdoor:W32/Zxshell.A and basically functions as a protection mechanism for its main payload file. http://www.f-secure.com/v-descs/backdoor_w32_zxshell_a.shtml Backdoor:W32/Zxshell.A is a DLL file with an exported function ("Install"), which is called to install the backdoor. http://europe.f-secure.com/v-descs/other_w32_false_positive.shtml Latest False Positive Notices:Adware.smartad.dThis detection was unintentionally triggered on a JavaScript file associated with Google Analytics. A Hydra exclusion for this detection (2010-12-10_01) was released at 0052 UTC on 10th December, followed by an Aquarius database update (2010-12-10_03) released at 0215 UTC which removes the detection entirely. Please ensure your database is updated to resolve this issue. http://www.f-secure.com/v-descs/worm_w32_todon_i.shtml Worm:W32/Todon.I is a worm that spreads to new victim machines via infected removable and network drives. The worm also has trojan-downloader capabilities, as it attempts to download additional files from remote servers. http://www.f-secure.com/v-descs/trojan_js_obfuscated_gen.shtml Trojan:JS/Obfuscated.Gen is a Generic Detection that identifies malicious HTML, Javascripts, PDF, or any scripting files that contain obfuscated code, which may be used by malware authors to evade antivirus signature detection, as well as making malicious scripts harder discover and analyze http://www.f-secure.com/v-descs/backdoor_wince_phonecreeper_a.shtml Backdoor:WinCE/PhoneCreeper.A provides unauthorized remote access to a mobile device. http://www.f-secure.com/v-descs/other_w32_generic.shtml Other:W32/Generic is a Generic Detection for a wide range of malicious programs, such as trojans, worms and keyloggers. http://www.f-secure.com/v-descs/application_w32_keygen.shtml Application:W32/Keygen identifies non-malicious files used to emulate a Microsoft Key Management Server in order to use cracked license keys for Windows 7. http://www.f-secure.com/v-descs/trojan_symbos_zeusmitmo_a.shtml When installed on a mobile phone, this trojan monitors all incoming SMS messages and acts as a backdoor for receiving commands sent by an attacker via SMS messages. http://www.f-secure.com/v-descs/worm_w32_downadup_al.shtml Worm:W32/Conficker.AL is a variant of <a href="http://www.f-secure.com/v-descs/worm_w32_downadup_a.shtml">Worm:W32/Downadup</a> that can spread using three different methods and is capable of hiding its actions on the infected machine, as well as downloading files from remote sites. http://www.f-secure.com/v-descs/worm_w32_downadup_a.shtml Worm:W32/Downadup exploits a vulnerability in the Windows Server service to spread copies of itself across a network. The worm also attempts to download files from a remote server. http://www.f-secure.com/v-descs/worm_w32_downaduprun_a.shtml Worm:W32/Downaduprun.A is Generic Detection of the malicious autorun files created by <a href="http://www.f-secure.com/v-descs/worm_w32_downadup_a.shtml">Worm:W32/Downadup</a>, which exploit the Windows Autorun functionality to spread the worm. http://www.f-secure.com/v-descs/worm_w32_downadup_gen.shtml Worm:W32/Downadup.gen is a Generic Detection of <a href="http://www.f-secure.com/v-descs/worm_w32_downadup_a.shtml">Worm:W32/Downadup</a>. http://www.f-secure.com/v-descs/exploit_w32_pdf-payload_gen.shtml Exploit:W32/PDF-Payload.Gen is a Generic Detection for Portable Document Format (PDF) files that attempt to exploit vulnerabilities in the popular Adobe Acrobat Reader program. http://www.f-secure.com/v-descs/trojan_w32_trojan.shtml This program performs a malicious action, either due to deliberate intent or to bugs in its programming. Malicious actions may vary from data tampering to disabling a computer system. http://www.f-secure.com/sw-desc/toolbar_w32_myglobalsearch.shtml A browser plug-in which provides additional functionality not included in the standard browser. May introduce security risks not present in the standard browser. http://www.f-secure.com/v-descs/other_w32_vulnerability.shtml A programming flaw or security loophole that may allow other users, applications or attackers to affect a program or system without the user's authorization or knowledge. http://www.f-secure.com/v-descs/trojan-spy_w32_zbot_pua.shtml This type of trojan secretly installs spy programs and/or keylogger programs.