Content

DAT Readme

Download the latest anti virus definitions for McAfee® VirusScan®. Ensure your McAfee® product contains the most up-to-date detection and prevention.
http://www.mcafee.com/apps/downloads/security_updates/dat.asp

DAT Version 4417
DAT Release Date 12/29/2004
Threats Detected 111451
New Detections 61
Enhanced Detections 126

Enhanced detections are those that have been modified for this release. Detections are enhanced to cover new variants, optimize performance, and correct incorrect identifications.

Noteworthy threats are those that had an Avert risk assessment of Low-Profiled, Medium, Medium-On-Watch, High, or High-Outbreak at the time of DAT release.

Noteworthy Threats:

Name Corporate Risk Assessment Home Risk Assessment
There are no noteworthy threats in this release

New Detections:

Program (2)
  Dialer (1)
    Dialer-237
  Downloader (1)
    Downloader-TN
Trojan (29)
  Application extension (1)
    BackDoor-CLK.dll
  Downloader (7)
    Downloader-TO
    Downloader-TL
    Downloader-TJ
    Downloader-FR.ldr
    Downloader-TM
    Downloader-TK
    Downloader-GG!chm
  Dropper (2)
    BackDoor-CKA.dr
    Fadiox.dr
  Exploit (6)
    Exploit-ANIfile
    Exploit-LoadImgAPI
    Exploit-phpBB!hilight
    JS/Exploit-HelpXSite
    Exploit-HelpZonePass
    Exploit-Winhlp
  Generic (1)
    JS/Exploit-BO.gen
  Malware Tool (1)
    Spam-Ultrapost
  Password Stealer (2)
    PWS-Banker.e
    PWS-Yulz
  Proxy (1)
    Proxy-Sambe
  Remote Access (2)
    BackDoor-CMH
    BackDoor-CMG
  Script (1)
    Perl/Shellbot
  StartPage (1)
    StartPage-FY
  Win32 (4)
    QHosts-22
    Generic MultiDropper.c
    Fadiox
    QReg-11
Virus (30)
   (3)
    SymbOS/Cabir!ezboot.h
    QHosts!apd!hosts
    SymbOS/Cabir!ezboot.i
  Application extension (1)
    W32/Mydoom.ao.dll
  Companion (1)
    W32/Casbo.cmp
  Dropper Worm (1)
    W32/Dodobot.worm.dr
  Email (3)
    VBS/Worlex@MM
    W32/Atak.k@MM
    W32/Breacuk.b@MM
  Generic (1)
    W32/Munzac.gen
  Internet Worm (1)
    Perl/Spyski.worm
  Parasitic (1)
    W32/HLLP.Philis.k
  PDA Device (3)
    SymbOS/Cabir.h
    SymbOS/Cabir.i
    SymbOS/Cabir.j
  Script (4)
    VBS/Waap
    VBS/Roor
    VBS/Oman
    Bat/Depro
  Win32 (8)
    W32/Mkar.e
    W32/Mkar.c
    W32/Mkar.a
    W32/Pulkfer
    W32/Mydoom
    W32/Mkar.f
    W32/Mkar.d
    W32/Mkar.b
  Worm (3)
    VBS/Bole.worm
    W32/Shodi.worm.i
    VBS/Chochi.worm

Enhanced Detections:

Internet Worm (1)
  Exploit (1)
    W32/Cran.worm.a
Program (5)
   (1)
    Redirected HOSTS
  Adware (1)
    Adware-Homepage
  Configurator (1)
    SmallHTTP.cfg
  Dialer (1)
    Dialer-236
  Win32 (1)
    SmallHTTP
Trojan (41)
   (2)
    Generic BackDoor.d
    Phish-BankFraud.eml
  Application extension (1)
    CoreFlood.dll
  Application extension Generi (1)
    BackDoor-AXJ.dll.gen
  Denial Of Svc (1)
    IRC/Flood
  Downloader (8)
    Downloader-EW
    Downloader-CY
    Downloader-NI
    Downloader-DA.js
    BackDoor-CLK
    Downloader-OQ
    Downloader-TB
    Downloader-TH
  Dropper (3)
    CoreFlood.dr
    PWS-Bancban.dr
    IRC-Sdbot.dr
  Dropper Generic (1)
    IRC-Sdbot.dr.gen
  Exploit (3)
    VBS/Psyme
    Exploit-MhtRedir.gen
    JS/Exploit-DragDrop.c
  Generic (3)
    PWS-Bancban.gen
    PWS-Bancos.gen
    BackDoor-WB.gen.b
  Malware Tool (1)
    NTRootKit-H
  Password (1)
    PWS-Watsn
  Password Stealer (2)
    PWS-Allight
    PWS-QQRob
  Proxy (1)
    Proxy-FBSR
  Remote Access (5)
    BackDoor-AXJ
    BackDoor-AQF
    Backdoor-TW
    BackDoor-AOZ
    BackDoor-ADW
  Script (1)
    W32/Sdbot.bat
  Win32 (7)
    ICQPager-Q
    Generic BackDoor.c
    QFav-2
    QLowZones-2
    AdClicker-BA
    Generic Downloader.f
    DDoS-Boxed
Virus (79)
   (8)
    SymbOS/Cabir!ezboot.e
    SymbOS/Cabir!ezboot.d
    SymbOS/Cabir!ezboot.c
    SymbOS/Cabir!ezboot
    SymbOS/Cabir.g
    SymbOS/Cabir.f
    SymbOS/Cabir.b
    SymbOS/Cabir.a
  Application extension (9)
    W32/Mydoom.a.dll
    W32/Mydoom.dll
    W32/Mydoom.b.dll
    W32/Mydoom.e.dll
    W32/Mydoom.f.dll
    W32/Mydoom.h.dll
    W32/Mydoom.g.dll
    W32/Mydoom.ae.dll
    W32/Mydoom.k.dll
  Damaged (2)
    W32/Sober.dam
    W32/Netsky.q.dam
  Damaged Worm (2)
    W32/Blaster.worm.dam
    W32/Sdbot.worm.dam
  Dropper Worm (1)
    W32/Blaster.worm.b.dr
  E-mail (1)
    W32/Atak.j@MM
  E-mail worm (2)
    W32/Atak.i@MM
    W32/Atak.b@MM
  Email (8)
    W32/Atak.c@MM
    W32/Atak.a@MM
    W32/Mydoom.aa@MM
    W32/Mydoom.an@MM
    W32/Atak.f@MM
    W32/Atak.h@MM
    W32/Atak.g@MM
    W32/Breacuk.a@MM
  Email Generic (2)
    W32/Atak.gen@MM
    W32/Mydoom.gen@MM
  Generic (3)
    VBS/Happy.gen
    W32/Mkar.gen
    SymbOS/Cabir.gen
  Generic Worm (12)
    W32/Sdbot.worm.gen
    W32/Sdbot.worm.gen.w
    W32/Blaster.worm.gen
    W32/Gaobot.worm.gen.j
    W32/Sdbot.worm.gen.l
    W32/Sdbot.worm.gen.j
    W32/Sdbot.worm.gen.h
    W32/Sdbot.worm.gen.i
    W32/Sdbot.worm.gen.g
    W32/Leox.worm.gen.gen
    W32/Sdbot.worm.gen.t
    W32/Spybot.worm.gen.n
  Intended Worm (1)
    W32/Atak.e@MM
  Internet Worm (5)
    W32/Sdbot.worm
    W32/Gbot.worm
    W32/Atak.d@MM
    Perl/Santy.worm
    W32/Gaobot.worm.gen.q
  mIRC Worm (1)
    W32/Protoride.worm
  MS Office Suite (1)
    VBA/Generic.src
  Parasitic (6)
    W32/HLLP.36864
    W32/HLLP.Philis.d
    W32/HLLP.Philis.c
    W32/HLLP.Philis.f
    W32/HLLP.Philis.b
    W32/HLLP.Philis.a
  PDA Device (3)
    SymbOS/Cabir.e
    SymbOS/Cabir.c
    SymbOS/Cabir.d
  Script (2)
    JS/Cassan
    VBS/Generic
  Win32 (3)
    W32/Generic.d
    W32/Zelly
    W32/Generic.Delphi
  Worm (7)
    W32/Blaster.worm.e
    W32/Blaster.worm.c
    W32/Blaster.worm.a
    W32/Blaster.worm.b
    W32/Blaster.worm.j
    W32/Dodobot.worm
    W32/Sdbot.worm!ftp