Content

DAT Readme

Download the latest anti virus definitions for McAfee® VirusScan®. Ensure your McAfee® product contains the most up-to-date detection and prevention.
http://www.mcafee.com/apps/downloads/security_updates/dat.asp

DAT Version 4624
DAT Release Date 11/09/2005
Threats Detected 157301
New Detections 58
Enhanced Detections 212

Enhanced detections are those that have been modified for this release. Detections are enhanced to cover new variants, optimize performance, and correct incorrect identifications.

Noteworthy threats are those that had an Avert risk assessment of Low-Profiled, Medium, Medium-On-Watch, High, or High-Outbreak at the time of DAT release.

Noteworthy Threats:

Name Corporate Risk Assessment Home Risk Assessment
There are no noteworthy threats in this release

New Detections:

Internet Worm (1)
  - (1)
    Linux/Lupper.worm.b
Program (19)
   (6)
    VSource/dab
    WorldAntiSpy.lnk
    VSource/alpha
    Tool/ftp3
    Tool/ftp2
    Tool/fmt23
  - (1)
    XCP
  Dropper (1)
    WorldAntiSpy.dr
  Malware Tool (4)
    HTool/stem
    HTool/adduser
    HTool/adduser2
    PWCrack-SnadBoy
  Script (3)
    Tool/kex
    Tool/del5
    Tool/antihack
  StartPage (1)
    StartPage-Meche
  Tool (2)
    Tool-Fumn.vxd
    Tool-Fumn
  Win32 (1)
    WorldAntiSpy
Trojan (29)
   (7)
    Sicily
    Page Bomb
    Comska
    SymbOS/Multidropper.q!sis
    Phenix
    Gator
    SymbOS/Multidropper!sis
  Application extension (1)
    Downloader-ARB.dll
  Downloader (2)
    Downloader-AGS
    Downloader-AGR
  Dropper (2)
    BackDoor-CVM.dr
    IRC-Tjspec.dr
  Malware Tool (2)
    NTRootKit-O
    Spam-Than
  Password Stealer (1)
    PWS-Goldun.sys
  Remote Access (1)
    BackDoor-CVM
  Script (12)
    Bat/trt
    Bat/qz158
    Bat/nosh18
    Bat/klw23
    Bat/dyi
    Bat/dt155
    Bat/tees
    Bat/pha
    Bat/nosh17
    Bat/kbd5
    Bat/dt156
    Bat/avk75
  Win31 (1)
    Rizalian
Virus (9)
  Email (1)
    W32/Sober.s@MM
  Email Generic (1)
    W32/Loosky.gen@MM
  Generic Worm (1)
    Linux/Lupper.worm.gen
  Parasitic (1)
    W32/HLLP.62128
  Script (1)
    Lupus.bat
  Win32 (2)
    W32/Incub
    W32/Katomik
  Worm (2)
    Linux/Lupper.worm.a
    W32/Kelvir.worm.fq

Enhanced Detections:

Internet Worm (2)
  E-mail (2)
    W32/Sober.e@MM
    W32/Sober.j@MM
Program (31)
   (5)
    VSource/jel
    VSource/cg
    Generic PUP.a
    Generic PUP.b
    VSource/inf
  Adware (12)
    Adware-Virtumundo
    Adware-Starware
    Adware-17Lele
    Adware-NaviPromo
    Adware-Mirar
    Adware-NaviHelper
    Adware-Oemji
    Adware-Pacimedia
    Adware-WinAd
    Adware-CasClient
    Adware-Cometsys
    Adware-WinTools
  Application extension (2)
    Favadd.dll
    Adware-2Search.dll
  Downloader (1)
    Adware-WinAd.dldr
  Dropper (3)
    Adware-WinAd.dr
    Adware-CasClient.dr
    Keylog-Ardamax.dr
  Generic (1)
    Dialer-RAS.bm.gen
  Malware Tool (1)
    BackDoor-CEP.kit
  Registry (1)
    Reg-DetectKeys25
  Spyware (2)
    Spyware-Webhancer
    Spyware-SpyLantern
  Win32 (3)
    KillApp
    TrueActive
    Favadd
Trojan (80)
   (18)
    EIC
    Generic component
    SymbOS/Multidropper.a!sis
    SymbOS/Multidropper.e!sis
    SymbOS/Multidropper.c!sis
    SymbOS/Multidropper.g!sis
    Generic.ca
    SymbOS/Multidropper.b!sis
    SymbOS/Multidropper.f!sis
    SymbOS/Multidropper.d!sis
    SymbOS/Multidropper.k!sis
    SymbOS/Multidropper.j!sis
    SymbOS/Multidropper.i!sis
    SymbOS/Multidropper.h!sis
    SymbOS/Multidropper.l!sis
    Generic Downloader.w
    Generic.dc
    Generic.cb
  - (1)
    AdClicker-AJ
  Application extension (6)
    BackDoor-AWQ.dll
    Keylog-SCLog.dll
    BackDoor-BAC.dll
    BackDoor-CDF.dll
    PWS-Vipgsm.dll
    PWS-Goldun.dll
  Client (1)
    BackDoor-AFZ.cli
  Configurator (1)
    BackDoor-CUQ.cfg
  Demonstration (1)
    JS/Exploit-Script.demo
  Downloader (6)
    Downloader-DC
    Downloader-AAI
    Downloader-AFX
    Downloader-AGF
    Downloader-ABU
    Downloader-AGP
  Dropper (4)
    BackDoor-AWQ.dr
    BackDoor-AVW.dr
    BackDoor-BAC.dr
    PWS-Goldun.dr
  Email (1)
    W32/Sober.q
  Exploit (2)
    Exploit-ObscuredHtml
    Exploit-MS03-037
  Generic (8)
    Generic Downloader.gen.be
    BackDoor-BAC.gen
    PWS-Banker.gen.ba
    PWS-Banker.gen.bb
    PWS-Banker.gen.h
    PWS-Banker.gen.g
    PWS-Banker.gen.t
    BackDoor-CEO.gen
  Password Stealer (2)
    PWS-QQRob
    PWS-Goldun
  Proxy (1)
    Proxy-Piky
  Remote Access (12)
    BackDoor-ARR
    BackDoor-AWQ.b
    BackDoor-BAC
    BackDoor-AWQ
    BackDoor-AGS
    BackDoor-AFZ
    BackDoor-CUL
    BackDoor-CPI
    BackDoor-CLC
    BackDoor-CPY
    BackDoor-CEO
    Generic BackDoor.k
  Server (1)
    BackDoor-AFZ.svr
  Win32 (15)
    Generic Downloader.a
    Generic Downloader.c
    Generic.i
    Generic Downloader.ak
    Generic BackDoor.bc
    Generic Proxy.b
    Generic Downloader.q
    Pokey.a
    Generic PWS.o
    DNSChanger.a
    Generic BackDoor.u
    Generic Downloader.ab
    Generic StartPage.o
    Generic VB.c
    DDoS-Boxed
Virus (99)
   (1)
    XS.851
  Damaged (1)
    W32/Sober.dam
  Damaged Worm (4)
    W32/Spybot.worm.dam
    W32/Gaobot.worm.dam
    W32/Kelvir.worm.dam
    W32/Sdbot.worm.dam
  Dropper (1)
    W32/Sober.dr
  E-mail (5)
    W32/Sober.c@MM
    W32/Sober.d@MM
    W32/Sober.p@MM
    W32/Sober.o@MM!M414
    W32/Sober.g@MM
  E-mail worm (3)
    W32/Sober.f@MM
    W32/Sober.b@MM
    W32/Sober.l@MM
  Email (1)
    W32/Sober.m@MM
  Email Generic (1)
    W32/Mytob.gen@MM
  Email Worm (1)
    W32/Sober.k@MM
  Floppy (1)
    W32/Generic!floppy
  Generic Worm (22)
    W32/Spybot.worm.gen.e
    W32/Gaobot.worm.gen.e
    W32/IRCbot.worm.gen
    W32/Sdbot.worm.gen.as
    W32/Sdbot.worm.gen.w
    W32/Gaobot.worm.gen.l
    W32/Sdbot.worm.gen.n
    W32/Sdbot.worm.gen.l
    W32/Sdbot.worm.gen.j
    W32/Sdbot.worm.gen.h
    W32/Gaobot.worm.gen.n
    W32/Sdbot.worm.gen.bk
    W32/Kelvir.worm.gen
    W32/Sdbot.worm.gen.ai
    W32/Gaobot.worm.gen.t
    W32/Sdbot.worm.gen.bd
    W32/Sdbot.worm.gen.bi
    W32/Sdbot.worm.gen.by
    W32/Sdbot.worm.gen.bj
    W32/Sdbot.worm.gen.bw
    W32/Sdbot.worm.gen.q
    W32/Gaobot.worm.gen.r
  Internet Worm (4)
    W32/Sober.a@MM
    W32/Kelvir.worm.c
    W32/Kelvir.worm.b
    W32/Kelvir.worm.dq
  Overwriting (1)
    Univ.ow/a
  Script (1)
    Univ.script/99a
  Win32 (6)
    W32/Generic.d
    W32/Generic.e
    W32/Generic.j
    W32/Generic!im
    W32/Generic.m
    W32/Generic.Delphi.a
  Worm (46)
    W32/Kelvir.worm.ew
    W32/Kelvir.worm.ev
    W32/Kelvir.worm
    W32/Kelvir.worm.ea
    W32/Kelvir.worm.ff
    W32/Kelvir.worm.ee
    W32/Kelvir.worm.eg
    W32/Kelvir.worm.eh
    W32/Kelvir.worm.ey
    W32/Kelvir.worm.fg
    W32/Kelvir.worm.bg
    W32/Kelvir.worm.ef
    W32/Kelvir.worm.d
    W32/Kelvir.worm.fk
    W32/Kelvir.worm.fj
    W32/Kelvir.worm.fh
    W32/Kelvir.worm.fi
    W32/Kelvir.worm.g
    W32/Kelvir.worm.k
    W32/Kelvir.worm.j
    W32/Kelvir.worm.a
    W32/Kelvir.worm.cm
    W32/Kelvir.worm.ck
    W32/Kelvir.worm.cj
    W32/Kelvir.worm.o
    W32/Kelvir.worm.n
    W32/Kelvir.worm.s
    W32/Kelvir.worm.fm
    W32/Kelvir.worm.fl
    W32/Kelvir.worm.l
    W32/Kelvir.worm.m
    W32/Kelvir.worm.t
    W32/Kelvir.worm.r
    W32/Kelvir.worm.cn
    W32/Kelvir.worm.cw
    W32/Kelvir.worm.cz
    W32/Kelvir.worm.ak
    W32/Kelvir.worm.co
    W32/Kelvir.worm.cx
    W32/Kelvir.worm.ab
    W32/Kelvir.worm.dc
    W32/Kelvir.worm.dg
    W32/Kelvir.worm.dv
    W32/Kelvir.worm.dj
    W32/Kelvir.worm.dx
    W32/Kelvir.worm.dz