Re: New variant of Virus ?

[Nick FitzGerald <nick () virus-l demon co uk>]

Gary Flynn <flynngn () jmu edu> to Hubbard, Dan:

> > It looks like there maybe a new variant of the virus MyDoom worm. We
> > have seen the following:
> >
> > RE: I still love you  fLctv 
> >
> > Error 551: We are sorry your UTF-8 encoding is not supported by the
> > server, so the text was automatically zipped and attached to this
> > message.
<<snip>>
> We've seen several of these here since yesterday. I submitted
> it last night and was told third-hand that the following Sophos
> definition was created for it:
>
> http://www.sophos.com/virusinfo/analyses/trojstawina.html

Yes.

It seems this was distributed widely via spam about 24-36 hours ago 
(maybe more??).  It is _not_ a self-mailer although it does contain 
SMTP code.  It is a keylogger that looks for windows by name 
(specifically the names of various bank and financial sites) and 
captures keystrokes directed to those windows.  It then mails off the 
keystroke logs...

Various AVs have named it various things:

   Stawin.A
   PSW.Keylog.E
   TrojanSpy.Win32.Keylogger.aa
   Trojan.Spy.Keylogger.AA
   Trojan.Keylogger
   W32/Ovnod.A@pws
   Trojan.Nodav
   Trj/Govnodav.A
   Win32.Elkong.D


-- 
Nick FitzGerald
Computer Virus Consulting Ltd.
Ph/FAX: +64 3 3529854


---------------------------------------------------------------------------
----------------------------------------------------------------------------