Skip to main content
Skip to main content
Microsoft Security Intelligence
500 entries found. Displaying page 1 of 25.
Updated on May 23, 2011
VirTool:Win32/DelfInject.gen!AB is a generic detection for malicious files that are obfuscated using particular techniques to protect them from detection or analysis.
Alert level: severe
Updated on Jul 01, 2011

Virus:Win32/Ramnit.AB is the detection for files infected by variants of the Win32/Ramnit malware family. This malware drops and loads other malware, which may be detected as Trojan:Win32/Ramnit.gen!A.

Alert level: severe
Updated on May 25, 2010
TrojanDownloader:Win32/Zlob.gen!AB is generic detection for a component of the greater Win32/Zlob malware family. Win32/Zlob refers to a large multi-component family of malware that modifies Internet Explorer's settings, alters and redirects the user's default Internet search page and home page, and attempts to download and execute arbitrary files (including additional malicious software). The Win32/Zlob family has also been associated with rogue security programs that display misleading warnings regarding bogus malware infections.
Alert level: severe
Updated on Apr 11, 2011
Exploit:JS/Mult.AB is detection for JavaScript that runs multiple vulnerability exploitations in order to download, execute or otherwise run arbitrary code. The malicious JavaScript may be hosted on compromised Web sites.
Alert level: severe
Updated on Apr 11, 2011
Worm:Win32/Nuqel.AB is a worm - a self-propagating program that can spread itself from one computer to another. Worms may spread themselves via a variety of different channels in order to compromise new machines. Commonly, worms may spread directly by copying themselves to removable or network drives, or by attempting to exploit particular vulnerabilities on targeted machines. Worms also often attempt to spread via platforms that require user interaction in order to run. They may send themselves as an attachment to an email or an instant message, or send a link to a copy of themselves in the body of a message. In these cases the message needs to be convincing enough to encourage the victim to click on the link or attachment and run or download a copy of the worm.
Alert level: severe
Updated on Apr 11, 2011
Backdoor:Win32/Koceg.AB is the detection for a trojan backdoor that steals FTP credentials and may be instructed to download and install other malicious files from remote Web sites.
Alert level: severe
Updated on Apr 11, 2011
PWS:Win32/Ldpinch.AB is a member of Win32/Ldpinch - a family of trojans that steals sensitive information from affected machines and sends it to a remote attacker. In particular, Ldpinch variants target passwords for a comprehensive selection of FTP, chat and e-mail clients, as well as those stored by browsers and in protected storage.
Alert level: severe
Updated on Apr 11, 2011
Worm:Win32/Sohanad.AB is a member of Win32/Sohanad - a family of worms that may spread via removable or network drives and particular messenger applications. It may also modify a number of system settings to facilitate its actions on an affected computer, and contact a remote host.
Alert level: severe
Updated on Jun 08, 2011

Trojan:Win32/Alureon.gen!AB is the generic detection for a member of the Win32/Alureon family. It drops another malware, tries to delete the Hosts file, and tries to create a virtual file system (VFS). It may also connect to certain servers.

Alert level: severe
Updated on Apr 11, 2011
VirTool:Win32/VBInject.gen!AB is a generic detection for malicious files that are obfuscated using particular techniques to protect them from detection or analysis.
Alert level: severe
Updated on Apr 11, 2011
TrojanDownloader:Java/OpenConnection.AB is a trojan Java applet that could allow the downloading and execution of arbitrary malicious files.
Alert level: severe
Updated on Sep 04, 2013

Trojan:Win64/Sirefef.AB is a component of the Sirefef multi-platform rootkit, related to Win32/Sirefef. Sirefef is multi-component malware family that modifies search results when you search for something on the Internet and generates pay-per-click advertising revenue for its controllers. This particular component clicks on links supplied by a remote attacker to generate revenue.

Alert level: severe
Updated on Nov 18, 2013

Microsoft security software detects and removes this threat.

This family of malware uses stealth to hide itself. Trojans in this family can do different things, including:

  • Downloading and running other files
  • Contacting remote hosts
  • Disabling security features

Members of the family can also change search results, which can generate money for the attackers who use Sirefef.

Variants of Win32/Sirefef may be installed by other malware, including variants of the Trojan:Win32/Necurs family.

See the Win32/Sirefef family description for more information.

Alert level: severe
Updated on Apr 11, 2011
TrojanDownloader:ASX/Wimad is a detection for malicious Windows media files that are used in order to encourage users to download and execute arbitrary files on an affected machine. When opened with Windows Media Player, these malicious files open a particular URL in a web browser. 
Alert level: severe
Updated on Apr 11, 2011
Worm:Win32/Brontok.AB@mm is a worm that spreads via e-mail and removable drives. The worm spreads by sending a copy of itself as an e-mail attachment to e-mail addresses that it gathers from files on the infected computer. It can also copy itself to USB and pen drives. Win32/Brontok can disable antivirus and security software, immediately terminate certain applications, and cause Windows to restart immediately when certain applications run. The worm may also conduct Denial of Service (DoS) attacks against certain web sites.
Alert level: severe
Updated on Feb 14, 2024
Alert level: severe
Updated on Apr 11, 2011
VirTool:Win32/Obfuscator are detections for programs that have had their purpose obfuscated to hinder analysis or detection by anti-virus scanners. They commonly employ a combination of methods including encryption, compression, anti-debugging and anti-emulation techniques.
Alert level: severe
Updated on Aug 15, 2013

Windows Defender detects and removes this threat.

Trojan:DOS/Alureon.AB is a part of Win32/Alureon - a family of data-stealing malware. Alureon steals confidential information from your computer, such as user names, passwords, and credit card data. Win32/Alureon may also allow an attacker to transmit malicious data to your computer.

This particular variant infects the Master Boot Record (MBR).

Alert level: severe
Updated on Apr 11, 2011
Worm:Win32/Pushbot.AB is a worm that may spread via MSN Messenger and/or AIM. The worm also contains backdoor functionality that allows unauthorized access to an affected machine. This worm does not spread automatically upon installation, but must be ordered to spread by a remote attacker.
Alert level: severe
Updated on May 23, 2011
VirTool:JS/Obfuscator are detections for programs that have had their purpose obfuscated to hinder analysis or detection by anti-virus scanners. They commonly employ a variety of techniques such as encryption.
Alert level: severe