-
Discovered:
- January 9, 2004
-
Updated:
- February 13, 2007 12:15:55 PM
-
Also Known As:
- Xombe [FSecure], Downloader-GJ [McAfee], Troj/Dloader-L [Sophos]
-
Type:
- Trojan Horse
-
Systems Affected:
- Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP
Trojan.Xombe is a Trojan horse that has at least two components: a 4,096 byte downloader and a 27,136 byte Trojan. The downloader component will retrieve the Trojan file from a predetermined Web site.
The download component has been distributed in an unsolicited email, purporting to be a security update for Windows XP, sent by Microsoft.
The email has the following characteristics:
From: windowsupdate@microsoft.com
Subject: Windows XP Service Pack 1 (Express) - Critical Update.
Attachment: winxp_sp1.exe(4,096 KB)
The Trojan is packed with UPX.
To prevent this Trojan from running, outgoing HTTP connections to domain gamemaniacs.org can be blocked.
Antivirus Protection Dates
-
Initial Rapid Release version January 9, 2004
-
Latest Rapid Release version September 28, 2010 revision 054
-
Initial Daily Certified version January 9, 2004
-
Latest Daily Certified version September 28, 2010 revision 036
-
Initial Weekly Certified release date January 14, 2004
Click for a more detailed description of Rapid Release and Daily Certified virus definitions.
Threat Assessment
Wild
-
Wild Level: Low
-
Number of Infections: 0 - 49
-
Number of Sites: 0 - 2
-
Geographical Distribution: Low
-
Threat Containment: Easy
-
Removal: Easy
Distribution
-
Distribution Level: Medium
Writeup By: Benjamin Nahorney
