Trojans and Spyware

Trojan
A classic trojan, a lie or deception. Not otherwise categorised

Dropper
TrojanDropper, Trojan.Dropper, MULDROP
This type of trojan drops other files (trojans)

Downloader
TrojanDownloader, Trojan.Downloader, WebDownloader
This type of trojan downloads other files (trojans)

Proxy
TrojanProxy, Trojan.Proxy, Spam Proxy
This type of trojan sets up spam email relays

FraudTool
Hoax, Adware This type of trojan pretends to find malware on your system, then asks for money to remove it. Virtual fraud/extortion..

Families and Variants

Many generic family and variant names are now used by most antivirus companies. This explains the known ones and what they mean.

Delf, VB
Viruses or other malware with these names are simply generic named samples. When a sample is obtained and it has no official name, it is named by characteristics, strings in the file or payload, or by author name. If none are known or easily found, the type of programming language is used to identify the family. VB for Visual Basic, Delf for Delphi. Some antivirus companies use these excessively when better names could be found for them.

Small
Small is exactly that. When samples come in and they are very small, often they have no strings to identify the project name or author, or even form names and classes. The easiest way to categorise the sample is to call it small. By now, many antivirus companies have thousands of variants called small, even thousands of just Trojan Downloader's which are called small. The naming is done with letters such that samples are .a .b .c and eventually .aa .ab etc.

Tiny
An even smaller variant - trojans which are tiny. 3kb is typical, which usually means only 1k or so of actual code.

Agent
Agent is a relatively newer naming which is given to money-related malware. Many trojan proxy, trojan spy, and trojan banker variants are AGENT variants. These are not all made by the same programmers nor are they all similar types of malware. Instead this name is given when it is clearly that type of program, used to leverage funds or outright steal money. An agent of evil perhaps...

Generic, Gen
Simply a generic detection, meaning a detection made by guesswork or by pattern matching which doesn't detect exact variants. Signatures which detect generic malware are rules for a heuristic analyser. These rules focus on what API functions a program imports, sometimes its relative size, and some significant code of certain functionality. Code scanning is done with high speed masks, searching to find known encryption patterns, and some generic detections are best made with simple file characteristics analysis.

Need to know about a specific trojan or spyware ?
Want to have a file analysed for trojans ?
Just email support and ask me anything you like!