SA Downloader Lite

Aliases: Trojan-Downloader.Win32.SALite.10, Trojan-Downloader.Win32.SALite.11
Variants: 1.0, 1.1
Size: 20kb
Author: r3L4x
Created: APR 2003
OS: Windows
Location: TBD

Sacapass

Aliases: Backdoor.Win32.VB.hc, Trojan-PSW.Perder
Size: 49kb
Author: MalHack
Created: SEP 2000
OS: Windows
Location: HKCU\Software\Microsoft\Windows\CurrentVersion\Run\
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
Infection: msn sacapass.exe, ad-pi.exe, msmsgs.exe

Sacapass ZakHack

Aliases: Backdoor.Win32.VB.va
Size: 70kb
Created: AUG 2002
OS: Windows
Location: HKCU\Software\Microsoft\Windows\CurrentVersion\Run\
Infection: msmsgs.exe

Sacrificail Suicide

Aliases: Backdoor.Win32.Sacri.a
Port: 5393
Size: 82kb
Author: SiCmaggOt
Created: FEB 2004
OS: Windows
Location: HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\
Infection: msmsgs.exe

SadaHacker

Aliases: Backdoor.Win32.Ullysee.b, Virus.Win32.Parite.b
Variants: 1.0
Size: 35kb
Author: Sada
Created: FEB 2004
OS: Windows
Location: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices\
Infection: system java.exe

Sadam

Aliases: FTP.Win32.SlimFTPd.314
Port: 7829
Author: Ontarget
Created: FEB 2004
OS: Windows
Location: HKCU\Software\Microsoft\Windows\CurrentVersion\Run\
Infection: trustlixcb.exe, sadam.exe, sadam.swf, slimftpd.conf, slimftpd.log

Sadoor

Aliases: Backdoor.Win32.Sadoor
Variants: 1.1
Size: 91kb
Author: Nyberg
Created: DEC 2003
OS: Windows
Location: TBD

Sahm

Aliases: Backdoor.Win32.Delf.um
Port: 21, 12121
Size: 595kb
Created: TBD
OS: Windows
Location: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
Infection: server.exe

Sality

Aliases: Virus.Win32.Sality.q, W32/Sality.x, Win32/Sality.NAJ, W32.Sality.U, PE_SALITY.AS, W32.HLLP.Sality, Win32/Sality/E
Created: JAN 2007
OS: Windows
Location: HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\
Infection: syslib32.dll, oledsp32.dll, olemdb32.dll, wcimgr32.dll, wmimgr32.dll, WINFIGBO.BGO

Sanctuary

Created: DEC 1999
OS: Windows
Location: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\

Sandesa

Aliases: Trojan-Downloader.Win32.Sandesa.11, Trojan-Downloader.Win32.Sandesa.15
Variants: 1.1, 1.5
Size: 2kb
Author: jaNooNi
Created: JAN 2003
OS: Windows
Location: TBD

Sandpath Remote Control

Aliases: Backdoor.Win32.RemoteControl.b
Port: 4069
Author: Zhang Bin
Created: AUG 2002
OS: Windows
Location: TBD

Sandra

Aliases: Backdoor.Win32.Sandrador.b, Backdoor.Win32.Sandrador.c, Backdoor.Win32.Delf.jf
Variants: (b), (c)
Size: 12kb
Created: TBD
OS: Windows
Location: HKCU\Software\Microsoft\Windows\CurrentVersion\Run\
Infection: q167319.dll, svchost.exe, license.txt, satelliteresolver.exe, winsock.dll, 18100a.msi, pass.exe

Sanity RAT

Port: 1254
Size: 1.4mb
Author: Team Sanity
Created: JAN 2008
OS: Windows
Location: TBD

Sanya

Aliases: Backdoor.Win32.Agent.qw, Trojan-Spy.Win32.Hookey.a
Variants: 1.1
Created: NOV 2005
OS: Windows
Location: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\
Infection: j j .exe, s,ss.exe, khk.dll, rbmisc.dll, userinit.exe

Saria Fake Logins

Aliases: Trojan.Win32.FakeLogin.b
Author: Prince Ali
Created: AUG 2002
OS: Windows
Location: TBD

Satan

Aliases: Backdoor.Win32.VB.gen
Variants: 1.0, Lite 1.0
Port: 1981, 2027
Size: 8kb
Author: ENZO
Created: DEC 2003
OS: Windows
Location: HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\
Infection: expiorer.exe, systemkernel.exe

Satans Back Door

Created: FEB 1999
OS: Windows
Location: HKLM\SOFTWARE\MicrosoftWindows\CurrentVersion\RunServices\

Satan Cam View

Aliases: Backdoor.Win32.StealthEye.11.f, Backdoor.Win32.StealthEye.11.b
Variants: 1.0
Port: 9777, 9778
Size: 19kb
Author: ENZO
Created: DEC 2003
OS: Windows
Location: HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
Infection: camdrv.exe

Satan R.A.T

Aliases: Backdoor.Win32.Feardoor.15.c
Variants: 1.5
Port: 8811
Size: 102kb
Author: Virus Devil
Created: MAY 2005
OS: Windows
Location: TBD

Satanic Control

Aliases: Backdoor.Win32.VB.agc, Backdoor.Win32.agc
Variants: Beta, 1.0
Port: 8079
Size: 37kb
Author: Z6 aka ZeUsSiXSiXSiX
Created: JUN 2005
OS: Windows
Location: TBD

Satanz Backdoor

Aliases: “Satan’s Backdoor”, “SBD”, Backdoor.Win32.Satan, Backdoor.Win32.Satan.a, Backdoor.Win32.Satan.b, Backdoor.Win32.SBD.10
Variants: 1.0, 1.0(a), 1.0(b), 1.0 Final, 2.0 Beta
Port: 666
Size: 25kb
Author: Toxic Fox
Created: FEB 1999
OS: Windows
Location: HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\
Infection: sysport.exe

SatanzCrew Notifier

Aliases: Backdoor.Win32.SatanCrew
Variants: 1.0
Size: 24kb
Created: JUN 2002
OS: Windows
Location: HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
Infection: testing.exe

Satax Trojan

Aliases: Trojan-Dropper.Win32.Joiner.bn
Port: 1521
Size: 499kb
Author: Satax
Created: JAN 2008
OS: Windows
Location: TBD

Satellite-RAT

Aliases: Backdoor.Win32.Agent.aoh, Trojan-Spy.Win32.VB.qo, Constructor.Win32.Agent.cd, PSWTool.Win32.FirePass.b, Backdoor.Win32.VB.bqu
Variants: 1.0b, 1.0b2, 1.0b3, 2.0
Port: 195, 12345
Author: MarjinZ
Created: MAY 2007
OS: Windows
Location: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\run\
Infection: test.exe, jpg.dll, klg.dll, svch0st.exe, fwbmz.dll, win.bat

Sattelite

Aliases: Backdoor.Win32.VB.bm
Port: 7143
Created: TBD
OS: Windows
Location: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\
Infection: comcfg.exe, system.exe, explorer.exe

Savage dDevil

Aliases: TrojanDropper.Win32.VB.bg
Author: Chalex
Created: APR 2004
OS: Windows
Location: TBD
Infection: savageddevilfactory.exe, savageddevilfactory.exe.manifest, readme.txt, screenshot.jpg

SB-MSN

Aliases: Constructor.Win32.Agent.eu, Backdoor.Win32.Delf.hyu
Variants: 1.0
Size: 163kb
Author: Octalh
Created: APR 2008
OS: Windows
Location: HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\
Infection: sb-msn.exe

SBD

Aliases: “Shadowinteger’s Backdoor”
Variants: 1.21, 1.23, 1.27, 1.31, 1.33, 1.36
Size: 49kb
Author: Blomgren
Created: JUN 2004
OS: Windows
Location: TBD
Infection: sbdbg.exe, cmd.exe, hacker.tld

sBot

Aliases: Backdoor.Win32.Sbot.10, Backdoor.Win32.Sbot.12, Backdoor.Win32.Sbot.20
Variants: 1.0, 1.2, 2.0
Port: 113
Size: 14kb
Author: akcom
Created: MAY 2003
OS: Windows
Location: HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
Infection: msconfig.exe

School Bus

Created: APR 1999
OS: Windows
Location: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\

Schwindler

Created: MAR 1999
OS: Windows
Location: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\

Secret Service

Created: JUN 1999
OS: Windows
Location: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\

Secret Agent

Created: MAR 1999
OS: Windows
Location: DNR

Senna Spy FTP

Created: AUG 1999
OS: Windows
Location: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices\

SenSi

Created: MAY 1999
OS: Windows
Location: TBD

ServeMe

Created: MAY 1999
OS: Windows
Location: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices\

Shadow Phyre

Created: APR 1999
OS: Windows
Location: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\

Share All

Created: JAN 1998
OS: Windows
Location: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Network\Lan Man\

Shit Heep

Created: APR 1999
OS: Windows
Location: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices\

Shock Rave

Created: NOV 1998
OS: Windows
Location: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices\

Shtirlitz

Created: JAN 1999
OS: Windows
Location: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\

Silencer

Created: JAN 1999
OS: Windows
Location: HKCU\Software\Microsoft\Windows\CurrentVersion\Run\

SkyDance

Created: APR 2000
OS: Windows
Location: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\

Small Share

Created: APR 1999
OS: Windows
Location: TBD

Snid

Created: SEP 1999
OS: Windows
Location: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\

SniperNet

Created: FEB 2000
OS: Windows
Location: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce\

SoftWar

Created: OCT 1999
OS: Windows
Location: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\

Son of Psych Ward

Created: TBD
OS: Windows
Location: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\

Spirit 2000

Created: JUL 1999
OS: Windows
Location: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\

Spying King

Created: MAY 1999
OS: Windows
Location: TBD

Stealth

Created: FEB 1999
OS: Windows
Location: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\

Stealth Spy

Created: AUG 1998
OS: Windows
Location: DNR

Striker

Created: FEB 1999
OS: Windows
Location: DNR

Storm

Aliases: “The Storm/Dorf Worm”, Downloader-BAI, Troj/Dorf-Fam, Troj_small.edw, Trojan-Downloader.Win32.Small.dam, Trojan.DL.Tibs.Gen!Pac13, Trojan.Downloader-647, Trojan.Peacomm, Win32/Nuwar.N@MM!CME-711
Port: 4000, 7871, 11271
Size: 29,347 bytes
Created: JAN 2007
OS: Windows
Location: HKLM\SYSTEM\CurrentControlSet\Services\wincom32\
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WINCOM32\
Infection: Postcard.exe, FullVideo.exe, Full Story.exe, Video.exe, Read More.exe, FullClip.exe, GreetingPostcard.exe, MoreHere.exe, FlashPostcard.exe, GreetingCard.exe, ClickHere.exe, ReadMore.exe, FlashPostcard.exe, FullNews.exe, wincom32.sys, peers.ini

Studio 54

Created: MAR 2000
OS: Windows
Location: HKU\.Default\Software\Microsoft\Windows\CurrentVersion\Run\
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices\

Stukach

Created: NOV 1999
OS: Windows
Location: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\

SubSeven

Created: FEB 1999
OS: Windows
Location: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices\
HKLM\SOFTWARE\exefile\shell\open\command\

Subseven Apocalypse

Created: JUL 1999
OS: Windows
Location: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices\

SubZero

Created: DEC 2000
OS: Windows
Location: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\

Suck Info

Created: DEC 1998
OS: Windows
Location: TBD

Swift Remote

Created: MAR 2000
OS: Windows
Location: TBD

Syphilis

Created: NOV 1999
OS: Windows
Location: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\

Sysmon

Created: SEP 2000
OS: Windows
Location: TBD

System33

Created: DEC 1999
OS: Windows
Location: TBD