Submission Summary:

• Submission details:
• Submission received: 11 April 2008, 17:37:29
• Processing time: 3 min 56 sec
• Submitted sample:
• File MD5: 0x000E287A9279E24546BB7F5A4C88585F
• File SHA-1: 0xBB054C91FBF65C74D32A1F75500EBB65D3197869
• Filesize: 46,788 bytes
• Alias:
• FraudTool.AlertVir!sd5 [PCTools]
• Trojan Horse [Symantec]
• not-a-virus:FraudTool.Win32.AlertVir.a [Kaspersky Lab]
• TROJ_SMALL.FCY [Trend Micro]

• Summary of the findings:

What's been found	Severity Level
Downloads/requests other files from Internet.
Creates a startup registry entry.
Packed with a packer that is known to be used by malware (e.g. to complicate threat analysis or detection).
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! Characteristics of the following security risk was identified in the system:

Security Risk	Description
FraudTool.AlertVir!sd5	FraudTool.AlertVir!sd5 is a rogue software product that may use deceptive and unfair practices to trick consumers into purchasing it.

• Attention! The following threat categories were identified:

Threat Category	Description
	A hacktool that could be used by attackers to break into a system
	A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment

File System Modifications

• The following file was created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	[file and pathname of the sample #1]	46,788 bytes	MD5: 0x000E287A9279E24546BB7F5A4C88585F SHA-1: 0xBB054C91FBF65C74D32A1F75500EBB65D3197869	FraudTool.AlertVir!sd5 [PCTools] Trojan Horse [Symantec] not-a-virus:FraudTool.Win32.AlertVir.a [Kaspersky Lab] TROJ_SMALL.FCY [Trend Micro]

Memory Modifications

• There was a new process created in the system:

Registry Modifications

• The following Registry Key was created:
• HKEY_CURRENT_USER\Software\AlertVir

• The newly created Registry Values are:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
• Alertvir = "[file and pathname of the sample #1]"

so that [file and pathname of the sample #1] runs every time Windows starts

• [HKEY_CURRENT_USER\Software\AlertVir]
• ua = 0x00000000

Other details

• Analysis of the file resources indicate the following possible country of origin:

	Spain

• To mark the presence in the system, the following Mutex object was created:
• _!SHMSFTHISTORY!_

• The following port was open in the system:

• The following Internet Connection was established:

• The data identified by the following URL was then requested from the remote web server:
• http://www.alertvir.es/idultimaalerta.php?idver=11