Submission Summary:

• Submission details:
• Submission received: 17 February 2009, 11:35:52
• Processing time: 5 min 59 sec
• Submitted sample:
• File MD5: 0x037E4637B4E034DAA2CB8FF8915E95CB
• File SHA-1: 0x3BA17E1BBF51F29AB511CFBD3449B16FC018036C
• Filesize: 416,631 bytes

• Summary of the findings:

What's been found	Severity Level
Downloads/requests other files from Internet.
Registers a 32-bit in-process server DLL.
Registers a Browser Helper Object (Microsoft's Internet Explorer plugin module).

Technical Details:

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%Temp%\gewhk1	125 bytes	MD5: 0x7C5F5A68051F6B0C0E9A2AD33C40D415 SHA-1: 0x120865765927A61AF83F02B83DC297EEDE61EC41	(not available)
2	%Temp%\nscA.tmp	32,768 bytes	MD5: 0xBB7DF04E1B0A2570657527A7E108AE23 SHA-1: 0x5188431849B4613152FD7BDBA6A3FF0A4FD6424B	(not available)
3	%Temp%\nst3.tmp\System.dll	10,240 bytes	MD5: 0x7E3C808299AA2C405DFFA864471DDB7F SHA-1: 0xB5DE7804DD35ED7AFD0C3B59D866F1A0749495E0	(not available)
4	%System%\cont_adservefast-remove.exe	55,186 bytes	MD5: 0x5CD64EBC02B0B797FA797757F466FB23 SHA-1: 0x7A7FE8A993FBE2887382B05D469595401F428C9D	(not available)
5	%System%\nsz4.dll	573,952 bytes	MD5: 0x0E66F263A547B5DC7B0634D3EDEA0448 SHA-1: 0x9BA829F101F8AE9F0F2CC20A5469CD77214CAD79	Generic PUP.x [McAfee] Adware:Win32/MxLiveMedia [Microsoft] AdWare.Win32.MxLiveMedia [Ikarus]
6	[file and pathname of the sample #1]	416,631 bytes	MD5: 0x037E4637B4E034DAA2CB8FF8915E95CB SHA-1: 0x3BA17E1BBF51F29AB511CFBD3449B16FC018036C	(not available)

• Notes:
• %Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).
• %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

• The following directory was created:
• %Temp%\nst3.tmp

Memory Modifications

• There were new processes created in the system:

Process Name	Process Filename	Main Module Size
cont_adservefast-remove.exe	%System%\cont_adservefast-remove.exe	196,608 bytes
[filename of the sample #1]	[file and pathname of the sample #1]	196,608 bytes

Registry Modifications

• The following Registry Keys were created:
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{15d41976-7db0-6d55-394c-e98ccce1842f}
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{15d41976-7db0-6d55-394c-e98ccce1842f}\InProcServer32
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{15d41976-7db0-6d55-394c-e98ccce1842f}
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\cont_adservefast

• The newly created Registry Values are:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{15d41976-7db0-6d55-394c-e98ccce1842f}\InProcServer32]
• (Default) = "%System%\nsz4.dll"
• ThreadingModel = "Apartment"
• [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{15d41976-7db0-6d55-394c-e98ccce1842f}]
• (Default) = "adservefast"
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{15d41976-7db0-6d55-394c-e98ccce1842f}]
• NoExplorer = """"
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\cont_adservefast]
• DisplayName = "Contextual Tool Adservefast"
• UninstallString = "%System%\cont_adservefast-remove.exe"
• NoModify = 0x00000000
• NoRepair = 0x00000000
• DisplayVersion = "4.6.3.7"

Other details

• The following Host Name was requested from a host database:
• ads2.adservefast.biz

• The following HTTP URL was started reading:
• http://ads2.adservefast.biz/smb/nsi_install.php?inst_result=success&hwid=5048ce2b6c6dbac689cdafbd7dfb18d51a7d4447