| Visit ThreatExpert web site | | | Close Report |
| What's been found | Severity Level |
| Produces outbound traffic. |  |
| Downloads/requests other files from Internet. | |
| Creates a startup registry entry. |  |
| Registers a 32-bit in-process server DLL. | |
| Registers a Browser Helper Object (Microsoft's Internet Explorer plugin module). | |
| Contains characteristics of an identified security risk. |  |
 | Possible Security Risk |
| Security Risk | Description |
Adware.BHO.GEN |
Adware.BHO.GEN is adware that use BHOs to display ads or can be used for malicious purposes like gathering info on your surfing habits. It also has the functionality to download and install further malicious files from remote servers. |
| Trojan.FakeAlert |
Trojan.FakeAlert will hijack the desktop background with an image alerting the user that their computer system has been infected with spyware. It also changes some settings of windows which include:- disabling permissions for the user to change the background image and setting the active desktop to 'show web content'. It is usually installed in conjunction with a rogue anti-spyware application. |
| Threat Category | Description |
 |
A network-aware worm that attempts to replicate across the existing network(s) |
 | File System Modifications |
| # | Filename(s) | File Size | File Hash | Alias |
| 1 | %AppData%\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#specificclick.net\settings.sol | 87 bytes | MD5: 0xC1388F8EB3F4352973844EB87B6C5FA7 SHA-1: 0x3112A3C277888EE54C9887B1A941FC9CFDE98433 |
(not available) |
| 2 | %AppData%\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#suitesmart.com\settings.sol | 84 bytes | MD5: 0x7252078074940B57CF20BF0D157C258B SHA-1: 0x0BF827D6509588C79DC0BAD4120F1C466D25FF03 |
(not available) |
| 3 | %AppData%\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sol | 204 bytes | MD5: 0x426042EA272BD1FA9368ADEA009ADA9A SHA-1: 0xEA22B9696F44DAA617C3FD9027D8E70085C6C180 |
(not available) |
| 4 | %AppData%\Macromedia\Flash Player\specificclick.net\img\gu.sol | 69 bytes | MD5: 0xB9B848DEC1F832A2A5F69B66A07C46C8 SHA-1: 0xC8FEC63FFA5B3751B260947898D8012C2A532D31 |
(not available) |
| 5 | %AppData%\Macromedia\Flash Player\suitesmart.com\6thElement.sol | 151 bytes | MD5: 0x9972C6D17B811E13E7FFCD5E97467741 SHA-1: 0x2895CBDF0617DF4396CC197B1260EE1161109CEB |
(not available) |
| 6 | %Temp%\4.tmp | 76,800 bytes | MD5: 0xD669F6DDEB953B31ABCFA6E62F932CC2 SHA-1: 0xFB8C09365FBADB64B057E982F6E404B6A6E95EA7 |
(not available) |
| 7 | %Temp%\a.dat | 78,444 bytes | MD5: 0xBAF79D526F474216F7EAA5BD577999BA SHA-1: 0x6CC0EDE0F0E10B535F8B4B79EEA39FB98A40900F |
(not available) |
| 8 |
%Temp%\a.exe
|
298,500 bytes | MD5: 0xF0C0636A810D15D229B16D773ABAB1C1 SHA-1: 0x7DD9B7C00E4E5F3B8D52186926BCE2FB1D43E19F |
Downloader-BWS [McAfee] |
| 9 |
%Temp%\b.exe
|
167,936 bytes | MD5: 0x54C1B2B1E6B0E767AD9768EC7F4DAFA9 SHA-1: 0xD73400E6E156D533010423B376D83207DB536767 |
Downloader-BWS [McAfee] |
| 10 |
%Temp%\c.exe
%Windir%\msa.exe
|
163,328 bytes | MD5: 0xD38573BDBB21112CCF50EE60D71C020D SHA-1: 0xBE31A3826185DFC56704897713E3E2E3C2AB94EC |
Downloader-BWS [McAfee] |
| 11 |
%Temp%\msxml71.dll
%System%\msxml71.dll
|
225,796 bytes | MD5: 0x4F14B8D2EC80D72A2809BD0080A81D50 SHA-1: 0xA4020016C3EEA2DE309328B86394F3E5824EAD6F |
(not available) |
| 12 | %UserProfile%\qktier.exe | 49,152 bytes | MD5: 0xBABFCD0A98FEFEC9FF4845FFF405E8B7 SHA-1: 0x9E6EC413A066B4302200BECAA66C8BB82E7076F6 |
Worm.Win32.VBNA.isu [Kaspersky Lab] W32/SillyFDC-DV [Sophos] |
| 13 | %UserProfile%\UserData\45SPQRWX\pmocntr[1].xml | 40 bytes | MD5: 0xB5E7F68B51A5B80BF635C3E757E86A83 SHA-1: 0x653054857448A4FC53EF22C6B3762D4DEAB16A73 |
(not available) |
| 14 | %UserProfile%\UserData\index.dat | 32,768 bytes | MD5: 0x537C10CFA371EFE2EB5884D5818CD2DA SHA-1: 0x5C2FD5A82795C4DD0F737C0F3A33EC22EC7B5F51 |
(not available) |
| 15 | [file and pathname of the sample #1] | 49,152 bytes | MD5: 0x0B8AAE0A3DDAAD38684E8211996F2205 SHA-1: 0xC51528CBFBEA175569357E743B3742BE191CCBCE |
Worm.Win32.VBNA.isu [Kaspersky Lab] W32/SillyFDC-DV [Sophos] Worm.Win32.Vobfus [Ikarus] |
| 16 | %Windir%\Tasks\{7B02EF0B-A410-4938-8480-9BA26420A627}.job | 330 bytes | MD5: 0xC8552BA703CD499063C218D2596944F4 SHA-1: 0x04FD0CE6D6D374EF1218D32B59A8D30BF984EC0C |
(not available) |
| 17 | %Windir%\Tasks\{BB65B0FB-5712-401b-B616-E69AC55E2757}.job | 290 bytes | MD5: 0xE36297952166744FBED59A76F49CF0D7 SHA-1: 0x9B84E7DCED990A21659745B508996EB9187C7804 |
(not available) |
 | Memory Modifications |
| Process Name | Process Filename | Main Module Size |
| [filename of the sample #1] | [file and pathname of the sample #1] | 57,344 bytes |
 | Registry Modifications |
 | Other details |
| Remote Host | Port Number |
| 209.12.183.104 | 80 |
| 64.120.164.40 | 80 |
| 64.120.164.41 | 80 |
| 64.191.30.57 | 80 |
| 64.210.72.27 | 80 |
| 64.210.72.49 | 80 |
| 64.210.72.51 | 80 |
| 64.241.242.90 | 80 |
| 66.197.207.41 | 80 |
| 66.199.229.230 | 80 |
 | Outbound traffic (potentially malicious) |
All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.
The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.
Copyright © 2010 ThreatExpert. All rights reserved.