Submission Summary:

• Submission details:
• Submission received: 27 August 2010, 04:48:21
• Processing time: 7 min 54 sec
• Submitted sample:
• File MD5: 0x1489BDE0A93BB0FA4B87CAF2AE6E7624
• File SHA-1: 0x37844827B08D9FDAC36FBC505F8A427626858466
• Filesize: 72,704 bytes
• Alias:
• Malware.Yimfoca [PCTools]
• W32.Yimfoca [Symantec]
• IM-Worm.Win32.Yahos.am [Kaspersky Lab]
• W32/Checkout [McAfee]
• Mal/Rimecud-D [Sophos]
• Worm:Win32/Pushbot.SW [Microsoft]
• IM-Worm.Win32.Yahos [Ikarus]
• Win32/Yahos.worm.72704 [AhnLab]

• Summary of the findings:

What's been found	Severity Level
Capability to manipulate a user list control in instant messenger (IM) programs such as AOL, Yahoo! Messenger, Skype. An affected user's contact list could be used by an IM worm in order to replicate over the IM network.
Creates a startup registry entry.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! The following threat categories were identified:

Threat Category	Description
	A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment
	A network-aware worm that attempts to replicate across the existing network(s)

File System Modifications

• The following file was created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%Windir%\jusched.exe [file and pathname of the sample #1]	72,704 bytes	MD5: 0x1489BDE0A93BB0FA4B87CAF2AE6E7624 SHA-1: 0x37844827B08D9FDAC36FBC505F8A427626858466	Malware.Yimfoca [PCTools] W32.Yimfoca [Symantec] IM-Worm.Win32.Yahos.am [Kaspersky Lab] W32/Checkout [McAfee] Mal/Rimecud-D [Sophos] Worm:Win32/Pushbot.SW [Microsoft] IM-Worm.Win32.Yahos [Ikarus] Win32/Yahos.worm.72704 [AhnLab]

• Note:
• %Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.

Memory Modifications

• There was a new process created in the system:

Process Name	Process Filename	Main Module Size
jusched.exe	%Windir%\jusched.exe	3,141,632 bytes

• The following system service was modified:

• Notes:
• %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

Registry Modifications

• The newly created Registry Values are:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
• Java developer Script Browse = "%Windir%\jusched.exe"

so that jusched.exe runs every time Windows starts

• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\Run]
• Java developer Script Browse = "%Windir%\jusched.exe"

so that jusched.exe runs every time Windows starts

• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
• Java developer Script Browse = "%Windir%\jusched.exe"

so that jusched.exe runs every time Windows starts