Submission Summary:

• Submission details:
• Submission received: 11 August 2009, 07:19:27
• Processing time: 6 min 18 sec
• Submitted sample:
• File MD5: 0x164E1847B11E714FA1E003683DFF9FE8
• File SHA-1: 0x2E66D0CE7E729EAF61B76D7560F44EE7DA8E7AFD
• Filesize: 36,864 bytes
• Alias:
• W32.IRCBot.Gen [Symantec]
• Backdoor.Win32.IRCBot.gen [Kaspersky Lab]
• W32/Sdbot.worm.gen.a [McAfee]
• Mal/SillyFDC-A, Mal/Behav-010, Mal/IRCBot-B [Sophos]
• Worm:Win32/Pushbot.gen [Microsoft]
• Virus.Win32.IRCBot.BSX [Ikarus]
• Win32/IRCBot.worm.Gen [AhnLab]

• Summary of the findings:

What's been found	Severity Level
Communication with a remote IRC server.
Creates a startup registry entry.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! Characteristics of the following security risk was identified in the system:

• Attention! The following threat categories were identified:

Threat Category	Description
	A malicious backdoor trojan that runs in the background and allows remote access to the compromised system
	A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment

File System Modifications

• The following file was created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%Windir%\csrs.exe [file and pathname of the sample #1]	36,864 bytes	MD5: 0x164E1847B11E714FA1E003683DFF9FE8 SHA-1: 0x2E66D0CE7E729EAF61B76D7560F44EE7DA8E7AFD	W32.IRCBot.Gen [Symantec] Backdoor.Win32.IRCBot.gen [Kaspersky Lab] W32/Sdbot.worm.gen.a [McAfee] Mal/SillyFDC-A, Mal/Behav-010, Mal/IRCBot-B [Sophos] Worm:Win32/Pushbot.gen [Microsoft] Virus.Win32.IRCBot.BSX [Ikarus] Win32/IRCBot.worm.Gen [AhnLab]

• Note:
• %Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.

Memory Modifications

• There was a new process created in the system:

Process Name	Process Filename	Main Module Size
csrs.exe	%Windir%\csrs.exe	319,488 bytes

Registry Modifications

• The newly created Registry Values are:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
• Windows Services = "csrs.exe"

so that csrs.exe runs every time Windows starts

• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\Run]
• Windows Services = "csrs.exe"

so that csrs.exe runs every time Windows starts