Submission Summary:

• Submission details:
• Submission received: 10 February 2010, 05:47:39
• Processing time: 7 min 11 sec
• Submitted sample:
• File MD5: 0x1E102CD1EEEAC4CE0530E40218F7BA1E
• File SHA-1: 0x96709FB3593898E4269EF09D2AC4EC594EF999CB
• Filesize: 145,408 bytes
• Alias:
• Malware.Gammima [PCTools]
• W32.Gammima.AG [Symantec]
• Trojan.Win32.Vaklik.bwn [Kaspersky Lab]
• PWS-OnlineGames.cn [McAfee]
• Mal/Generic-A [Sophos]
• Trojan:Win32/Sisproc [Microsoft]
• Win-Trojan/OnlineGameHack.145408 [AhnLab]

• Summary of the findings:

What's been found	Severity Level
Sets the drive to autoplay by creating autorun.inf file in its root directory. If the drive is shared across the network then other remote computers can be infected any time they try to access this share.
Creates a startup registry entry.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! The following threat category was identified:

Threat Category	Description
	A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	c:\autorun.inf	660 bytes	MD5: 0xC32AE571C4625A754E2BE7BE3D4BB654 SHA-1: 0x0F83B41858331EDF2FD86E9AE112B4B2DA628913	Mal/AutoInf-B, Mal/AutoInf-A [Sophos] Trojan.Script [Ikarus]
2	%Temp%\ekgwob.dll	31,615 bytes	MD5: 0x2363F8DB1A96FA9E90BCB0371E3D4D56 SHA-1: 0xAE124E534500A9389D7B779EED1D45531B8CBC6D	Malware.Gammima [PCTools] W32.Gammima [Symantec] Trojan-GameThief.Win32.Magania.yyt [Kaspersky Lab] PWS-Gamania.gen.a [McAfee] Mal/EncPk-CE [Sophos] VirTool:Win32/Vanti.gen!C [Microsoft] Win-Trojan/OnlineGameHack.31615 [AhnLab]
3	%Temp%\tru1.tmp	145,408 bytes	MD5: 0x1E102CD1EEEAC4CE0530E40218F7BA1E SHA-1: 0x96709FB3593898E4269EF09D2AC4EC594EF999CB	Malware.Gammima [PCTools] W32.Gammima.AG [Symantec] Trojan.Win32.Vaklik.bwn [Kaspersky Lab] PWS-OnlineGames.cn [McAfee] Mal/Generic-A [Sophos] Trojan:Win32/Sisproc [Microsoft] Win-Trojan/OnlineGameHack.145408 [AhnLab]
4	c:\hovrflst.bat %Windir%\2.exe %System%\kavo.exe	121,670 bytes	MD5: 0xB4AE1CE31BCC5FDECF0924F86417E23B SHA-1: 0x47E7B9109EE6CDCD011438004F1EE611BAC97600	Trojan.Vaklik!sd6 [PCTools] W32.Gammima [Symantec] Trojan.Win32.Vaklik.apk [Kaspersky Lab] PWS-Gamania.gen.a [McAfee] Mal/EncPk-DH [Sophos] Worm:Win32/Taterf.B [Microsoft] Trojan.Win32.Vaklik [Ikarus] Win-Trojan/Vaklik.121670 [AhnLab]
5	%System%\kavo0.dll %System%\kavo1.dll %System%\kavo2.dll	131,584 bytes	MD5: 0x08F3AEAE9ACC83DC84443A675F6F4BAD SHA-1: 0x64C6686F4E2A250BFA1D781C90735047885D4886	Trojan.Lineage.Gen!Pac.3 [PCTools] W32.Gammima [Symantec] Packed.Win32.Krap.b [Kaspersky Lab] PWS-Gamania.gen.a [McAfee] Mal/EncPk-DH [Sophos] Worm:Win32/Taterf.A.dll [Microsoft] Win-Trojan/OnlineGameHack.131584.C [AhnLab]

• Notes:
• %Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).
• %Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.
• %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

Memory Modifications

• There was a new process created in the system:

Process Name	Process Filename	Main Module Size
2.exe	%Windir%\2.exe	274,432 bytes

• The following modules were loaded into the address space of other process(es):

Module Name	Module Filename	Address Space Details
kavo2.dll	%System%\kavo2.dll	Process name: explorer.exe Process filename: %Windir%\explorer.exe Address space: 0x1EF0000 - 0x1F25000
kavo0.dll	%System%\kavo0.dll	Process name: IEXPLORE.EXE Process filename: %ProgramFiles%\internet explorer\iexplore.exe Address space: 0x1940000 - 0x1975000

• Notes:
• %ProgramFiles% is a variable that refers to the Program Files folder. A typical path is C:\Program Files.

Registry Modifications

• The newly created Registry Value is:
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
• kava = "%System%\kavo.exe"

so that kavo.exe runs every time Windows starts

• The following Registry Value was modified:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL]
• CheckedValue =

Other details

• Analysis of the file resources indicate the following possible country of origin:

	China