Submission Summary:

• Submission details:
• Submission received: 28 May 2008, 02:49:24
• Processing time: 4 min 6 sec
• Submitted sample:
• File MD5: 0x23665C885DA8B61FE54B5A7AC788C50F
• File SHA-1: 0xD90CCB40B5A0DF50216D62D143178BD5A70D8411
• Filesize: 231,424 bytes
• Alias:
• Downloader [Symantec]
• Downloader-BCF [McAfee]

• Summary of the findings:

What's been found	Severity Level
Downloads/requests other files from Internet.
Creates a startup registry entry.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! Characteristics of the following security risks were identified in the system:

Security Risk	Description
Adware.ISMonitor!sd6	Adware.ISMonitor!sd6 is a potentially unwanted adware program that could be used to display various pop-up advertisements.
Adware.Adsponsor	Adsponsor is a Browser Helper Object which was installed by other malware. It contacts remote servers and display pop up advertisements. Adsponsor is a potential unwanted software.

• Attention! The following threat categories were identified:

Threat Category	Description
	A potentially unwanted adware program designed to deliver various advertisements to the users' systems
	A program that downloads files to the local computer that may represent security risk

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%Programs%\Internet Speed Monitor\Check Now.lnk	622 bytes	MD5: 0x194A4FF2A57E3EB1C97DDDDD161D320A SHA-1: 0xCEE1D88386DF4D6AF81D481F23A257866CD7EEBA	(not available)
2	%Programs%\Internet Speed Monitor\Uninstall.lnk	658 bytes	MD5: 0x6A3FE2AEE81A890A97415A32ACCF4EC0 SHA-1: 0xA5B34B8F368B1947ED890A85A7CFC76812E8D02A	(not available)
3	%ProgramFiles%\InetGet2\ISMSetup Venora2 (aid=28 gab10).exe	225,600 bytes	MD5: 0xBB9531C502C149CB0597D6EDFEF8AB28 SHA-1: 0xFB102D7B85F26273297E93B001A084228BD9481D	(not available)
4	%ProgramFiles%\ISM\ism.exe	237,568 bytes	MD5: 0xA6C126F526A2F4A823D24FC49D3E8142 SHA-1: 0x3E8888B520263E5E0257C89703660D61D6768FE8	Adware.ISMonitor!sd6 [PCTools] Adware.ISMonitor [Symantec]
5	%ProgramFiles%\ISM\Uninstall.exe	32,661 bytes	MD5: 0x400FFE3D48C23CF12BD1612EC70BDEAD SHA-1: 0xBD7F738795A7F4C6961C2898E1A9F9AF0995CF5B	(not available)
6	%ProgramFiles%\QdrPack\QdrPack16.exe	360,448 bytes	MD5: 0x356E9BE7D77A919D341391A3898F4784 SHA-1: 0xD16040771BB12B639122A6895D24B75CCDD654E0	Adware-ISM [McAfee]
7	[file and pathname of the sample #1]	231,424 bytes	MD5: 0x23665C885DA8B61FE54B5A7AC788C50F SHA-1: 0xD90CCB40B5A0DF50216D62D143178BD5A70D8411	Downloader [Symantec] Downloader-BCF [McAfee]

• Notes:
• %Programs% is a variable that refers to the file system directory that contains the user's program groups. A typical path is C:\Documents and Settings\[UserName]\Start Menu\Programs.
• %ProgramFiles% is a variable that refers to the Program Files folder. A typical path is C:\Program Files.

• The following directories were created:
• %Programs%\Internet Speed Monitor
• %ProgramFiles%\InetGet2
• %ProgramFiles%\ISM
• %ProgramFiles%\QdrPack

Memory Modifications

• There were new processes created in the system:

Process Name	Process Filename	Main Module Size
QdrPack16.exe	%ProgramFiles%\qdrpack\qdrpack16.exe	376,832 bytes
[filename of the sample #1]	[file and pathname of the sample #1]	311,296 bytes
ISMSetup Venora2 (aid=28 gab10).exe	%ProgramFiles%\InetGet2\ISMSetup Venora2 (aid=28 gab10).exe	184,320 bytes

Registry Modifications

• The following Registry Keys were created:
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ISM
• HKEY_CURRENT_USER\Software\Classes\CLSID\{F0CD1A40-0C77-1033-0410-0710070001}
• HKEY_CURRENT_USER\Software\QdrPack

• The newly created Registry Values are:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ISM]
• DisplayName = "Internet Speed Monitor"
• UninstallString = "%ProgramFiles%\ISM\Uninstall.exe"
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
• QdrPack16 = ""%ProgramFiles%\QdrPack\QdrPack16.exe""

so that QdrPack16.exe runs every time Windows starts

• [HKEY_CURRENT_USER\Software\Classes\CLSID\{F0CD1A40-0C77-1033-0410-0710070001}]
• b148 = "yes"
• [HKEY_CURRENT_USER\Software\QdrPack]
• Installed = 0x00000001
• aid = "28"
• Version = 0x00000010
• InstallDt = 0x000036CA

Other details

• Analysis of the file resources indicate the following possible countries of origin:

	Russian Federation
	France

• The data identified by the following URL was then requested from the remote web server:
• http://berlinads3.com/venora/we-connect.php

• The following Internet download was started (the retrieved bits are saved into the local file):

• Notes:
• %Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).