Submission Summary:

• Submission details:
• Submission received: 3 March 2009, 22:35:59
• Processing time: 5 min 53 sec
• Submitted sample:
• File MD5: 0x279FCEA6AC148659569F5B3B166F09B8
• File SHA-1: 0xF95D349CB82AA5BBCCAE62F17394AE1C9AEC0A07
• Filesize: 45,056 bytes
• Alias:
• Adware.Altnet_Software [PCTools]
• Adware.Topsearch [Symantec]
• not-a-virus:AdWare.Win32.Altnet.g [Kaspersky Lab]
• Adware-Altnet [McAfee]
• Adware:Win32/Altnet [Microsoft]
• not-a-virus:AdWare.Win32.Altnet.g [Ikarus]

• Summary of the findings:

What's been found	Severity Level
Contains characteristics of an identified security risk.

Technical Details:

• The new window was created, as shown below:

Possible Security Risk

• Attention! Characteristics of the following security risks were identified in the system:

Security Risk	Description
Adware.Joltid_P2P_Networking	Part of the Altnet suite of Promotional supported software which displays advertisements and pop-ups.
Adware.Altnet_Software	Bundled with Kazaa. Installs a Browser Helper Object: which loads when IE is started. Altnet software is used to supply advertising content to KaZaA users

• Attention! The following threat category was identified:

Threat Category	Description
	A potentially unwanted adware program designed to deliver various advertisements to the users' systems

File System Modifications

• The following file was created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%Temp%\__unin__.exe [file and pathname of the sample #1]	45,056 bytes	MD5: 0x279FCEA6AC148659569F5B3B166F09B8 SHA-1: 0xF95D349CB82AA5BBCCAE62F17394AE1C9AEC0A07	Adware.Altnet_Software [PCTools] Adware.Topsearch [Symantec] not-a-virus:AdWare.Win32.Altnet.g [Kaspersky Lab] Adware-Altnet [McAfee] Adware:Win32/Altnet [Microsoft] not-a-virus:AdWare.Win32.Altnet.g [Ikarus]

• Note:
• %Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).

Memory Modifications

• There were new processes created in the system:

Process Name	Process Filename	Main Module Size
[filename of the sample #1]	[file and pathname of the sample #1]	45,056 bytes
__unin__.exe	%Temp%\__unin__.exe	45,056 bytes

Registry Modifications

• The following Registry Keys were created:
• HKEY_LOCAL_MACHINE\SOFTWARE\P2P Networking
• HKEY_LOCAL_MACHINE\SOFTWARE\P2P Networking\Clients

Other details

• Analysis of the file resources indicate the following possible country of origin:

	Australia

• To mark the presence in the system, the following Mutex object was created:
• DBWinMutex

• A system request is initiated to shut down and then restart the system.