Submission Summary:

• Submission details:
• Submission received: 5 February 2008, 01:37:45
• Processing time: 3 min 24 sec
• Submitted sample:
• File MD5: 0x289BFC7D7A0670582F993137417D5942
• Filesize: 20,480 bytes
• Alias:
• Trojan.PWS.OnlineGames.Gen.11 [PCTools]
• Infostealer.Gampass [Symantec]
• Trojan-PSW.Win32.OnLineGames.kw [Kaspersky Lab]
• Generic.abq [McAfee]
• TSPY_ONLINEG.BDQ [Trend Micro]

• Summary of the findings:

What's been found	Severity Level
Creates a startup registry entry.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! Characteristics of the following security risk was identified in the system:

Security Risk	Description
Trojan-PWS.OnlineGames.KW	Trojan.PSW.OnlineGames.KW monitors online games such as World of Warcraft to steal password information.

• Attention! The following threat categories were identified:

Threat Category	Description
	A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment
	A keylogger program that can capture all user keystrokes (including confidential details such username, password, credit card number, etc.)
	A program that downloads files to the local computer that may represent security risk

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%Temp%\iexpl0re.exe [file and pathname of the sample #1]	20,480 bytes	MD5: 0x289BFC7D7A0670582F993137417D5942	Trojan.PWS.OnlineGames.Gen.11 [PCTools] Infostealer.Gampass [Symantec] Trojan-PSW.Win32.OnLineGames.kw [Kaspersky Lab] Generic.abq [McAfee] TSPY_ONLINEG.BDQ [Trend Micro]
2	%Temp%\LgSy0.dll %Temp%\LgSy1.dll	13,824 bytes	MD5: 0x901ED515B5B854D6AD274C2819530860	Trojan-PWS.OnlineGames.KW [PCTools] Downloader [Symantec] Trojan-PSW.Win32.OnLineGames.ky [Kaspersky Lab] PWS-LegMir.dll [McAfee] TSPY_ONLINEG.BKD [Trend Micro]

• Note:
• %Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).

Memory Modifications

• There were new processes created in the system:

Process Name	Process Filename	Main Module Size
iexpl0re.exe	%Temp%\iexpl0re.exe	45,056 bytes
[filename of the sample #1]	[file and pathname of the sample #1]	45,056 bytes

Registry Modifications

• The newly created Registry Value is:
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
• 2h4dybm = "%Temp%\iexpl0re.exe"

so that iexpl0re.exe runs every time Windows starts