ThreatExpert Report: Spyware.CheatMonitor, Heuristic.ADH, not-a-virus:Monitor.Win32.CheatMonitor.a..

Visit ThreatExpert web site

Close Report

Submission Summary:

Submission details:

Submission received: 6 September 2010, 18:21:17
Processing time: 8 min 57 sec
Submitted sample:

File MD5: 0x29C3CFD3691D73BD8AFD12DDB96E620F
File SHA-1: 0x77D4DAE9E16C9A0961FB739789CA95B7F921B2FA
Filesize: 1,032,472 bytes
Alias:

Spyware.CheatMonitor [PCTools]
Heuristic.ADH [Symantec]
not-a-virus:Monitor.Win32.CheatMonitor.a [Kaspersky Lab]
Generic PUP.z [McAfee]
not-a-virus:Monitor.Win32.CheatMonitor [Ikarus]

Technical Details:

File System Modifications

The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%AppData%\Protexis\UserSettings.xml	112 bytes	MD5: 0x89DCFDE5F75AA1F0250646D3AA148EDC SHA-1: 0x1DA2821AD8D7C6F3B09C7EA68C8231261BF26DAD	(not available)
2	%Temp%\VSD6.tmp\DotNetFX\dotnetchk.exe %Temp%\VSD8.tmp\DotNetFX\dotnetchk.exe	87,552 bytes	MD5: 0x4992D98E6772A5FD7256C4C7FE978A11 SHA-1: 0x6CF70905908B59553E1B92E057C3E7C13BD7B6A4	(not available)
3	%Temp%\VSD6.tmp\install.log	2,636 bytes	MD5: 0x259D7B292B248618F6B4223163FDCC6D SHA-1: 0x84EB4842A19B05571505C27A5C62A29D6914A42E	(not available)
4	%Temp%\VSD8.tmp\install.log	2,636 bytes	MD5: 0x85D083C29819ABDC4C80264E540511E8 SHA-1: 0x1AA3082F9ED528FA4BAAD48699F41AC6D4291ABD	(not available)
5	%ProgramFiles%\Common Files\cmx1\cmx1.exe	1,540,096 bytes	MD5: 0x0218E0E8DC9FA22A89E672997774BA0C SHA-1: 0x823363E0F708FCEFFA3300A4C1BE284EDBFB6810	(not available)
6	%ProgramFiles%\Common Files\cmx1\remove.exe	34,621 bytes	MD5: 0x8B196BA10CD0E537FA8E0AAAF6B62C6D SHA-1: 0x7CDDEFE36828C38C340B1261FDE97FAB54782A7E	(not available)
7	%ProgramFiles%\Common Files\cmx1\setup.exe	496,128 bytes	MD5: 0x528B6265CE9C7782FCF8B42BA28DF92A SHA-1: 0x6E33A1F93FCA1C223276A3F47C4859DDAF5869EF	(not available)
8	%System%\4081AB28A8.dll	8 bytes	MD5: 0x30D5858EEFB0B40B95B9A0D12F8E6837 SHA-1: 0x40DA095D5294F889F10E645AC4274ACF39121D47	(not available)
9	[file and pathname of the sample #1]	1,032,472 bytes	MD5: 0x29C3CFD3691D73BD8AFD12DDB96E620F SHA-1: 0x77D4DAE9E16C9A0961FB739789CA95B7F921B2FA	Spyware.CheatMonitor [PCTools] Heuristic.ADH [Symantec] not-a-virus:Monitor.Win32.CheatMonitor.a [Kaspersky Lab] Generic PUP.z [McAfee] not-a-virus:Monitor.Win32.CheatMonitor [Ikarus]

Notes:

%AppData% is a variable that refers to the file system directory that serves as a common repository for application-specific data. A typical path is C:\Documents and Settings\[UserName]\Application Data.
%Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).
%ProgramFiles% is a variable that refers to the Program Files folder. A typical path is C:\Program Files.
%System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

The following directories were created:

%Temp%\VSD8.tmp
%CommonAppData%\Protexis
%AppData%\Protexis
%Temp%\VSD6.tmp
%Temp%\VSD6.tmp\DotNetFX
%Temp%\VSD8.tmp\DotNetFX
%ProgramFiles%\Common Files\cmx1

Notes:

%CommonAppData% is a variable that refers to the file system directory containing application data for all users. A typical path is C:\Documents and Settings\All Users\Application Data.

Memory Modifications

There was a new process created in the system:

Process Name	Process Filename	Main Module Size
setup.exe	%ProgramFiles%\Common Files\cmx1\setup.exe	516,096 bytes

The following system service was modified:

Service Name	Display Name	New Status	Service Filename
MSIServer	Windows Installer	"Running"	%System%\msiexec.exe /V

Registry Modifications

The following Registry Values were modified:

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ServiceCurrent]

(Default) =

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ServiceCurrent]

(Default) =

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.

The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.