Submission Summary:

• Submission details:
• Submission received: 14 July 2008, 20:36:52
• Processing time: 3 min 27 sec
• Submitted sample:
• File MD5: 0x2CD67D3A5805F7475C35A29ED5C70AFB
• File SHA-1: 0x1909AC44F596AC339299770238A7D19F1E00AA27
• Filesize: 101,910 bytes
• Alias:
• Trojan.Lineage.Gen!Pac.3 [PCTools]
• W32/Autorun.worm.bx.gen [McAfee]

• Summary of the findings:

What's been found	Severity Level
Downloads/requests other files from Internet.
Modifies some system settings that may have negative impact on overall system security state.
Creates a startup registry entry.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! Characteristics of the following security risks were identified in the system:

Security Risk	Description
Trojan-PWS.OnlineGames.ARun	Trojan-PWS.OnlineGames.ARun attempts to steal password information associated to popular online games such as MapleStory, Legend of Mir and World of Warcraft. It has the ability to spread itself via removable disk such as USB drives.
Trojan-PWS.Onlinegames.BS	Trojan.PWS.Onlinegames.BS is a Trojan that will start itself automatically and steal passwords of onlinegames on the infected machines.

• Attention! The following threat category was identified:

Threat Category	Description
	A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	c:\autorun.inf	570 bytes	MD5: 0x3C4C147C8ECFE5F2C497B51DE53A6EA2 SHA-1: 0x92E5AA6E53589ECCA30825ADAB844259661ECFE4	(not available)
2	%Temp%\fliuqm.dll	26,501 bytes	MD5: 0x8DCB945B9C021E0C508D9CE531431399 SHA-1: 0xB3E27630B55DC6F2220B13AB79122E86F04D7E5E	Trojan-PWS.OnlineGames.ARun [PCTools] PWS-OnlineGames.bl [McAfee] TSPY_ONLINEG.ICH [Trend Micro]
3	c:\tknn6.bat %System%\amvo.exe [file and pathname of the sample #1]	101,910 bytes	MD5: 0x2CD67D3A5805F7475C35A29ED5C70AFB SHA-1: 0x1909AC44F596AC339299770238A7D19F1E00AA27	Trojan.Lineage.Gen!Pac.3 [PCTools] W32/Autorun.worm.bx.gen [McAfee]
4	%System%\amvo0.dll	70,144 bytes	MD5: 0xBCD1AEADD579EACC6DB73A1B2FA75570 SHA-1: 0x158A6D3EE8F317319CC223668655CC3E9FDF36F8	Trojan.Lineage.Gen!Pac.3 [PCTools] PWS-LegMir.gen.k.dll [McAfee]

• Notes:
• %Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).
• %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

Memory Modifications

• There were new processes created in the system:

Process Name	Process Filename	Main Module Size
amvo.exe	%System%\amvo.exe	229,376 bytes
[filename of the sample #1]	[file and pathname of the sample #1]	229,376 bytes

• The following module was loaded into the address space of other process(es):

Module Name	Module Filename	Address Space Details
amvo1.dll	%System%\amvo1.dll	Process name: explorer.exe Process filename: %Windir%\explorer.exe Address space: 0xD80000 - 0xDA2000

• Notes:
• %Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.

Registry Modifications

• The newly created Registry Value is:
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
• amva = "%System%\amvo.exe"

so that amvo.exe runs every time Windows starts

• The following Registry Value was modified:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL]
• CheckedValue = 0x00000000

so that hidden files and folders are not displayed in explorer when browsing the file system

Other details

• The following Internet download was started (the retrieved bits are saved into the local file):