Submission Summary:

• Submission details:
• Submission received: 18 February 2010, 16:39:02
• Processing time: 6 min 58 sec
• Submitted sample:
• File MD5: 0x33AE3E85A03E02F5600BFB79A1EF8E6A
• File SHA-1: 0xE1BCAB50067CFFD37C7C18394E57CDE766D3BD44
• Filesize: 108,450 bytes
• Alias:
• Trojan-PWS.OnlineGames.ARUN [PCTools]
• Infostealer.Gampass [Symantec]
• Trojan-GameThief.Win32.OnLineGames.ssx [Kaspersky Lab]
• PWS-Gamania.gen.a [McAfee]
• Mal_NSAnti-1 [Trend Micro]
• Mal/EncPk-CE [Sophos]
• Worm:Win32/Taterf.AA [Microsoft]

• Summary of the findings:

What's been found	Severity Level
Sets the drive to autoplay by creating autorun.inf file in its root directory. If the drive is shared across the network then other remote computers can be infected any time they try to access this share.
Creates a startup registry entry.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! The following threat categories were identified:

Threat Category	Description
	A keylogger program that can capture all user keystrokes (including confidential details such username, password, credit card number, etc.)
	A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	c:\autorun.inf	618 bytes	MD5: 0x3EE014B2107300F5F14B3B3E6A3F7BD0 SHA-1: 0x1F05CF787E6C6DE83B3C907C971F50D890B7138F	Trojan-PWS.OnlineGames.generic.A!ct [PCTools] Trojan-GameThief.Win32.OnLineGames.ssx [Kaspersky Lab] Generic!atr [McAfee] Mal/AutoInf-B, Mal/AutoInf-A [Sophos] Trojan-GameThief.Win32.OnLineGames [Ikarus] BAT/OnlineGameHack [AhnLab]
2	%Temp%\zamxy7il.dll	30,091 bytes	MD5: 0x46A4A48A46CA1A611A22DE81DD33EBB8 SHA-1: 0x025CD0A7795E71EC8852DED2F0DF48DF33B8FA84	Trojan.Lineage.Gen!Pac.3 [PCTools] Infostealer.Gampass [Symantec] Trojan-GameThief.Win32.OnLineGames.ssx [Kaspersky Lab] PWS-Gamania.gen.a [McAfee] Mal/EncPk-CE [Sophos] VirTool:Win32/Vanti.gen!D [Microsoft] Trojan-GameThief.Win32.OnLineGames [Ikarus]
3	%System%\amvo.exe [file and pathname of the sample #1] c:\y82td3td.com	108,450 bytes	MD5: 0x33AE3E85A03E02F5600BFB79A1EF8E6A SHA-1: 0xE1BCAB50067CFFD37C7C18394E57CDE766D3BD44	Trojan-PWS.OnlineGames.ARUN [PCTools] Infostealer.Gampass [Symantec] Trojan-GameThief.Win32.OnLineGames.ssx [Kaspersky Lab] PWS-Gamania.gen.a [McAfee] Mal_NSAnti-1 [Trend Micro] Mal/EncPk-CE [Sophos] Worm:Win32/Taterf.AA [Microsoft]
4	%System%\amvo0.dll %System%\amvo1.dll	71,680 bytes	MD5: 0xCF5E004B43C08214D5FAF14630ECFEAB SHA-1: 0xD7C1D826B1BF5D4B6F8B791459D8DDDE60C695A6	Trojan.Lineage.Gen!Pac.3 [PCTools] Trojan.Packed.NsAnti [Symantec] Trojan-GameThief.Win32.OnLineGames.ssx [Kaspersky Lab] PWS-Gamania.gen.a [McAfee] Mal_NSAnti-1 [Trend Micro] Mal/EncPk-CE, Mal/Krap-K, Mal/Krap-K [Sophos] Worm:Win32/Taterf.A.dll [Microsoft] Trojan-GameThief.Win32.OnLineGames [Ikarus]

• Notes:
• %Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).
• %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

Memory Modifications

• The following module was loaded into the address space of other process(es):

Module Name	Module Filename	Address Space Details
amvo0.dll	%System%\amvo0.dll	Process name: explorer.exe Process filename: %Windir%\explorer.exe Address space: 0x1FF0000 - 0x2013000

• Notes:
• %Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.

• There was a new kernel-mode driver installed in the system:

Driver Name	Driver Filename
wincab.sys	%System%\wincab.sys

Registry Modifications

• The following Registry Keys were created:
• HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_JHYUIOPEWFJESWED
• HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_JHYUIOPEWFJESWED\0000
• HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_JHYUIOPEWFJESWED\0000\Control
• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_JHYUIOPEWFJESWED
• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_JHYUIOPEWFJESWED\0000
• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_JHYUIOPEWFJESWED\0000\Control

• The newly created Registry Values are:
• [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_JHYUIOPEWFJESWED\0000\Control]
• *NewlyCreated* = 0x00000000
• ActiveService = "jhyuiopewfjeswed"
• [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_JHYUIOPEWFJESWED\0000]
• Service = "jhyuiopewfjeswed"
• Legacy = 0x00000001
• ConfigFlags = 0x00000000
• Class = "LegacyDriver"
• ClassGUID = "{8ECC055D-047F-11D1-A537-0000F8753ED1}"
• DeviceDesc = "jhyuiopewfjeswed"
• [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_JHYUIOPEWFJESWED]
• NextInstance = 0x00000001
• [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_JHYUIOPEWFJESWED\0000\Control]
• *NewlyCreated* = 0x00000000
• ActiveService = "jhyuiopewfjeswed"
• [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_JHYUIOPEWFJESWED\0000]
• Service = "jhyuiopewfjeswed"
• Legacy = 0x00000001
• ConfigFlags = 0x00000000
• Class = "LegacyDriver"
• ClassGUID = "{8ECC055D-047F-11D1-A537-0000F8753ED1}"
• DeviceDesc = "jhyuiopewfjeswed"
• [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_JHYUIOPEWFJESWED]
• NextInstance = 0x00000001
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
• amva = "%System%\amvo.exe"

so that amvo.exe runs every time Windows starts

• The following Registry Value was modified:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL]
• CheckedValue =