ThreatExpert Report: Adware.Savenow, not-a-virus:WebToolbar.Win32.WhenU.a..

Visit ThreatExpert web site

Close Report

Submission Summary:

Submission details:

Submission received: 5 January 2009, 15:38:36
Processing time: 9 min 42 sec
Submitted sample:

File MD5: 0x36030A739D706ABCC388D818922048EF
File SHA-1: 0xC15B14C89F723ACAED8136A230B9E619FAF0ED83
Filesize: 3,529,024 bytes
Alias & packer info:

Adware.Savenow [Symantec]
not-a-virus:WebToolbar.Win32.WhenU.a [Kaspersky Lab]
not-a-virus:AdWare.Win32.OneStep [Ikarus]
packed with: WiseSFXDropper [Kaspersky Lab]

Summary of the findings:

What's been found	Severity Level
Produces outbound traffic.
Downloads/requests other files from Internet.
Creates a startup registry entry.
Registers a 32-bit in-process server DLL.
Contains characteristics of an identified security risk.

Technical Details:

The new window was created, as shown below:

NOTICE: The content shown in the above window is captured automatically and is not controlled or endorsed by ThreatExpert.
Please contact us on this link should any material be offensive or inappropriate and we will ensure any such content is blocked from future viewers of the report.

Possible Security Risk

Attention! Characteristics of the following security risk was identified in the system:

Security Risk	Description
Adware.WhenU_SaveNow	SaveNow shows targeted pop-up advertisements and coupons based on user's Internet surfing habits. It is usually distributed with other third party software such as BearShare.

Attention! The following threat category was identified:

Threat Category	Description
	A potentially unwanted adware program designed to deliver various advertisements to the users' systems

File System Modifications

The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%CommonPrograms%\BearShare.lnk	700 bytes	MD5: 0xBC3A78B0E615B86DC13B042A295D8548 SHA-1: 0x5D96A8BAEFAAE5FF5B164D91E4834B57E2F9CB6C	(not available)
2	%DesktopDir%\BearShare.lnk	694 bytes	MD5: 0x5D9C60E1BBBA61A8D048B604723F70E0 SHA-1: 0x703D17D8AF5C9DE1BC1326D03E0902D67FC98676	(not available)
3	%Temp%\VVSNInst.exe	106,560 bytes	MD5: 0x3E9C72F5B57307229D75FD5B8891593D SHA-1: 0xA7B7B6E51994D12E019783AADD6FF50F9A69946E	Adware.WhenU_SaveNow [PCTools] Adware.Savenow [Symantec] not-a-virus:WebToolbar.Win32.WhenU.a [Kaspersky Lab] Adware-SaveNow [McAfee] Adware:Win32/WhenU.A [Microsoft] not-a-virus:AdWare.Win32.SaveNow.bo [Ikarus]
4	%ProgramFiles%\BearShare\BearShare.dat	8,815 bytes	MD5: 0x541CCA9781AD792BD7C0828B3FB1ABFF SHA-1: 0xFCBC5D2A661F313BB45C83815637023A9309BE9E	(not available)
5	%ProgramFiles%\BearShare\BearShare.exe	3,223,552 bytes	MD5: 0x3DCBA51CE22E0913A143DEBCCE1DB9F0 SHA-1: 0xEC004DAA22BD875EC97C7C4782DCD33F62BB8B5F	packed with Armadillo [Kaspersky Lab]
6	%ProgramFiles%\BearShare\BSidle.dll	24,576 bytes	MD5: 0x760911842FC80D9D54516BD5BA6931EF SHA-1: 0xA64410ECD2BAF150FD8D121707E0F910FCA6EAF9	(not available)
7	%ProgramFiles%\BearShare\db\connect.txt	108,501 bytes	MD5: 0x1CCA694A038B9D4904B2E8DD35F0B0C1 SHA-1: 0x41C2BA9512EBFF6DA5E69CDA44503DC78E00AA77	(not available)
8	%ProgramFiles%\BearShare\db\library.2.db	59,392 bytes	MD5: 0x41DC86078B49887EBC6E9A874161334F SHA-1: 0x8853FB451884BECEECE289FF78F04CE86AA2CED5	(not available)
9	%ProgramFiles%\BearShare\db\library.2.db.lastgoodload.bak	59,392 bytes	MD5: 0x753518A29DB9220C27C979866F36540D SHA-1: 0x872417D0D2874E6FE6F7E88B2AB85DF0E0542C76	(not available)
10	%ProgramFiles%\BearShare\db\library.db	59,392 bytes	MD5: 0x2148459F39B2AA25B53AE6A1DD618518 SHA-1: 0x15A00453D664B1A33E35528593912EB0084833E8	(not available)
11	%ProgramFiles%\BearShare\db\library.db.lastgoodload.bak	59,392 bytes	MD5: 0x69CC02B6FE418A13961C4DF9D3D072AC SHA-1: 0x38BAEC2CCFD95431D0DF63B62D2B9BBC005A6F59	(not available)
12	%ProgramFiles%\BearShare\FreePeers.ini	46,819 bytes	MD5: 0x9C7A94C749812AD2EB80EC9122E3757D SHA-1: 0xCADD04EB068B548ECA2A13E5C48FCC830D7DFEDD	(not available)
13	%ProgramFiles%\BearShare\History.txt	18,867 bytes	MD5: 0xC5A9BD4A437957A374D52B40EF7F155A SHA-1: 0xFB33C47E660D8C120763DED6625407DE42239F44	(not available)
14	%ProgramFiles%\BearShare\INSTALL.LOG	7,309 bytes	MD5: 0x587F15A057AB10EDA7BC70AEEF36C553 SHA-1: 0xE5976FB437056528900D47FB8E63230FDD660308	(not available)
15	%ProgramFiles%\BearShare\Logs\hosts-state.txt	13 bytes	MD5: 0x0729FCB0ABA010BE2C3B3E8042F650D2 SHA-1: 0x1097496C989149760A6A161BA642BEB6906BFA2B	(not available)
16	%ProgramFiles%\BearShare\Logs\memory.txt	11,960 bytes	MD5: 0x9AD9E1FABF67B41D18E68CA1DAFA1771 SHA-1: 0x6705C20E48B9616EF3CFCB370F097BD5E209A086	(not available)
17	%ProgramFiles%\BearShare\Logs\ordinal.txt	2,041 bytes	MD5: 0x9A3EDFA15234665793D3DBC5C6FCC794 SHA-1: 0x37D654CE7DF31E0D1869D9BDD0BB4C41649A8DEF	(not available)
18	%ProgramFiles%\BearShare\Logs\streams.txt	15 bytes	MD5: 0xE7364AB20091C0ECD7C12AB381C2CB28 SHA-1: 0xBDB2C67DA9440913D673C378E681A447E66205D8	(not available)
19	%ProgramFiles%\BearShare\RunMSC.dll	57,344 bytes	MD5: 0xB938EDABE9EFC9B024E79697E6C01FEA SHA-1: 0xFD5090E617EEA7AA80B99608828CE78F05A630A3	(not available)
20	%ProgramFiles%\BearShare\sounds\notify.wav	4,014 bytes	MD5: 0x4A61949290ADEBB4B096DE6655B24232 SHA-1: 0x4C8F681E6AD13FB800B3755F7B2025D18230DBB6	(not available)
21	%ProgramFiles%\BearShare\UNWISE.EXE	153,088 bytes	MD5: 0x973567B98CDFC147DF4E60471D9DF072 SHA-1: 0x3C4735750C99C63E6861170A8C459A608594211E	(not available)
22	%ProgramFiles%\BearShare\Webstats.bat	347 bytes	MD5: 0x3B1D35D193F6BA3F9E459530C3BFCD2B SHA-1: 0x6FA6866EB24F3D3AC1F5AF571A1716E85E140B0C	(not available)
23	%ProgramFiles%\BearShare\Webstats.exe	294,912 bytes	MD5: 0x3114E2732C4315B27F4BD31355DE547F SHA-1: 0x89AE915ABB094209909DB722CE641AFAE94767DB	(not available)
24	%ProgramFiles%\BearShare\Webstats.ini	3,159 bytes	MD5: 0x0C65B7A84781D5C016A04643D76A4F57 SHA-1: 0xD8624C2DE219C57F7E61DE84472FA1353DE37B60	(not available)
25	[file and pathname of the sample #1]	3,529,024 bytes	MD5: 0x36030A739D706ABCC388D818922048EF SHA-1: 0xC15B14C89F723ACAED8136A230B9E619FAF0ED83	Adware.Savenow [Symantec] not-a-virus:WebToolbar.Win32.WhenU.a [Kaspersky Lab] not-a-virus:AdWare.Win32.OneStep [Ikarus] packed with WiseSFXDropper [Kaspersky Lab]

Notes:

%CommonPrograms% is a variable that refers to the file system directory that contains the directories for the common program groups that appear on the Start menu for all users. A typical path is C:\Documents and Settings\All Users\Start Menu\Programs (Windows NT/2000/XP).
%DesktopDir% is a variable that refers to the file system directory used to physically store file objects on the desktop. A typical path is C:\Documents and Settings\[UserName]\Desktop.
%Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).
%ProgramFiles% is a variable that refers to the Program Files folder. A typical path is C:\Program Files.

The following directories were created:

%ProgramFiles%\BearShare
%ProgramFiles%\VVSN
c:\My Downloads
%ProgramFiles%\BearShare\db
%ProgramFiles%\BearShare\Extras
%ProgramFiles%\BearShare\Installer
%ProgramFiles%\BearShare\Logs
%ProgramFiles%\BearShare\Playlists
%ProgramFiles%\BearShare\sounds
%ProgramFiles%\BearShare\Temp
%ProgramFiles%\BearShare\Webstats

Memory Modifications

There were new processes created in the system:

Process Name	Process Filename	Main Module Size
BearShare.exe	%ProgramFiles%\bearshare\bearshare.exe	9,633,792 bytes
VVSNInst.exe	%Temp%\VVSNInst.exe	110,592 bytes
[filename of the sample #1]	[file and pathname of the sample #1]	3,538,944 bytes
GLB1.tmp	%Temp%\GLB1.tmp	28,672 bytes
VVSN.exe	%ProgramFiles%\VVSN\VVSN.exe	122,880 bytes

The following module was loaded into the address space of other process(es):

Module Name	Module Filename	Address Space Details
BSidle.dll	%ProgramFiles%\BearShare\BSidle.dll	Process name: BearShare.exe Process filename: %ProgramFiles%\bearshare\bearshare.exe Address space: 0x1CD0000 - 0x1CD6000

Registry Modifications

The following Registry Keys were created:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{558EC983-BEDB-9168-B2DE-31DBF0EE543E}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{558EC983-BEDB-9168-B2DE-31DBF0EE543E}\Control
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{558EC983-BEDB-9168-B2DE-31DBF0EE543E}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{558EC983-BEDB-9168-B2DE-31DBF0EE543E}\MiscStatus
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{558EC983-BEDB-9168-B2DE-31DBF0EE543E}\ProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{558EC983-BEDB-9168-B2DE-31DBF0EE543E}\Programmable
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{558EC983-BEDB-9168-B2DE-31DBF0EE543E}\ToolboxBitmap32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{558EC983-BEDB-9168-B2DE-31DBF0EE543E}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{558EC983-BEDB-9168-B2DE-31DBF0EE543E}\Version
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{558EC983-BEDB-9168-B2DE-31DBF0EE543E}\VersionIndependentProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9F95F736-0F62-4214-A4B4-CAA6738D4C07}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9F95F736-0F62-4214-A4B4-CAA6738D4C07}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9F95F736-0F62-4214-A4B4-CAA6738D4C07}\ProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9F95F736-0F62-4214-A4B4-CAA6738D4C07}\Programmable
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9F95F736-0F62-4214-A4B4-CAA6738D4C07}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9F95F736-0F62-4214-A4B4-CAA6738D4C07}\VersionIndependentProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C285D18D-43A2-4AEF-83FB-BF280E660A97}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C285D18D-43A2-4AEF-83FB-BF280E660A97}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C285D18D-43A2-4AEF-83FB-BF280E660A97}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C285D18D-43A2-4AEF-83FB-BF280E660A97}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{905D0DF2-3A0A-4D94-853C-54A12A745905}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{905D0DF2-3A0A-4D94-853C-54A12A745905}\1.0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{905D0DF2-3A0A-4D94-853C-54A12A745905}\1.0\0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{905D0DF2-3A0A-4D94-853C-54A12A745905}\1.0\0\win32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{905D0DF2-3A0A-4D94-853C-54A12A745905}\1.0\FLAGS
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{905D0DF2-3A0A-4D94-853C-54A12A745905}\1.0\HELPDIR
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.gnu
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ed2k
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ed2k\DefaultIcon
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ed2k\shell
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ed2k\shell\open
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ed2k\shell\open\command
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ed2k\shell\open\ddeexec
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ed2k\shell\open\ddeexec\Application
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ed2k\shell\open\ddeexec\Topic
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gnu
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gnu\DefaultIcon
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gnu\shell
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gnu\shell\open
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gnu\shell\open\command
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gnufile
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gnufile\shell
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gnufile\shell\open
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gnufile\shell\open\command
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gnutella
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gnutella\DefaultIcon
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gnutella\shell
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gnutella\shell\open
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gnutella\shell\open\command
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gnutella\shell\open\ddeexec
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gnutella\shell\open\ddeexec\Application
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gnutella\shell\open\ddeexec\Topic
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\magnet
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\magnet\DefaultIcon
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\magnet\shell
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\magnet\shell\open
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\magnet\shell\open\command
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\magnet\shell\open\ddeexec
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\magnet\shell\open\ddeexec\Application
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\magnet\shell\open\ddeexec\Topic
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RunMSC.Loader
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RunMSC.Loader\CLSID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RunMSC.Loader\CurVer
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RunMSC.Loader.1
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RunMSC.Loader.1\CLSID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5F95E1AF-2620-4f15-BDF9-7FDCE4607E17}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BearShare
HKEY_LOCAL_MACHINE\SOFTWARE\BearShare
HKEY_LOCAL_MACHINE\SOFTWARE\Licenses
HKEY_LOCAL_MACHINE\SOFTWARE\Magnet
HKEY_LOCAL_MACHINE\SOFTWARE\Magnet\Handlers
HKEY_LOCAL_MACHINE\SOFTWARE\Magnet\Handlers\Bearshare
HKEY_LOCAL_MACHINE\SOFTWARE\Magnet\Handlers\Bearshare\Type
HKEY_USERS\.DEFAULT\AppEvents\EventLabels\BearShareChatNotifyMsg
HKEY_USERS\.DEFAULT\AppEvents\Schemes\Apps\BearShare
HKEY_USERS\.DEFAULT\AppEvents\Schemes\Apps\BearShare\BearShareChatNotifyMsg
HKEY_USERS\.DEFAULT\AppEvents\Schemes\Apps\BearShare\BearShareChatNotifyMsg\.Current
HKEY_CURRENT_USER\AppEvents\EventLabels\BearShareChatNotifyMsg
HKEY_CURRENT_USER\AppEvents\Schemes\Apps\BearShare
HKEY_CURRENT_USER\AppEvents\Schemes\Apps\BearShare\BearShareChatNotifyMsg
HKEY_CURRENT_USER\AppEvents\Schemes\Apps\BearShare\BearShareChatNotifyMsg\.Current

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{558EC983-BEDB-9168-B2DE-31DBF0EE543E}\VersionIndependentProgID]

(Default) = "ListPad.ListPad"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{558EC983-BEDB-9168-B2DE-31DBF0EE543E}\Version]

(Default) = "1.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{558EC983-BEDB-9168-B2DE-31DBF0EE543E}\TypeLib]

(Default) = "{3F81A848-2D52-E993-4B25-608905EE9D5A}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{558EC983-BEDB-9168-B2DE-31DBF0EE543E}\ToolboxBitmap32]

(Default) = "cic.dll, 1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{558EC983-BEDB-9168-B2DE-31DBF0EE543E}\Programmable]

(Default) = ""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{558EC983-BEDB-9168-B2DE-31DBF0EE543E}\ProgID]

(Default) = "ListPad.ListPad.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{558EC983-BEDB-9168-B2DE-31DBF0EE543E}\MiscStatus]

(Default) = "0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{558EC983-BEDB-9168-B2DE-31DBF0EE543E}\InprocServer32]

(Default) = "%System%\cic.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{558EC983-BEDB-9168-B2DE-31DBF0EE543E}\Control]

(Default) = ""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{558EC983-BEDB-9168-B2DE-31DBF0EE543E}]

(Default) = "Xehebome.Garilqeta.Tocoreji Class"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9F95F736-0F62-4214-A4B4-CAA6738D4C07}\VersionIndependentProgID]

(Default) = "RunMSC.Loader"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9F95F736-0F62-4214-A4B4-CAA6738D4C07}\TypeLib]

(Default) = "{905D0DF2-3A0A-4D94-853C-54A12A745905}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9F95F736-0F62-4214-A4B4-CAA6738D4C07}\ProgID]

(Default) = "RunMSC.Loader.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9F95F736-0F62-4214-A4B4-CAA6738D4C07}\InprocServer32]

(Default) = "%ProgramFiles%\BearShare\RunMSC.dll"
ThreadingModel = "Apartment"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9F95F736-0F62-4214-A4B4-CAA6738D4C07}]

(Default) = "Loader Class"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C285D18D-43A2-4AEF-83FB-BF280E660A97}\TypeLib]

(Default) = "{905D0DF2-3A0A-4D94-853C-54A12A745905}"
Version = "1.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C285D18D-43A2-4AEF-83FB-BF280E660A97}\ProxyStubClsid32]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C285D18D-43A2-4AEF-83FB-BF280E660A97}\ProxyStubClsid]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C285D18D-43A2-4AEF-83FB-BF280E660A97}]

(Default) = "ILoader"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{905D0DF2-3A0A-4D94-853C-54A12A745905}\1.0\0\win32]

(Default) = "%ProgramFiles%\BearShare\RunMSC.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{905D0DF2-3A0A-4D94-853C-54A12A745905}\1.0\HELPDIR]

(Default) = "%ProgramFiles%\BearShare\"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{905D0DF2-3A0A-4D94-853C-54A12A745905}\1.0\FLAGS]

(Default) = "0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{905D0DF2-3A0A-4D94-853C-54A12A745905}\1.0]

(Default) = "RunMSC 1.0 Type Library"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.gnu]

(Default) = "gnufile"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ed2k\shell\open\ddeexec\Topic]

(Default) = "URLHandler"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ed2k\shell\open\ddeexec\Application]

(Default) = "BearShare"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ed2k\shell\open\ddeexec]

(Default) = "%1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ed2k\shell\open\command]

(Default) = ""%ProgramFiles%\BearShare\BearShare.exe" -noinstcheck -spawnedfromurl %1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ed2k\DefaultIcon]

(Default) = ""%ProgramFiles%\BearShare\BearShare.exe",-130"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ed2k]

URL Protocol = ""
(Default) = "URL:ed2k Protocol"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gnu\shell\open\command]

(Default) = ""%ProgramFiles%\BearShare\BearShare.exe" --noinstcheck -spawnedfromurl %1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gnu\DefaultIcon]

(Default) = ""%ProgramFiles%\BearShare\BearShare.exe",-130"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gnu]

URL Protocol = ""
(Default) = "URL:GNU Protocol"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gnufile\shell\open\command]

(Default) = ""%ProgramFiles%\BearShare\BearShare.exe" "%1""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gnufile]

(Default) = "gnutella"
BrowserFlags = 0x00000008
EditFlags = 0x00010000

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gnutella\shell\open\ddeexec\Topic]

(Default) = "URLHandler"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gnutella\shell\open\ddeexec\Application]

(Default) = "BearShare"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gnutella\shell\open\ddeexec]

(Default) = "%1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gnutella\shell\open\command]

(Default) = ""%ProgramFiles%\BearShare\BearShare.exe" -noinstcheck -spawnedfromurl %1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gnutella\DefaultIcon]

(Default) = ""%ProgramFiles%\BearShare\BearShare.exe",-130"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gnutella]

URL Protocol = ""
(Default) = "URL:Gnutella Protocol"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\magnet\shell\open\ddeexec\Topic]

(Default) = "URLHandler"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\magnet\shell\open\ddeexec\Application]

(Default) = "BearShare"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\magnet\shell\open\ddeexec]

(Default) = "%1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\magnet\shell\open\command]

(Default) = ""%ProgramFiles%\BearShare\BearShare.exe" -noinstcheck -spawnedfromurl %1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\magnet\DefaultIcon]

(Default) = ""%ProgramFiles%\BearShare\BearShare.exe",-130"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\magnet]

URL Protocol = ""
(Default) = "URL:Magnet Protocol"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RunMSC.Loader\CurVer]

(Default) = "RunMSC.Loader.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RunMSC.Loader\CLSID]

(Default) = "{9F95F736-0F62-4214-A4B4-CAA6738D4C07}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RunMSC.Loader]

(Default) = "Loader Class"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RunMSC.Loader.1\CLSID]

(Default) = "{9F95F736-0F62-4214-A4B4-CAA6738D4C07}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RunMSC.Loader.1]

(Default) = "Loader Class"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5F95E1AF-2620-4f15-BDF9-7FDCE4607E17}]

(Default) = "BearShare"
Version = "5,2,2,2"
ComponentID = "BearShare"
IsInstalled = 0x00000001
Locale = "EN"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

BearShare = ""%ProgramFiles%\BearShare\BearShare.exe" /pause"

so that BearShare.exe runs every time Windows starts

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BearShare]

DisplayName = "BearShare"
UninstallString = "C:\PROGRA~1\BEARSH~1\UNWISE.EXE C:\PROGRA~1\BEARSH~1\INSTALL.LOG"
DisplayVersion = "5.2.2.2"
HelpLink = "http://bearshare.com/help.htm"
Publisher = "Free Peers, Inc."
URLInfoAbout = "http://www.freepeers.com"
DisplayIcon = "%ProgramFiles%\BearShare\BearShare.exe,-128"

[HKEY_LOCAL_MACHINE\SOFTWARE\BearShare]

InstallDir = "%ProgramFiles%\BearShare"

[HKEY_LOCAL_MACHINE\SOFTWARE\Licenses]

{R7C0DB872A3F777C0} = 4A 8D 7D 4C
{K7C0DB872A3F777C0} = B6 E7 98 78 FB 0D 1F FF FF FF FF 69 EB 67 03 03 07 99 01 65 14 0F C8 1F F3 29 FB 4A 8D 7D 4C FF FF FF FF 87 30 0C C3 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF F

[HKEY_LOCAL_MACHINE\SOFTWARE\Magnet\Handlers\Bearshare\Type]

urn:sha1 = 0x00000000
urn:bitprint = 0x00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Magnet\Handlers\Bearshare]

(Default) = "Bearshare"
Description = "Bearshare can automatically search for and download the selected content on its peer-to-peer network."
DefaultIcon = ""%ProgramFiles%\BearShare\BearShare.exe",-130"
ShellExecute = ""%ProgramFiles%\BearShare\BearShare.exe" -noinstcheck -spawnedfromurl %1"
DdeApplication = "BearShare"
DdeTopic = "URLHandler"

[HKEY_USERS\.DEFAULT\AppEvents\EventLabels\BearShareChatNotifyMsg]

(Default) = "Chat Message Waiting"

[HKEY_USERS\.DEFAULT\AppEvents\Schemes\Apps\BearShare\BearShareChatNotifyMsg\.Current]

(Default) = "%ProgramFiles%\BearShare\sounds\notify.wav"

[HKEY_USERS\.DEFAULT\AppEvents\Schemes\Apps\BearShare\BearShareChatNotifyMsg]

(Default) = ""

[HKEY_USERS\.DEFAULT\AppEvents\Schemes\Apps\BearShare]

(Default) = "BearShare"

[HKEY_CURRENT_USER\AppEvents\EventLabels\BearShareChatNotifyMsg]

(Default) = "Chat Message Waiting"

[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\BearShare\BearShareChatNotifyMsg\.Current]

(Default) = "%ProgramFiles%\BearShare\sounds\notify.wav"

[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\BearShare\BearShareChatNotifyMsg]

(Default) = ""

[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\BearShare]

(Default) = "BearShare"

Other details

To mark the presence in the system, the following Mutex objects were created:

DBWinMutex
RAL1A8B7953
1A8B7953::WK
FreePeers_BearShare
c:
WhenU_VVSN_1_0_SharedMutex

The following ports were open in the system:

Port	Protocol	Process
1025	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1026	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1027	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1028	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1029	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1030	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1031	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1033	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1034	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1035	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1036	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1037	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1038	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1039	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1040	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1041	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1042	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1043	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1044	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1046	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1047	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1048	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1049	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1050	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1051	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1052	TCP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1052	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1053	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1054	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1055	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1056	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1057	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1058	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1059	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1060	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1061	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1062	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1063	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1064	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1065	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1066	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1067	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1068	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1069	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1070	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1071	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1072	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1073	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1074	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1075	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1076	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1077	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1078	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1079	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1080	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1081	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1082	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1083	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1084	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1085	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1086	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1087	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1088	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1089	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1090	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1091	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1092	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1093	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1094	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1095	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1096	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1097	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1098	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1099	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1100	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1101	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1102	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1103	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1104	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1105	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1106	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1107	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1108	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1109	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1110	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1111	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1112	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1113	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1114	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1115	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1116	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1117	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1118	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1119	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1120	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1121	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1122	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1123	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1124	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1125	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)

The following Host Names were requested from a host database:

track.bearshare.com
24.165.49.128
privateport1.bearshare.net
gwebcache.bearshare.net
www.softgap.com
loot.alumnigroup.org
gwc.nonexiste.net
gwc1.mager.org
private1.bearshare.net

There were registered attempts to establish connection with the remote hosts. The connection details are:

Remote Host	Port Number
204.14.60.129	6346
62.107.126.156	6346
84.60.164.221	6346
220.239.106.250	6346
145.97.212.178	6346
217.75.50.112	6346
81.66.190.53	6346
172.163.255.214	6346
84.57.77.130	6346
142.167.211.60	6346
80.137.233.182	6348
84.24.1.171	6348
84.41.6.169	6348
69.221.141.164	6348
68.2.129.79	6348
68.49.157.208	6348
84.173.85.162	6348
81.79.39.29	6348
206.116.183.207	6348
65.43.149.191	6348
69.171.136.43	6544
private1.bearshare.net	1034

The following Internet Connections were established:

Server Name	Server Port	Connect as User	Connection Password
www.bearshare.com	80	(null)	(null)
app.whenu.com	80	(null)	(null)
spweb.whenu.com	80	(null)	(null)

The following GET requests were made:

AppInstall?app=VVSN&url=EEPE120501&id=9F5EB25F498B48A5A32027A948DA7668&ui=JH
vvsn/EEPE120501/vsn.cfg
AppInstall?app=VVSN_CFG&url=EEPE120501&id=9F5EB25F498B48A5A32027A948DA7668&ui=QF

The following HTTP URLs were started reading:

http://gwebcache.bearshare.net/gcache.php?client=BEAR&version=5.2.2.2&urlfile=1
http://www.softgap.com/ares/gcache.php?client=BEAR&version=5.2.2.2&urlfile=1
http://loot.alumnigroup.org/?client=BEAR&version=5.2.2.2&urlfile=1
http://www.whenudownloads.com/vvsn/prod/SAVEInst.exe

The data identified by the following URL was then requested from the remote web server:

http://track.bearshare.com/BS522.htm

Outbound traffic (potentially malicious)

There was an outbound traffic produced on port 6346:

There was an outbound traffic produced on port 6348:

There was an outbound traffic produced on port 6544:

There was an outbound traffic produced on port 6356:

00000000 | 474E 5554 454C 4C41 2043 4F4E 4E45 4354 | GNUTELLA CONNECT
00000010 | 2F30 2E36 0D0A 5573 6572 2D41 6765 6E74 | /0.6..User-Agent
00000020 | 3A20 4265 6172 5368 6172 6520 352E 322E | : BearShare 5.2.
00000030 | 322E 320D 0A41 6363 6570 742D 456E 636F | 2.2..Accept-Enco
00000040 | 6469 6E67 3A20 6465 666C 6174 650D 0A58 | ding: deflate..X
00000050 | 2D52 6571 7565 7269 6573 3A20 6661 6C73 | -Requeries: fals
00000060 | 650D 0A56 656E 646F 722D 4D65 7373 6167 | e..Vendor-Messag
00000070 | 653A 2030 2E31 0D0A 582D 556C 7472 6170 | e: 0.1..X-Ultrap
00000080 | 6565 723A 2046 616C 7365 0D0A 582D 5175 | eer: False..X-Qu
00000090 | 6572 792D 526F 7574 696E 673A 2030 2E31 | ery-Routing: 0.1
000000A0 | 0D0A 4D61 6368 696E 653A 2031 2C31 332C | ..Machine: 1,13,
000000B0 | 3235 352C 312C 3331 3932 0D0A 506F 6E67 | 255,1,3192..Pong
000000C0 | 2D43 6163 6869 6E67 3A20 302E 310D 0A4C | -Caching: 0.1..L
000000D0 | 6973 7465 6E2D 4950 3A20 302E 302E 302E | isten-IP: 0.0.0.
000000E0 | 303A 3633 3438 0D0A 5265 6D6F 7465 2D49 | 0:6348..Remote-I
000000F0 | 503A 2032 3137 2E32 3130 2E31 3833 2E32 | P: 217.210.183.2
00000100 | 3339 0D0A 4747 4550 3A20 302E 350D 0A58 | 39..GGEP: 0.5..X
00000110 | 2D44 6567 7265 653A 2032 360D 0A58 2D55 | -Degree: 26..X-U
00000120 | 6C74 7261 7065 6572 2D51 7565 7279 2D52 | ltrapeer-Query-R
00000130 | 6F75 7469 6E67 3A20 302E 310D 0A58 2D4D | outing: 0.1..X-M
00000140 | 6178 2D54 544C 3A20 340D 0A58 2D44 796E | ax-TTL: 4..X-Dyn
00000150 | 616D 6963 2D51 7565 7279 696E 673A 2030 | amic-Querying: 0
00000160 | 2E31 0D0A 582D 5072 6F62 652D 5175 6572 | .1..X-Probe-Quer
00000170 | 6965 733A 2030 2E31 0D0A 4650 2D31 613A | ies: 0.1..FP-1a:
00000180 | 2031 3238 2C44 96B9 44A9 27BB D1B2 B4EB |  128,D..D.'.....
00000190 | F64D 462B E8EA E834 47F5 27D9 B593 A685 | .MF+...4G.'.....
000001A0 | 3E7D C77A E821 640D 0A46 502D 4175 7468 | >}.z.!d..FP-Auth
000001B0 | 2D43 6861 6C6C 656E 6765 3A20 4935 5147 | -Challenge: I5QG
000001C0 | 4246 5342 5149 3255 5155 334B 4956 5951 | BFSBQI2UQU3KIVYQ
000001D0 | 514A 324E 5742 3754 5937 344E 0D0A 0D0A | QJ2NWB7TY74N....

There was an outbound traffic produced on port 7100:

There was an outbound traffic produced on port 6117:

There was an outbound traffic produced on port 39587:

There was an outbound traffic produced on port 600:

00000000 | 474E 5554 454C 4C41 2043 4F4E 4E45 4354 | GNUTELLA CONNECT
00000010 | 2F30 2E36 0D0A 5573 6572 2D41 6765 6E74 | /0.6..User-Agent
00000020 | 3A20 4265 6172 5368 6172 6520 352E 322E | : BearShare 5.2.
00000030 | 322E 320D 0A41 6363 6570 742D 456E 636F | 2.2..Accept-Enco
00000040 | 6469 6E67 3A20 6465 666C 6174 650D 0A58 | ding: deflate..X
00000050 | 2D52 6571 7565 7269 6573 3A20 6661 6C73 | -Requeries: fals
00000060 | 650D 0A56 656E 646F 722D 4D65 7373 6167 | e..Vendor-Messag
00000070 | 653A 2030 2E31 0D0A 582D 556C 7472 6170 | e: 0.1..X-Ultrap
00000080 | 6565 723A 2046 616C 7365 0D0A 582D 5175 | eer: False..X-Qu
00000090 | 6572 792D 526F 7574 696E 673A 2030 2E31 | ery-Routing: 0.1
000000A0 | 0D0A 4D61 6368 696E 653A 2031 2C31 332C | ..Machine: 1,13,
000000B0 | 3235 352C 312C 3331 3932 0D0A 506F 6E67 | 255,1,3192..Pong
000000C0 | 2D43 6163 6869 6E67 3A20 302E 310D 0A4C | -Caching: 0.1..L
000000D0 | 6973 7465 6E2D 4950 3A20 302E 302E 302E | isten-IP: 0.0.0.
000000E0 | 303A 3633 3438 0D0A 5265 6D6F 7465 2D49 | 0:6348..Remote-I
000000F0 | 503A 2038 372E 3132 332E 3134 322E 3533 | P: 87.123.142.53
00000100 | 0D0A 4747 4550 3A20 302E 350D 0A58 2D44 | ..GGEP: 0.5..X-D
00000110 | 6567 7265 653A 2032 360D 0A58 2D55 6C74 | egree: 26..X-Ult
00000120 | 7261 7065 6572 2D51 7565 7279 2D52 6F75 | rapeer-Query-Rou
00000130 | 7469 6E67 3A20 302E 310D 0A58 2D4D 6178 | ting: 0.1..X-Max
00000140 | 2D54 544C 3A20 340D 0A58 2D44 796E 616D | -TTL: 4..X-Dynam
00000150 | 6963 2D51 7565 7279 696E 673A 2030 2E31 | ic-Querying: 0.1
00000160 | 0D0A 582D 5072 6F62 652D 5175 6572 6965 | ..X-Probe-Querie
00000170 | 733A 2030 2E31 0D0A 4650 2D31 613A 2031 | s: 0.1..FP-1a: 1
00000180 | 3238 2C80 B6DD 98F3 99C9 F53B 9EF4 CAFA | 28,........;....
00000190 | F658 CF26 F97D 51AB ADBB FAC0 6644 3050 | .X.&.}Q.....fD0P
000001A0 | 369F 6021 580D 0A46 502D 4175 7468 2D43 | 6.`!X..FP-Auth-C
000001B0 | 6861 6C6C 656E 6765 3A20 3345 5A44 544B | hallenge: 3EZDTK
000001C0 | 5651 4634 5135 5544 505A 3347 4A55 5650 | VQF4Q5UDPZ3GJUVP
000001D0 | 3244 3251 4455 504B 5A4B 0D0A 0D0A      | 2D2QDUPKZK....

There was an outbound traffic produced on port 6000:

There was an outbound traffic produced on port 9411:

Downloaded File Summary:

Download details:

Download retrieved: 5 January 2009 15:48:38
Processing time: 6 min 33 sec
Downloaded sample:

File MD5: 0x57CD9489DA9FEF8A95B037F444A405C5
File SHA-1: 0x7B930E353649FB526C4C5C458680BFAEF569E7CA
Filesize: 849,784 bytes
Alias:

Adware.WhenU.AQ [PCTools]
Adware.Savenow [Symantec]
not-a-virus:WebToolbar.Win32.WhenU.a [Kaspersky Lab]
Adware-SaveNow [McAfee]

Summary of the findings:

What's been found	Severity Level
Downloads/requests other files from Internet.
Creates a startup registry entry.
Registers a 32-bit in-process server DLL.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

Attention! Characteristics of the following security risks were identified in the system:

Security Risk	Description
Adware.WhenU_SaveNow	SaveNow shows targeted pop-up advertisements and coupons based on user's Internet surfing habits. It is usually distributed with other third party software such as BearShare.
Adware.VB	Adware.VB is a generic detection for adware programs compiled in Visual Basic. It displays popup advertisements and may download other adware and spyware without the users knowledge.
Adware.Component.WhenU	Common Components shared between WhenU products like ClockSync, SaveNow, SideFinder and WeatherCast.

Attention! The following threat category was identified:

Threat Category	Description
	A potentially unwanted adware program designed to deliver various advertisements to the users' systems

File System Modifications

The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%Programs%\WhenU\Customer Support.lnk	1,496 bytes	MD5: 0x89016BBC9F94F9F5F4666A382C99447F SHA-1: 0x313C753BBDECC40E573C33BC7F2F78D5D7A1A8BC	(not available)
2	%Programs%\WhenU\Learn More About WhenU Save.url	94 bytes	MD5: 0x9272494A28895BEB559602EC18CDEC8C SHA-1: 0x45338468237DE5D096567649C120CBFF0AE70E70	(not available)
3	%Programs%\WhenU\Learn More About WhenU SaveNow.url	97 bytes	MD5: 0xBB86ED25BD98F9103C785491EC92422F SHA-1: 0x89617653EFE59911C6494BD749C8D5E3DA30B68B	(not available)
4	%Programs%\WhenU\Uninstall Instructions.lnk	1,496 bytes	MD5: 0xB6DF3338EE0526B55E6EE7D1698856BD SHA-1: 0x8FA380776341BF7E963CCE138E567194AC7DB1EC	(not available)
5	%Programs%\WhenU\WhenU.com Website.url	76 bytes	MD5: 0xBD1DC7BD301B57EF0E77242CF2557996 SHA-1: 0x1DB489117321E7D6FBB3A7473D2FF1E81278DB71	(not available)
6	%ProgramFiles%\Save\ACM.dll	516,472 bytes	MD5: 0xAD616A7E4A5306582E0F7363E36E0E75 SHA-1: 0x33C78E3161F1D59AA14005D058844138B6B71913	Adware.WhenU_SaveNow [PCTools] Adware.Savenow [Symantec] not-a-virus:AdTool.Win32.WhenU.i [Kaspersky Lab] Adware-SaveNow [McAfee] Adware:Win32/WhenU.A [Microsoft] not-a-virus:AdTool.Win32.WhenU.i [Ikarus]
7	%ProgramFiles%\Save\ffext.mod	12,814 bytes	MD5: 0x501D4C0B7D3C5449210007EC658C47ED SHA-1: 0x1201DB4A4DABEA7DFDE53AC2107CD00074274167	Adware.WhenU_SaveNow [PCTools] Adware.Savenow [Symantec] not-a-virus:WebToolbar.Win32.WhenU.z [Kaspersky Lab] AdWare.Win32.WhenU [Ikarus]
8	%ProgramFiles%\Save\Save.exe	803,184 bytes	MD5: 0x47754BF98FD5A4BC05C3B08221D6426A SHA-1: 0xC533F42FCA267458C489077B8DDC12F1A64526FD	Adware.WhenU_SaveNow [PCTools] Adware.Savenow [Symantec] not-a-virus:WebToolbar.Win32.WhenU.y [Kaspersky Lab] Adware-SaveNow [McAfee] Adware:Win32/WhenU.A [Microsoft] not-a-virus:AdTool.Win32.WhenU.i [Ikarus]
9	%ProgramFiles%\Save\save.htm	135,229 bytes	MD5: 0x64A8BEC37176AC27F4F5781139C9D744 SHA-1: 0xE01493BB480EDDE0D563D9F9C76886BC8D9EE186	HTML.Pestblock [Ikarus]
10	%ProgramFiles%\Save\SaveUninst.exe	118,200 bytes	MD5: 0x7AADCB4EB4B8EBDA8BE77548754427DA SHA-1: 0xC5610CD5AC119E395E843FE1C0893ACD1141EBE1	Adware.Savenow [Symantec] Adware-SaveNow [McAfee] Adware:Win32/WhenU.A [Microsoft] Virus.Win32.Trojan [Ikarus]
11	[file and pathname of the sample #1]	849,784 bytes	MD5: 0x57CD9489DA9FEF8A95B037F444A405C5 SHA-1: 0x7B930E353649FB526C4C5C458680BFAEF569E7CA	Adware.WhenU.AQ [PCTools] Adware.Savenow [Symantec] not-a-virus:WebToolbar.Win32.WhenU.a [Kaspersky Lab] Adware-SaveNow [McAfee]

Notes:

%Programs% is a variable that refers to the file system directory that contains the user's program groups. A typical path is C:\Documents and Settings\[UserName]\Start Menu\Programs.
%ProgramFiles% is a variable that refers to the Program Files folder. A typical path is C:\Program Files.

The following directories were created:

%Programs%\WhenU
%ProgramFiles%\Save

Memory Modifications

There were new processes created in the system:

Process Name	Process Filename	Main Module Size
Save.exe	%ProgramFiles%\Save\Save.exe	827,392 bytes
[filename of the sample #1]	[file and pathname of the sample #1]	860,160 bytes

Registry Modifications

The following Registry Keys were created:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\ACM.DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{127DF9B4-D75D-44A6-AF78-8C3A8CEB03DB}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A9AAE1AB-9688-42C5-86F5-C12F6B9015AD}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A9AAE1AB-9688-42C5-86F5-C12F6B9015AD}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A9AAE1AB-9688-42C5-86F5-C12F6B9015AD}\ProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A9AAE1AB-9688-42C5-86F5-C12F6B9015AD}\Programmable
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A9AAE1AB-9688-42C5-86F5-C12F6B9015AD}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A9AAE1AB-9688-42C5-86F5-C12F6B9015AD}\VersionIndependentProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{43382522-A846-46F4-AC57-1F71AE6E1086}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{43382522-A846-46F4-AC57-1F71AE6E1086}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{43382522-A846-46F4-AC57-1F71AE6E1086}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{43382522-A846-46F4-AC57-1F71AE6E1086}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{572FB162-C0BA-4EDF-8CFF-E3846153B9B0}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{572FB162-C0BA-4EDF-8CFF-E3846153B9B0}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{572FB162-C0BA-4EDF-8CFF-E3846153B9B0}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{572FB162-C0BA-4EDF-8CFF-E3846153B9B0}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{72A836D1-BC00-43C0-A941-17960E4FB842}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{72A836D1-BC00-43C0-A941-17960E4FB842}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{72A836D1-BC00-43C0-A941-17960E4FB842}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{72A836D1-BC00-43C0-A941-17960E4FB842}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{DF901432-1B9F-4F5B-9E56-301C553F9095}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{DF901432-1B9F-4F5B-9E56-301C553F9095}\1.0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{DF901432-1B9F-4F5B-9E56-301C553F9095}\1.0\0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{DF901432-1B9F-4F5B-9E56-301C553F9095}\1.0\0\win32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{DF901432-1B9F-4F5B-9E56-301C553F9095}\1.0\FLAGS
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{DF901432-1B9F-4F5B-9E56-301C553F9095}\1.0\HELPDIR
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ACM.ACMFactory
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ACM.ACMFactory\CLSID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ACM.ACMFactory\CurVer
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ACM.ACMFactory.1
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ACM.ACMFactory.1\CLSID
HKEY_LOCAL_MACHINE\SOFTWARE\WhenUSave

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\ACM.DLL]

AppID = "{127DF9B4-D75D-44A6-AF78-8C3A8CEB03DB}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{127DF9B4-D75D-44A6-AF78-8C3A8CEB03DB}]

(Default) = "ACM"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A9AAE1AB-9688-42C5-86F5-C12F6B9015AD}\VersionIndependentProgID]

(Default) = "ACM.ACMFactory"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A9AAE1AB-9688-42C5-86F5-C12F6B9015AD}\TypeLib]

(Default) = "{DF901432-1B9F-4F5B-9E56-301C553F9095}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A9AAE1AB-9688-42C5-86F5-C12F6B9015AD}\ProgID]

(Default) = "ACM.ACMFactory.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A9AAE1AB-9688-42C5-86F5-C12F6B9015AD}\InprocServer32]

(Default) = "%ProgramFiles%\Save\ACM.dll"
ThreadingModel = "Apartment"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A9AAE1AB-9688-42C5-86F5-C12F6B9015AD}]

(Default) = "ACMFactory Class"
AppID = "{127DF9B4-D75D-44A6-AF78-8C3A8CEB03DB}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{43382522-A846-46F4-AC57-1F71AE6E1086}\TypeLib]

(Default) = "{DF901432-1B9F-4F5B-9E56-301C553F9095}"
Version = "1.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{43382522-A846-46F4-AC57-1F71AE6E1086}\ProxyStubClsid32]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{43382522-A846-46F4-AC57-1F71AE6E1086}\ProxyStubClsid]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{43382522-A846-46F4-AC57-1F71AE6E1086}]

(Default) = "IFetchExtractor"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{572FB162-C0BA-4EDF-8CFF-E3846153B9B0}\TypeLib]

(Default) = "{DF901432-1B9F-4F5B-9E56-301C553F9095}"
Version = "1.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{572FB162-C0BA-4EDF-8CFF-E3846153B9B0}\ProxyStubClsid32]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{572FB162-C0BA-4EDF-8CFF-E3846153B9B0}\ProxyStubClsid]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{572FB162-C0BA-4EDF-8CFF-E3846153B9B0}]

(Default) = "IACMFactory"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{72A836D1-BC00-43C0-A941-17960E4FB842}\TypeLib]

(Default) = "{DF901432-1B9F-4F5B-9E56-301C553F9095}"
Version = "1.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{72A836D1-BC00-43C0-A941-17960E4FB842}\ProxyStubClsid32]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{72A836D1-BC00-43C0-A941-17960E4FB842}\ProxyStubClsid]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{72A836D1-BC00-43C0-A941-17960E4FB842}]

(Default) = "IFetchData"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{DF901432-1B9F-4F5B-9E56-301C553F9095}\1.0\0\win32]

(Default) = "%ProgramFiles%\Save\ACM.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{DF901432-1B9F-4F5B-9E56-301C553F9095}\1.0\HELPDIR]

(Default) = "%ProgramFiles%\Save\"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{DF901432-1B9F-4F5B-9E56-301C553F9095}\1.0\FLAGS]

(Default) = "0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{DF901432-1B9F-4F5B-9E56-301C553F9095}\1.0]

(Default) = "ACM 1.0 Type Library"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ACM.ACMFactory\CurVer]

(Default) = "ACM.ACMFactory.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ACM.ACMFactory\CLSID]

(Default) = "{A9AAE1AB-9688-42C5-86F5-C12F6B9015AD}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ACM.ACMFactory]

(Default) = "ACMFactory Class"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ACM.ACMFactory.1\CLSID]

(Default) = "{A9AAE1AB-9688-42C5-86F5-C12F6B9015AD}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ACM.ACMFactory.1]

(Default) = "ACMFactory Class"

[HKEY_LOCAL_MACHINE\SOFTWARE\WhenUSave]

db_script_update = "1002700877"
InstallDir = "%ProgramFiles%\Save"
pats_url = "http://akapp.whenu.com/OffersDataGZ"
pat_chunks_url = "http://akapp.whenu.com/DataChunksGZ"
script_url = "http://akweb.whenu.com/offscript2.html"
update_url = "http://akdwl.whenu.com/saveupdate.exe"
ver_url = "http://www.whenu.com/versions.html"
Version = "4.22"
timedDBUpdate_rs = "Y"
SystemParam_rs = "dt=WhenU Save;q=;i=1"
uninst_rs = "4.2202"
extra_url = "http://www.whenudownloads.com/extra.exe"
extraver_url = "http://www.whenudownloads.com/extraver.html"
ziptomsa_url = "http://akapp.whenu.com/ziptomsa"
InstallTime = "20081019184426"
LastPartner = ""
SetupCmdLine = "http://web.whenu.com/Offers?iou=i&clp=&pip=0"
zip = ""
acm_rs = "1.05"
TotalPartner = "0"
newuser_rs = "Y"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

WhenUSave = ""%ProgramFiles%\Save\Save.exe""

so that Save.exe runs every time Windows starts

Other details

To mark the presence in the system, the following Mutex object was created:

WhenU_WhenUSave_SharedMutex

The following Internet Connection was established:

Server Name	Server Port	Connect as User	Connection Password
offers.whenu.com	80	(null)	(null)

The following GET requests were made:

installed.html?app=whenusave&ptr=&pds=&toi=20081019184426
index.jpg

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.

The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.