Submission Summary:

• Submission details:
• Submission received: 17 January 2008, 10:31:15
• Processing time: 3 min 42 sec
• Submitted sample:
• File MD5: 0x37D76C4B06CEE773272B87784EFFFA31
• Filesize: 103,956 bytes
• Alias:
• Trojan-Downloader.OnlineGames [PCTools]
• Worm.Win32.AutoRun.bnq [Kaspersky Lab]
• PWS-OnlineGames.a [McAfee]
• WORM_ONLINEG.YE [Trend Micro]

• Summary of the findings:

What's been found	Severity Level
Downloads/requests other files from Internet.
Modifies some system settings that may have negative impact on overall system security state.
Creates a startup registry entry.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! Characteristics of the following security risks were identified in the system:

Security Risk	Description
Trojan-Downloader.OnlineGames	Trojan.Downloader.OnlineGames downloads other malware which steals password information for online games.
Trojan-PWS.Onlinegames.BS	Trojan.PWS.Onlinegames.BS is a Trojan that will start itself automatically and steal passwords of onlinegames on the infected machines.

• Attention! The following threat categories were identified:

Threat Category	Description
	A program that downloads files to the local computer that may represent security risk
	A network-aware worm that attempts to replicate across the existing network(s)

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	c:\autorun.inf	319 bytes	MD5: 0x3F11F1940C6E520CB0C67AE0A76660DA	Worm.Win32.AutoRun.bnq [Kaspersky Lab]
2	%Temp%\rkd.dll	31,147 bytes	MD5: 0x4C46414742AAC7E8E62B536E6663EA71	Trojan-Downloader.OnlineGames [PCTools] Worm.Win32.AutoRun.bnq [Kaspersky Lab]
3	c:\u.bat %System%\amvo.exe [file and pathname of the sample #1]	103,956 bytes	MD5: 0x37D76C4B06CEE773272B87784EFFFA31	Trojan-Downloader.OnlineGames [PCTools] Worm.Win32.AutoRun.bnq [Kaspersky Lab] PWS-OnlineGames.a [McAfee] WORM_ONLINEG.YE [Trend Micro]
4	%System%\amvo0.dll	54,784 bytes	MD5: 0x7F273E33185C818C0BF8A7C1A887E596	Worm.Win32.AutoRun.bnq [Kaspersky Lab] PWS-OnlineGames.a [McAfee] WORM_ONLINEG.YE [Trend Micro]

• Notes:
• %Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).
• %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

Memory Modifications

• There were new processes created in the system:

Process Name	Process Filename	Main Module Size
amvo.exe	%System%\amvo.exe	184,320 bytes
[filename of the sample #1]	[file and pathname of the sample #1]	184,320 bytes

• The following module was loaded into the address space of other process(es):

Module Name	Module Filename	Address Space Details
amvo1.dll	%System%\amvo1.dll	Process name: explorer.exe Process filename: %Windir%\explorer.exe Address space: 0xD80000 - 0xD9E000

• Notes:
• %Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.

Registry Modifications

• The newly created Registry Value is:
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
• amva = "%System%\amvo.exe"

so that amvo.exe runs every time Windows starts

• The following Registry Value was modified:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL]
• CheckedValue = 0x00000000

so that hidden files and folders are not displayed in explorer when browsing the file system

Other details

• The following Internet download was started (the retrieved bits are saved into the local file):