ThreatExpert Report: Win-Trojan/Adspy.717658

Technical Details:

File System Modifications

The following files were created in the system:

Filename(s)

File Size

File Hash

Alias

%CommonPrograms%\Security Solutions Antispyware\Security Solutions\Security Solutions Antispyware.lnk

899 bytes

MD5: 0x5095816A8D78B49E356E2726C65725C0
SHA-1: 0x6860BDB4C424B192EFD598CCAD5F8DCA174FE73F

(not available)

%CommonPrograms%\Security Solutions Antispyware\Uninstall Security Solutions Antispyware.lnk

848 bytes

MD5: 0xC927E155D4BA943581E47C508AC3297C
SHA-1: 0x8B3066D6E867E6DCA3C60AEF502074C07F18F2EE

(not available)

%DesktopDir%\Security Solutions Antispyware.lnk

881 bytes

MD5: 0xDC9AFBF190A73F7EFCE0165D531376DA
SHA-1: 0x8FC775DE4894C18DEDF3EE2C682A11871A6FAB20

(not available)

%ProgramFiles%\Security Solutions Antispyware\definitions.dat

8,500 bytes

MD5: 0xA487D28CA6CEFD829DD5BF45D29B3003
SHA-1: 0xD5F70EC580F574575A0B7E44DBCC67E63F577150

(not available)

%ProgramFiles%\Security Solutions Antispyware\DotNetSkin.SkinControls.dll

57,344 bytes

MD5: 0x056FBD995278DC056A1BEE1C3EC41010
SHA-1: 0x0381A9FF19B06C7E9232AD65D2C2C0CE473BD0B7

(not available)

%ProgramFiles%\Security Solutions Antispyware\first.txt

0 bytes

MD5: 0xD41D8CD98F00B204E9800998ECF8427E
SHA-1: 0xDA39A3EE5E6B4B0D3255BFEF95601890AFD80709

(not available)

%ProgramFiles%\Security Solutions Antispyware\Icons.dll

106,496 bytes

MD5: 0x146CC9E4B95C918A31CD3252A2904FCF
SHA-1: 0x9E25A80F8B5AE95D8D05C906A14E3E3E9420DB4C

(not available)

%ProgramFiles%\Security Solutions Antispyware\instsrv.exe

18,432 bytes

MD5: 0xC43D1B84143FB2561F22E1A2C8FACF53
SHA-1: 0x3F1357007F61F02F97F0AAABB8756C6ECA2ACEBD

(not available)

%ProgramFiles%\Security Solutions Antispyware\License.txt

3,364 bytes

MD5: 0xC371ABCD0EDED6999991D117F249A1FC
SHA-1: 0x9FCD35BE71DD5D04A559BAA9E515C58F83E12800

(not available)

%ProgramFiles%\Security Solutions Antispyware\ProgBar.dll

57,344 bytes

MD5: 0xB0A96C3184FDEA4C8A63751FD929F307
SHA-1: 0x6C0DDC6C66341C6A4FA2A1209BA3E86394BA534D

(not available)

%ProgramFiles%\Security Solutions Antispyware\regjump.exe

150,328 bytes

MD5: 0x781D276DC4EC4523CEAB73D554FC9777
SHA-1: 0xD085FC81C53E1A039AAECE4692ABE1BA2C5886A0

(not available)

%ProgramFiles%\Security Solutions Antispyware\SecuritySolutions.exe

704,512 bytes

MD5: 0x9BF89C2A0B267E79C3B19322666B268C
SHA-1: 0x3AFFC82333782A6E0FF2918BBDFF67B8A99B4E43

(not available)

%ProgramFiles%\Security Solutions Antispyware\SecuritySolutions.ico

26,694 bytes

MD5: 0x2E99846D30AE17FA84D152FFE0C768A6
SHA-1: 0xBD0BC8747C565FF97C8FAAC457DC70261DC8ED0C

(not available)

%ProgramFiles%\Security Solutions Antispyware\unins000.dat

7,622 bytes

MD5: 0x24ECC17E35975219FDC76CB2C3FEA5FC
SHA-1: 0x2E58DA33473474A960334518B3E9F5B0FBF37F29

(not available)

%ProgramFiles%\Security Solutions Antispyware\unins000.exe

717,658 bytes

MD5: 0x604D7202305A469F95C2158E742EA21F
SHA-1: 0xAE05665B67AF93FC07EC7220F77AF2864158545D

Win-Trojan/Adspy.717658

[AhnLab]

%ProgramFiles%\Security Solutions Antispyware\UninstallService.exe

16,384 bytes

MD5: 0x76B16BB7B738C3F10CFC51FC35B2B9C0
SHA-1: 0xF940A4530A48804489B5CEA5F15C0F52CB21BBBA

(not available)

%ProgramFiles%\Security Solutions Antispyware\VBCustomTabControl.dll

28,672 bytes

MD5: 0xB522F9EF8BAA3FCF4BC79ECE05663E5E
SHA-1: 0x8318F878F846D5C5FEAC143B1AF70948835CE93F

(not available)

%System%\PerfStringBackup.TMP

425,894 bytes

MD5: 0xDB35AD675AC3E158ADF22D313292FDCF
SHA-1: 0xA9404880735B0ED2254FF1FCC5D803E67CB42594

(not available)

[file and pathname of the sample #1]

744,482 bytes

MD5: 0x3E8FAE33D0336AA5ED20697DBD63BACD
SHA-1: 0x48935A557F09660E691FC9860EA77A511E4F3313

(not available)

Notes:

%CommonPrograms% is a variable that refers to the file system directory that contains the directories for the common program groups that appear on the Start menu for all users. A typical path is C:\Documents and Settings\All Users\Start Menu\Programs (Windows NT/2000/XP).
%DesktopDir% is a variable that refers to the file system directory used to physically store file objects on the desktop. A typical path is C:\Documents and Settings\[UserName]\Desktop.
%ProgramFiles% is a variable that refers to the Program Files folder. A typical path is C:\Program Files.
%System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

The following directories were created:

%CommonPrograms%\Security Solutions Antispyware
%CommonPrograms%\Security Solutions Antispyware\Security Solutions
%ProgramFiles%\Security Solutions Antispyware
%ProgramFiles%\Security Solutions Antispyware\backups

Registry Modifications

The following Registry Keys were created:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Security Solutions Antispyware_is1
HKEY_LOCAL_MACHINE\SOFTWARE\SecuritySolutions
HKEY_LOCAL_MACHINE\SOFTWARE\SecuritySolutions\SpywareRemover
HKEY_CURRENT_USER\Software\Sysinternals\Regjump

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Security Solutions Antispyware_is1]

Inno Setup: Setup Version = "5.2.3"
Inno Setup: App Path = "%ProgramFiles%\Security Solutions Antispyware"
InstallLocation = "%ProgramFiles%\Security Solutions Antispyware\"
Inno Setup: Icon Group = "Security Solutions Antispyware"
Inno Setup: User = "%UserName%"
Inno Setup: Selected Tasks = "desktopicon,quicklaunchicon"
Inno Setup: Deselected Tasks = ""
DisplayName = "Security Solutions Antispyware 3.0.0"
UninstallString = ""%ProgramFiles%\Security Solutions Antispyware\unins000.exe""
QuietUninstallString = ""%ProgramFiles%\Security Solutions Antispyware\unins000.exe" /SILENT"
Publisher = "Security Solutions"
NoModify = 0x00000001
NoRepair = 0x00000001
InstallDate = "20100204"

[HKEY_LOCAL_MACHINE\SOFTWARE\SecuritySolutions\SpywareRemover]

Path = "%ProgramFiles%\security solutions antispyware"

[HKEY_CURRENT_USER\Software\Sysinternals\Regjump]

EulaAccepted = 0x00000001

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.

The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.

Submission Summary:

Technical Details: