ThreatExpert Report

Submission Summary:

Submission details:

Submission received: 19 July 2008, 19:22:32
Processing time: 5 min 18 sec
Submitted sample:

File MD5: 0x3E9B9FACD7B421D664BB780B51B275FA
File SHA-1: 0xE22540B6646F2EADE5EADD86BAA1C4F25B166993
Filesize: 1,649,721 bytes

Summary of the findings:

What's been found	Severity Level
Downloads/requests other files from Internet.
Registers a 32-bit in-process server DLL.

Technical Details:

The new window was created, as shown below:

NOTICE: The content shown in the above window is captured automatically and is not controlled or endorsed by ThreatExpert.
Please contact us on this link should any material be offensive or inappropriate and we will ensure any such content is blocked from future viewers of the report.

File System Modifications

The following files were created in the system:

#	Filename(s)	File Size	File Hash
1	%CommonPrograms%\Ares Gold\About AdVantage.lnk	479 bytes	MD5: 0x3FD6133CBC3824227C383027B7C563AE SHA-1: 0xD1C52FE78ACF0B9CFE76D5136072D70B5905B7F6
2	%CommonPrograms%\Ares Gold\AdVantage Customer Support.lnk	479 bytes	MD5: 0x0DF6EF5B37AF86A08270AFE97D876865 SHA-1: 0xEF7481814615A7C3CB515F3648C884F7766877D1
3	%CommonPrograms%\Ares Gold\Ares Gold.lnk	647 bytes	MD5: 0x7BBB08613A65DE61AE66C49B4D92122B SHA-1: 0x252EBB615B9971DF9896BC0658E482FF06392FA3
4	%DesktopDir%\Ares Gold.lnk	635 bytes	MD5: 0xB1C6830CAA174ED50A898A16BAECD2C5 SHA-1: 0x4993C666C1671BF0B17C5FEA5BB67C3A16CC4B58
5	%AppData%\Microsoft\Windows Media\9.0\WMSDKNSD.XML	53 bytes	MD5: 0xA9B5DA9AEC61657B32393D96217165F0 SHA-1: 0x80B5C577155ACD269B450D70F6B2CBED693EDF49
6	%Temp%\CSM1.tmp %Temp%\CSM7.tmp	147,456 bytes	MD5: 0x83BACD2C634B541DD1E7DED3CF5F5FF7 SHA-1: 0x486E20514E6F1873F993CAB5AAC72A0C218F082A
7	%Temp%\is-I96I1.tmp\rkverify.exe	233,472 bytes	MD5: 0x37FF45A5063985FBEEAC98AFF61890A3 SHA-1: 0x07B003EC81C3E76149ACD4CFCF03C7F3154C4726
8	%ProgramFiles%\Ares Gold\AresGold.exe	2,263,552 bytes	MD5: 0x904FBFA8C951E1158349079FDCAFFEC8 SHA-1: 0xEB7D2556FA7D93F9391EF000AE8DD6F5E1970D46
9	%ProgramFiles%\Ares Gold\Data\defaultcache.net	8,988 bytes	MD5: 0x7A9936FEA098F6352943254F04B7031D SHA-1: 0xF4C2D2C90F266DF7938FB3243368740B5E3C888C
10	%ProgramFiles%\Ares Gold\Data\defaultultracache.net	3,883 bytes	MD5: 0x951A37CF24A3FD677C659B3100375F1F SHA-1: 0xE86482D36124A5A26B41E9DDE197B47C6567D115
11	%ProgramFiles%\Ares Gold\Data\defaultwebcache.net	5,749 bytes	MD5: 0xD1F2D92DC97C7093691C184D0AD50EC1 SHA-1: 0xA5F6C84DFF76C9C1523A6F67966AF646BBA1C497
12	%ProgramFiles%\Ares Gold\Data\MyMedia.edb	37,144 bytes	MD5: 0x69C9C9590631AFA58A86A559A6B00E20 SHA-1: 0xE80F645628C2F2C58564F8D69996612AA70F0F58
13	%ProgramFiles%\Ares Gold\tcpip_patcher.sys	15,744 bytes	MD5: 0x4F781A6337CF1048147C684ED21B34D1 SHA-1: 0x66AFE5CD521A80A8EF16E9869B8960AE626CAA23
14	%ProgramFiles%\Ares Gold\unins000.dat	2,222 bytes	MD5: 0x44898ECE336A3DAA3FA8C73372C8E130 SHA-1: 0xB97250F2E1B2BB596D4FF3CA4E59E8E47C0B2F24
15	%ProgramFiles%\Ares Gold\unins000.exe	77,257 bytes	MD5: 0xBF15CE70E055955FAFD81A18EC1C0771 SHA-1: 0x2E744B01A4A96B82F1C298304D497A26D75C5B91
16	%System%\GnucDNA.dll	1,040,384 bytes	MD5: 0x899CBFACB20BB41B8E2423C4856B498C SHA-1: 0xFFC81AD50665863D99AB53AD990935FA43BC73CA
17	%System%\rkinstall.exe	327,680 bytes	MD5: 0x04BF349D146CC5A7354BB144B756F496 SHA-1: 0x89DDF33EC18A52483913FA4592280D60999B887F
18	[file and pathname of the sample #1]	1,649,721 bytes	MD5: 0x3E9B9FACD7B421D664BB780B51B275FA SHA-1: 0xE22540B6646F2EADE5EADD86BAA1C4F25B166993

Notes:

%CommonPrograms% is a variable that refers to the file system directory that contains the directories for the common program groups that appear on the Start menu for all users. A typical path is C:\Documents and Settings\All Users\Start Menu\Programs (Windows NT/2000/XP).
%DesktopDir% is a variable that refers to the file system directory used to physically store file objects on the desktop. A typical path is C:\Documents and Settings\[UserName]\Desktop.
%AppData% is a variable that refers to the file system directory that serves as a common repository for application-specific data. A typical path is C:\Documents and Settings\[UserName]\Application Data.
%Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).
%ProgramFiles% is a variable that refers to the Program Files folder. A typical path is C:\Program Files.
%System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

The following file was modified:

%AppData%\Microsoft\Windows Media\9.0\WMSDKNS.XML

The following directories were created:

%CommonPrograms%\Ares Gold
%Temp%\is-I96I1.tmp
%ProgramFiles%\Ares Gold
%ProgramFiles%\Ares Gold\Data

Memory Modifications

There were new processes created in the system:

Process Name	Process Filename	Main Module Size
rkinstall.exe	%System%\rkinstall.exe	352,256 bytes
AdVantageSetup.exe	%ProgramFiles%\Ares Gold\Partner\AdVantageSetup.exe	135,168 bytes
rkverify.exe	%Temp%\is-I96I1.tmp\rkverify.exe	237,568 bytes
[filename of the sample #1]	[file and pathname of the sample #1]	77,824 bytes
is-8OG8R.tmp	%Temp%\is-S6LKE.tmp\is-8OG8R.tmp	643,072 bytes

Registry Modifications

The following Registry Keys were created:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F02C0AE1-D796-42C9-81E1-084D88F79B8E}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F02C0AE1-D796-42C9-81E1-084D88F79B8E}\InProcServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F02C0AE1-D796-42C9-81E1-084D88F79B8E}\ProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0BE385A3-85A5-4722-B677-68DAE891FF21}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0BE385A3-85A5-4722-B677-68DAE891FF21}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0BE385A3-85A5-4722-B677-68DAE891FF21}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0BE385A3-85A5-4722-B677-68DAE891FF21}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{272C0D60-0561-4C83-B3DB-EB0A71F9D2EB}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{272C0D60-0561-4C83-B3DB-EB0A71F9D2EB}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{272C0D60-0561-4C83-B3DB-EB0A71F9D2EB}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{272C0D60-0561-4C83-B3DB-EB0A71F9D2EB}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{284477E4-A7CB-4055-9E1B-0EA7CBA28945}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{284477E4-A7CB-4055-9E1B-0EA7CBA28945}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{284477E4-A7CB-4055-9E1B-0EA7CBA28945}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{284477E4-A7CB-4055-9E1B-0EA7CBA28945}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{70CA4938-6A0F-4641-A9A9-C936E4C1E7DE}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{70CA4938-6A0F-4641-A9A9-C936E4C1E7DE}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{70CA4938-6A0F-4641-A9A9-C936E4C1E7DE}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{70CA4938-6A0F-4641-A9A9-C936E4C1E7DE}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7468213E-010E-4EC6-A17D-642E909BA7EC}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7468213E-010E-4EC6-A17D-642E909BA7EC}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7468213E-010E-4EC6-A17D-642E909BA7EC}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7468213E-010E-4EC6-A17D-642E909BA7EC}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{89DC33A2-F86F-42A1-8B5F-D4D1943EFC9C}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{89DC33A2-F86F-42A1-8B5F-D4D1943EFC9C}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{89DC33A2-F86F-42A1-8B5F-D4D1943EFC9C}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{89DC33A2-F86F-42A1-8B5F-D4D1943EFC9C}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A916AF3C-976D-4358-8736-95BEA0B5FD2C}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A916AF3C-976D-4358-8736-95BEA0B5FD2C}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A916AF3C-976D-4358-8736-95BEA0B5FD2C}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A916AF3C-976D-4358-8736-95BEA0B5FD2C}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B86F4810-19A9-4050-9AC9-B5CF60B5799A}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B86F4810-19A9-4050-9AC9-B5CF60B5799A}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B86F4810-19A9-4050-9AC9-B5CF60B5799A}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B86F4810-19A9-4050-9AC9-B5CF60B5799A}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BB5B7E14-F8B4-4365-A24D-F4965C33E1EE}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BB5B7E14-F8B4-4365-A24D-F4965C33E1EE}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BB5B7E14-F8B4-4365-A24D-F4965C33E1EE}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BB5B7E14-F8B4-4365-A24D-F4965C33E1EE}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BE45F056-E005-437B-BE88-23ACF70B0B6A}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BE45F056-E005-437B-BE88-23ACF70B0B6A}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BE45F056-E005-437B-BE88-23ACF70B0B6A}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BE45F056-E005-437B-BE88-23ACF70B0B6A}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C13D4627-02F5-4B03-897A-BF6A90022DD2}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C13D4627-02F5-4B03-897A-BF6A90022DD2}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C13D4627-02F5-4B03-897A-BF6A90022DD2}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C13D4627-02F5-4B03-897A-BF6A90022DD2}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C636F1FC-6AE4-4E6A-90AB-6D61D821A0DD}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C636F1FC-6AE4-4E6A-90AB-6D61D821A0DD}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C636F1FC-6AE4-4E6A-90AB-6D61D821A0DD}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C636F1FC-6AE4-4E6A-90AB-6D61D821A0DD}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{CB971AC0-6408-40DA-A540-92F9F256F51F}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{CB971AC0-6408-40DA-A540-92F9F256F51F}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{CB971AC0-6408-40DA-A540-92F9F256F51F}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{CB971AC0-6408-40DA-A540-92F9F256F51F}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D5694DFE-43B6-4E05-AA29-8C556C968973}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D5694DFE-43B6-4E05-AA29-8C556C968973}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D5694DFE-43B6-4E05-AA29-8C556C968973}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D5694DFE-43B6-4E05-AA29-8C556C968973}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E2032EC2-A9AC-4ED7-9BDB-EBECACF076F2}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E2032EC2-A9AC-4ED7-9BDB-EBECACF076F2}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E2032EC2-A9AC-4ED7-9BDB-EBECACF076F2}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E2032EC2-A9AC-4ED7-9BDB-EBECACF076F2}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EBAB4A71-8C34-461A-B57D-DD041D439555}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EBAB4A71-8C34-461A-B57D-DD041D439555}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EBAB4A71-8C34-461A-B57D-DD041D439555}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EBAB4A71-8C34-461A-B57D-DD041D439555}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F06FEA43-0CC3-4BF6-A85B-5EFB1C07AA4B}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F06FEA43-0CC3-4BF6-A85B-5EFB1C07AA4B}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F06FEA43-0CC3-4BF6-A85B-5EFB1C07AA4B}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F06FEA43-0CC3-4BF6-A85B-5EFB1C07AA4B}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FC94A0F7-9C7C-4AE2-9106-5C212332B209}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FC94A0F7-9C7C-4AE2-9106-5C212332B209}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FC94A0F7-9C7C-4AE2-9106-5C212332B209}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FC94A0F7-9C7C-4AE2-9106-5C212332B209}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{2850BDC7-2330-4E31-9FA0-88268846539A}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{2850BDC7-2330-4E31-9FA0-88268846539A}\1.0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{2850BDC7-2330-4E31-9FA0-88268846539A}\1.0\0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{2850BDC7-2330-4E31-9FA0-88268846539A}\1.0\0\win32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{2850BDC7-2330-4E31-9FA0-88268846539A}\1.0\FLAGS
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{2850BDC7-2330-4E31-9FA0-88268846539A}\1.0\HELPDIR
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\GnucDNA.Core
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\GnucDNA.Core\CLSID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Ares Gold_is1
HKEY_LOCAL_MACHINE\SOFTWARE\SynView
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{DB28B382-9162-41C0-949B-7B00A53BCA72}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{DB28B382-9162-41C0-949B-7B00A53BCA72}\Properties
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{DB28B382-9162-41C0-949B-7B00A53BCA72}
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{DB28B382-9162-41C0-949B-7B00A53BCA72}\Properties
HKEY_CURRENT_USER\Software\Microsoft\MediaPlayer\Player\Tasks
HKEY_CURRENT_USER\Software\Microsoft\MediaPlayer\Player\Tasks\NowPlaying
HKEY_CURRENT_USER\Software\Microsoft\MediaPlayer\Preferences\ProxySettings
HKEY_CURRENT_USER\Software\Microsoft\MediaPlayer\Preferences\ProxySettings\HTTP
HKEY_CURRENT_USER\Software\Microsoft\MediaPlayer\Preferences\ProxySettings\MMS
HKEY_CURRENT_USER\Software\Microsoft\MediaPlayer\Preferences\ProxySettings\RTSP
HKEY_CURRENT_USER\Software\Microsoft\MediaPlayer\Health
HKEY_CURRENT_USER\Software\Microsoft\MediaPlayer\Health\{E2B0B374-2A6B-4A6D-A7B3-27F32E49E4F5}
HKEY_CURRENT_USER\Software\Ares Gold
HKEY_CURRENT_USER\Software\Ares Gold\General
HKEY_CURRENT_USER\Software\Ares Gold\Options

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F02C0AE1-D796-42C9-81E1-084D88F79B8E}\ProgID]

(Default) = "GnucDNA.Core"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F02C0AE1-D796-42C9-81E1-084D88F79B8E}\InProcServer32]

(Default) = "%System%\GnucDNA.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F02C0AE1-D796-42C9-81E1-084D88F79B8E}]

(Default) = "GnucDNA.Core"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0BE385A3-85A5-4722-B677-68DAE891FF21}\TypeLib]

(Default) = "{2850BDC7-2330-4E31-9FA0-88268846539A}"
Version = "1.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0BE385A3-85A5-4722-B677-68DAE891FF21}\ProxyStubClsid32]

(Default) = "{00020420-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0BE385A3-85A5-4722-B677-68DAE891FF21}\ProxyStubClsid]

(Default) = "{00020420-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0BE385A3-85A5-4722-B677-68DAE891FF21}]

(Default) = "_IDownloadEvent"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{272C0D60-0561-4C83-B3DB-EB0A71F9D2EB}\TypeLib]

(Default) = "{2850BDC7-2330-4E31-9FA0-88268846539A}"
Version = "1.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{272C0D60-0561-4C83-B3DB-EB0A71F9D2EB}\ProxyStubClsid32]

(Default) = "{00020420-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{272C0D60-0561-4C83-B3DB-EB0A71F9D2EB}\ProxyStubClsid]

(Default) = "{00020420-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{272C0D60-0561-4C83-B3DB-EB0A71F9D2EB}]

(Default) = "IUpload"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{284477E4-A7CB-4055-9E1B-0EA7CBA28945}\TypeLib]

(Default) = "{2850BDC7-2330-4E31-9FA0-88268846539A}"
Version = "1.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{284477E4-A7CB-4055-9E1B-0EA7CBA28945}\ProxyStubClsid32]

(Default) = "{00020420-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{284477E4-A7CB-4055-9E1B-0EA7CBA28945}\ProxyStubClsid]

(Default) = "{00020420-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{284477E4-A7CB-4055-9E1B-0EA7CBA28945}]

(Default) = "_IShareEvent"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{70CA4938-6A0F-4641-A9A9-C936E4C1E7DE}\TypeLib]

(Default) = "{2850BDC7-2330-4E31-9FA0-88268846539A}"
Version = "1.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{70CA4938-6A0F-4641-A9A9-C936E4C1E7DE}\ProxyStubClsid32]

(Default) = "{00020420-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{70CA4938-6A0F-4641-A9A9-C936E4C1E7DE}\ProxyStubClsid]

(Default) = "{00020420-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{70CA4938-6A0F-4641-A9A9-C936E4C1E7DE}]

(Default) = "_IUpdateEvent"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7468213E-010E-4EC6-A17D-642E909BA7EC}\TypeLib]

(Default) = "{2850BDC7-2330-4E31-9FA0-88268846539A}"
Version = "1.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7468213E-010E-4EC6-A17D-642E909BA7EC}\ProxyStubClsid32]

(Default) = "{00020420-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7468213E-010E-4EC6-A17D-642E909BA7EC}\ProxyStubClsid]

(Default) = "{00020420-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7468213E-010E-4EC6-A17D-642E909BA7EC}]

(Default) = "_INetworkEvent"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{89DC33A2-F86F-42A1-8B5F-D4D1943EFC9C}\TypeLib]

(Default) = "{2850BDC7-2330-4E31-9FA0-88268846539A}"
Version = "1.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{89DC33A2-F86F-42A1-8B5F-D4D1943EFC9C}\ProxyStubClsid32]

(Default) = "{00020420-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{89DC33A2-F86F-42A1-8B5F-D4D1943EFC9C}\ProxyStubClsid]

(Default) = "{00020420-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{89DC33A2-F86F-42A1-8B5F-D4D1943EFC9C}]

(Default) = "ICore"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A916AF3C-976D-4358-8736-95BEA0B5FD2C}\TypeLib]

(Default) = "{2850BDC7-2330-4E31-9FA0-88268846539A}"
Version = "1.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A916AF3C-976D-4358-8736-95BEA0B5FD2C}\ProxyStubClsid32]

(Default) = "{00020420-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A916AF3C-976D-4358-8736-95BEA0B5FD2C}\ProxyStubClsid]

(Default) = "{00020420-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A916AF3C-976D-4358-8736-95BEA0B5FD2C}]

(Default) = "_IChatEvent"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B86F4810-19A9-4050-9AC9-B5CF60B5799A}\TypeLib]

(Default) = "{2850BDC7-2330-4E31-9FA0-88268846539A}"
Version = "1.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B86F4810-19A9-4050-9AC9-B5CF60B5799A}\ProxyStubClsid32]

(Default) = "{00020420-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B86F4810-19A9-4050-9AC9-B5CF60B5799A}\ProxyStubClsid]

(Default) = "{00020420-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B86F4810-19A9-4050-9AC9-B5CF60B5799A}]

(Default) = "ICache"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BB5B7E14-F8B4-4365-A24D-F4965C33E1EE}\TypeLib]

(Default) = "{2850BDC7-2330-4E31-9FA0-88268846539A}"
Version = "1.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BB5B7E14-F8B4-4365-A24D-F4965C33E1EE}\ProxyStubClsid32]

(Default) = "{00020420-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BB5B7E14-F8B4-4365-A24D-F4965C33E1EE}\ProxyStubClsid]

(Default) = "{00020420-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BB5B7E14-F8B4-4365-A24D-F4965C33E1EE}]

(Default) = "IShare"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BE45F056-E005-437B-BE88-23ACF70B0B6A}\TypeLib]

(Default) = "{2850BDC7-2330-4E31-9FA0-88268846539A}"
Version = "1.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BE45F056-E005-437B-BE88-23ACF70B0B6A}\ProxyStubClsid32]

(Default) = "{00020420-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BE45F056-E005-437B-BE88-23ACF70B0B6A}\ProxyStubClsid]

(Default) = "{00020420-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BE45F056-E005-437B-BE88-23ACF70B0B6A}]

(Default) = "IChat"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C13D4627-02F5-4B03-897A-BF6A90022DD2}\TypeLib]

(Default) = "{2850BDC7-2330-4E31-9FA0-88268846539A}"
Version = "1.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C13D4627-02F5-4B03-897A-BF6A90022DD2}\ProxyStubClsid32]

(Default) = "{00020420-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C13D4627-02F5-4B03-897A-BF6A90022DD2}\ProxyStubClsid]

(Default) = "{00020420-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C13D4627-02F5-4B03-897A-BF6A90022DD2}]

(Default) = "ISearch"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C636F1FC-6AE4-4E6A-90AB-6D61D821A0DD}\TypeLib]

(Default) = "{2850BDC7-2330-4E31-9FA0-88268846539A}"
Version = "1.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C636F1FC-6AE4-4E6A-90AB-6D61D821A0DD}\ProxyStubClsid32]

(Default) = "{00020420-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C636F1FC-6AE4-4E6A-90AB-6D61D821A0DD}\ProxyStubClsid]

(Default) = "{00020420-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C636F1FC-6AE4-4E6A-90AB-6D61D821A0DD}]

(Default) = "IUpdate"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{CB971AC0-6408-40DA-A540-92F9F256F51F}\TypeLib]

(Default) = "{2850BDC7-2330-4E31-9FA0-88268846539A}"
Version = "1.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{CB971AC0-6408-40DA-A540-92F9F256F51F}\ProxyStubClsid32]

(Default) = "{00020420-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{CB971AC0-6408-40DA-A540-92F9F256F51F}\ProxyStubClsid]

(Default) = "{00020420-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{CB971AC0-6408-40DA-A540-92F9F256F51F}]

(Default) = "_IUploadEvent"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D5694DFE-43B6-4E05-AA29-8C556C968973}\TypeLib]

(Default) = "{2850BDC7-2330-4E31-9FA0-88268846539A}"
Version = "1.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D5694DFE-43B6-4E05-AA29-8C556C968973}\ProxyStubClsid32]

(Default) = "{00020420-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D5694DFE-43B6-4E05-AA29-8C556C968973}\ProxyStubClsid]

(Default) = "{00020420-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D5694DFE-43B6-4E05-AA29-8C556C968973}]

(Default) = "IPrefs"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E2032EC2-A9AC-4ED7-9BDB-EBECACF076F2}\TypeLib]

(Default) = "{2850BDC7-2330-4E31-9FA0-88268846539A}"
Version = "1.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E2032EC2-A9AC-4ED7-9BDB-EBECACF076F2}\ProxyStubClsid32]

(Default) = "{00020420-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E2032EC2-A9AC-4ED7-9BDB-EBECACF076F2}\ProxyStubClsid]

(Default) = "{00020420-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E2032EC2-A9AC-4ED7-9BDB-EBECACF076F2}]

(Default) = "_ISearchEvent"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EBAB4A71-8C34-461A-B57D-DD041D439555}\TypeLib]

(Default) = "{2850BDC7-2330-4E31-9FA0-88268846539A}"
Version = "1.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EBAB4A71-8C34-461A-B57D-DD041D439555}\ProxyStubClsid32]

(Default) = "{00020420-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EBAB4A71-8C34-461A-B57D-DD041D439555}\ProxyStubClsid]

(Default) = "{00020420-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EBAB4A71-8C34-461A-B57D-DD041D439555}]

(Default) = "IDownload"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F06FEA43-0CC3-4BF6-A85B-5EFB1C07AA4B}\TypeLib]

(Default) = "{2850BDC7-2330-4E31-9FA0-88268846539A}"
Version = "1.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F06FEA43-0CC3-4BF6-A85B-5EFB1C07AA4B}\ProxyStubClsid32]

(Default) = "{00020420-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F06FEA43-0CC3-4BF6-A85B-5EFB1C07AA4B}\ProxyStubClsid]

(Default) = "{00020420-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F06FEA43-0CC3-4BF6-A85B-5EFB1C07AA4B}]

(Default) = "IMeta"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FC94A0F7-9C7C-4AE2-9106-5C212332B209}\TypeLib]

(Default) = "{2850BDC7-2330-4E31-9FA0-88268846539A}"
Version = "1.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FC94A0F7-9C7C-4AE2-9106-5C212332B209}\ProxyStubClsid32]

(Default) = "{00020420-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FC94A0F7-9C7C-4AE2-9106-5C212332B209}\ProxyStubClsid]

(Default) = "{00020420-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FC94A0F7-9C7C-4AE2-9106-5C212332B209}]

(Default) = "INetwork"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{2850BDC7-2330-4E31-9FA0-88268846539A}\1.0\0\win32]

(Default) = "%System%\GnucDNA.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{2850BDC7-2330-4E31-9FA0-88268846539A}\1.0\HELPDIR]

(Default) = "%Windir%\system32"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{2850BDC7-2330-4E31-9FA0-88268846539A}\1.0\FLAGS]

(Default) = "0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{2850BDC7-2330-4E31-9FA0-88268846539A}\1.0]

(Default) = "GnucDNA"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\GnucDNA.Core\CLSID]

(Default) = "{F02C0AE1-D796-42C9-81E1-084D88F79B8E}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\GnucDNA.Core]

(Default) = "GnucDNA.Core"

[[pathname with a string SHARE]\SharedDlls]

%System%\GnucDNA.dll = 0x00000001

The following Registry Value was deleted:

[HKEY_CURRENT_USER\Software\Microsoft\MediaPlayer\Player\Settings]

Client ID = "{8B2FC17F-5905-448A-88D5-C64086555F44}"

The following Registry Value was modified:

[HKEY_CURRENT_USER\Software\Microsoft\Windows Media\WMSDK\Namespace]

LocalBase = "%AppData%\Microsoft\Windows Media\9.0\WMSDKNS.XML"
DTDFile = "%AppData%\Microsoft\Windows Media\9.0\WMSDKNS.DTD"
LocalDelta = "%AppData%\Microsoft\Windows Media\9.0\WMSDKNSD.XML"
RemoteDelta = "%AppData%\Microsoft\Windows Media\9.0\WMSDKNSR.XML"

Other details

To mark the presence in the system, the following Mutex objects were created:

MeMediaSetup_SharedMutex
Ares Gold

The following port was open in the system:

Port	Protocol	Process
1041	TCP	rkinstall.exe (%System%\rkinstall.exe)

The following Internet Connections were established:

Server Name	Server Port	Connect as User	Connection Password
post.securestudies.com	443	(null)	(null)
app.memedia.com	80	(null)	(null)
downloads.memedia.com	80	(null)	(null)
www.aresgold.com	80	(null)	(null)

There were application-defined hook procedures installed into the hook chain (e.g. to monitor keystrokes). The installed hooks are handled by the following modules:

%Temp%\CSM7.tmp

the hook is handled by its export "KeyboardProc()"

%Temp%\CSM7.tmp

the hook is handled by its export "MsgProc()"

%Temp%\CSM1.tmp

the hook is handled by its export "KeyboardProc()"

%Temp%\CSM1.tmp

the hook is handled by its export "MsgProc()"

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.

The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.