Submission Summary:

• Submission details:
• Submission received: 18 February 2010, 02:14:10
• Processing time: 6 min 59 sec
• Submitted sample:
• File MD5: 0x45E8A93C63496DE3E5D74AE60F5677A6
• File SHA-1: 0x231E94AE071694BD2C3642F2E92FE2383CBFDB06
• Filesize: 107,475 bytes
• Alias:
• Trojan-PWS.OnlineGames.generic.A!ct [PCTools]
• W32.Gammima.AG [Symantec]
• Trojan-GameThief.Win32.OnLineGames.ryg [Kaspersky Lab]
• PWS-Gamania.gen.a [McAfee]
• Mal_NSAnti-1 [Trend Micro]
• Mal/EncPk-CE, Mal/Krap-K, Mal/Krap-K [Sophos]
• Worm:Win32/Taterf.AM [Microsoft]
• Trojan-GameThief.Win32.OnLineGames [Ikarus]
• Win-Trojan/OnlineGameHack.107475 [AhnLab]

• Summary of the findings:

What's been found	Severity Level
Sets the drive to autoplay by creating autorun.inf file in its root directory. If the drive is shared across the network then other remote computers can be infected any time they try to access this share.
Creates a startup registry entry.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! The following threat category was identified:

Threat Category	Description
	A program that downloads files to the local computer that may represent security risk

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	c:\autorun.inf	303 bytes	MD5: 0x4F1ADE3A73B95A332C6BC2377F9A139A SHA-1: 0x1623FACCB5177EF0DD758E982858DF2B51EF99B7	Trojan-GameThief.Win32.OnLineGames.ryg [Kaspersky Lab] Mal/AutoInf-A [Sophos] Trojan-GameThief.Win32.OnLineGames [Ikarus]
2	%Temp%\n8.dll	30,161 bytes	MD5: 0xA7FF2F751409D8AD0663C5FF1D01C083 SHA-1: 0x539E5FA4B910DF973CF1332210D424108FEED358	Trojan-PWS.OnLineGames!sd5 [PCTools] Downloader [Symantec] Trojan-GameThief.Win32.OnLineGames.snt [Kaspersky Lab] PWS-Gamania.gen.a [McAfee] TROJ_VANTI.BN [Trend Micro] Mal/EncPk-CE [Sophos] VirTool:Win32/Vanti.gen!D [Microsoft] Dropper/Malware.30161 [AhnLab]
3	c:\u2.cmd %System%\amvo.exe [file and pathname of the sample #1]	107,475 bytes	MD5: 0x45E8A93C63496DE3E5D74AE60F5677A6 SHA-1: 0x231E94AE071694BD2C3642F2E92FE2383CBFDB06	Trojan-PWS.OnlineGames.generic.A!ct [PCTools] W32.Gammima.AG [Symantec] Trojan-GameThief.Win32.OnLineGames.ryg [Kaspersky Lab] PWS-Gamania.gen.a [McAfee] Mal_NSAnti-1 [Trend Micro] Mal/EncPk-CE, Mal/Krap-K, Mal/Krap-K [Sophos] Worm:Win32/Taterf.AM [Microsoft] Trojan-GameThief.Win32.OnLineGames [Ikarus] Win-Trojan/OnlineGameHack.107475 [AhnLab]
4	%System%\amvo0.dll %System%\amvo1.dll	71,680 bytes	MD5: 0x53557C462E9214FFDFB6BBAE6F7E333A SHA-1: 0xC0FC026C79D954A58ECBA29E0360D7CE22C59947	Trojan.Lineage.Gen!Pac.3 [PCTools] W32.Gammima.AG [Symantec] Trojan-GameThief.Win32.OnLineGames.ryg [Kaspersky Lab] PWS-Gamania.gen.a [McAfee] Mal_NSAnti-1 [Trend Micro] Mal/EncPk-CE, Mal/Krap-K, Mal/Krap-K [Sophos] Worm:Win32/Taterf.A.dll [Microsoft] Win-Trojan/OnlineGameHack.71680.BD [AhnLab]

• Notes:
• %Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).
• %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

Memory Modifications

• The following module was loaded into the address space of other process(es):

Module Name	Module Filename	Address Space Details
amvo0.dll	%System%\amvo0.dll	Process name: explorer.exe Process filename: %Windir%\explorer.exe Address space: 0x1FF0000 - 0x2013000

• Notes:
• %Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.

• There was a new kernel-mode driver installed in the system:

Driver Name	Driver Filename
wincab.sys	%System%\wincab.sys

Registry Modifications

• The following Registry Keys were created:
• HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_ZSDERHGFDQOSZVJ
• HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_ZSDERHGFDQOSZVJ\0000
• HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_ZSDERHGFDQOSZVJ\0000\Control
• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ZSDERHGFDQOSZVJ
• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ZSDERHGFDQOSZVJ\0000
• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ZSDERHGFDQOSZVJ\0000\Control

• The newly created Registry Values are:
• [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_ZSDERHGFDQOSZVJ\0000\Control]
• *NewlyCreated* = 0x00000000
• ActiveService = "zsderhgfdqoszvj"
• [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_ZSDERHGFDQOSZVJ\0000]
• Service = "zsderhgfdqoszvj"
• Legacy = 0x00000001
• ConfigFlags = 0x00000000
• Class = "LegacyDriver"
• ClassGUID = "{8ECC055D-047F-11D1-A537-0000F8753ED1}"
• DeviceDesc = "zsderhgfdqoszvj"
• [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_ZSDERHGFDQOSZVJ]
• NextInstance = 0x00000001
• [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ZSDERHGFDQOSZVJ\0000\Control]
• *NewlyCreated* = 0x00000000
• ActiveService = "zsderhgfdqoszvj"
• [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ZSDERHGFDQOSZVJ\0000]
• Service = "zsderhgfdqoszvj"
• Legacy = 0x00000001
• ConfigFlags = 0x00000000
• Class = "LegacyDriver"
• ClassGUID = "{8ECC055D-047F-11D1-A537-0000F8753ED1}"
• DeviceDesc = "zsderhgfdqoszvj"
• [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ZSDERHGFDQOSZVJ]
• NextInstance = 0x00000001
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
• amva = "%System%\amvo.exe"

so that amvo.exe runs every time Windows starts

• The following Registry Value was modified:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL]
• CheckedValue =