Submission Summary:

• Submission details:
• Submission received: 21 June 2008, 03:12:07
• Processing time: 4 min 26 sec
• Submitted sample:
• File MD5: 0x48A48401D7A9B1D11E7F7A4C1C1A5DED
• File SHA-1: 0x30CEE16C8E51EBB88FAE20F67D401F93FDE92DD9
• Filesize: 93,184 bytes
• Alias:
• Trojan-Downloader.Win32.Injecter.tz [Kaspersky Lab]
• Vundo [McAfee]

• Summary of the findings:

What's been found	Severity Level
Threat characteristics of Vundo (aka VirtuMonde/VirtuMundo), a trojan horse that cause popups and advertises rogue antispyware programs. Vundo can be installed by visiting a Web site link contained in a spammed email. It is known to create a DLL file in the Windows system32 directory and inject it into system processes winlogon.exe and explorer.exe.
Registers a Winlogon notification package so that the installed module is loaded into the address space of winlogon.exe.
Registers a 32-bit in-process server DLL.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! Characteristics of the following security risk was identified in the system:

Security Risk	Description
Trojan.Virtumonde	Virtumonde modifies the Windows Internet connection mechanism and display various pop-up advertisements.

• Attention! The following threat categories were identified:

Threat Category	Description
	A potentially unwanted adware program designed to deliver various advertisements to the users' systems
	A program that downloads files to the local computer that may represent security risk

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%Temp%\removalfile.bat	43 bytes	MD5: 0x9A7EF09167A6F4433681B94351509043 SHA-1: 0x259B1375ED8E84943CA1D42646BB416325C89E12	(not available)
2	%System%\ssqQHAtt.dll	57,344 bytes	MD5: 0x0CEF9D1EE059C2693E3854BF62DCC36B SHA-1: 0xC22F0DFC680633C4CCD3E6F881302335A9785A78	not-a-virus:AdWare.Win32.Virtumonde.wwr [Kaspersky Lab]

• Notes:
• %Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).
• %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

Memory Modifications

• There was a new process created in the system:

• The following module was loaded into the address space of other process(es):

Module Name	Module Filename	Address Space Details
ssqQHAtt.dll	%System%\ssqQHAtt.dll	Process name: explorer.exe Process filename: %Windir%\explorer.exe Address space: 0x1930000 - 0x1940C66

• Notes:
• %Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.

Registry Modifications

• The following Registry Keys were created:
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{487C9905-26A8-42C8-8033-C58AD3D2AEC3}
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{487C9905-26A8-42C8-8033-C58AD3D2AEC3}\InprocServer32
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\Settings
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ssqQHAtt
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\00cd0861

• The newly created Registry Values are:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{487C9905-26A8-42C8-8033-C58AD3D2AEC3}\InprocServer32]
• (Default) = "%System%\ssqQHAtt.dll"
• ThreadingModel = "Both"
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\Settings]
• Time = 50 D7 68 CA F8 D2 C8 01 00 00 00 00
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
• {487C9905-26A8-42C8-8033-C58AD3D2AEC3} = ""
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ssqQHAtt]
• Asynchronous = 0x00000001
• DllName = "ssqQHAtt.dll"
• Impersonate = 0x00000000
• Logon = "o"
• Logoff = "f"

so that ssqQHAtt.dll is installed as a Winlogon notification package

• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\00cd0861]
• (Default) = "AFF95CF3454947AF985492238F2F999B&"
• [HKEY_CURRENT_USER\Software\Microsoft\Installer]
• (Default) = C2 46 FA CA F8 D2 C8 01

Other details

• There was application-defined hook procedure installed into the hook chain (e.g. to monitor keystrokes). The installed hook is handled by the following module:
• %System%\ssqQHAtt.dll