Submission Summary:

• Submission details:
• Submission received: 16 January 2009, 22:01:04
• Processing time: 6 min 57 sec
• Submitted sample:
• File MD5: 0x5174D8042C4165154FBEEC30FEBF0BFC
• File SHA-1: 0x67165CE780A3772AE1A23AD3F2C0E8482666D95D
• Filesize: 826,208 bytes
• Alias:
• not-a-virus:FraudTool.Win32.Agent.ex [Kaspersky Lab]
• FakeAlert-BR [McAfee]
• Generic.Win32.Malware.WinFixer [Ikarus]

• Summary of the findings:

What's been found	Severity Level
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! The following threat category was identified:

Threat Category	Description
	A spyware program that represents security risk for a local system

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%Temp%\tmpasg\asg.exe %ProgramFiles%\AntiSpywareGuard\asg.exe	681,984 bytes	MD5: 0xE74CA5D63DDDE4F1991842303CB25B23 SHA-1: 0x50AB157E122903461A2D911327A9EE6D4E375E91	AntiSpywareGuard [Symantec] not-a-virus:FraudTool.Win32.Agent.ex [Kaspersky Lab] Winfixer [McAfee] Mal/FakeAle-KC [Sophos] Virus.Win32.Faker.J [Ikarus]
2	%ProgramFiles%\AntiSpywareGuard\asg.ini	175 bytes	MD5: 0x6FE4A00DC57214328395E90CDE7D13C8 SHA-1: 0x6A49ECA330CD27BAF165204A09F5C35898362EEB	(not available)
3	%ProgramFiles%\AntiSpywareGuard\PP.exe	405,504 bytes	MD5: 0xFCDE9F0AC705CC99ED94115E6F26E8C9 SHA-1: 0xCDE35B456B9547DE58000461FAE17EF3DAD9821C	New Malware.ix [McAfee] Mal/FakeAle-KC [Sophos]
4	[file and pathname of the sample #1]	826,208 bytes	MD5: 0x5174D8042C4165154FBEEC30FEBF0BFC SHA-1: 0x67165CE780A3772AE1A23AD3F2C0E8482666D95D	not-a-virus:FraudTool.Win32.Agent.ex [Kaspersky Lab] FakeAlert-BR [McAfee] Generic.Win32.Malware.WinFixer [Ikarus]

• Notes:
• %Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).
• %ProgramFiles% is a variable that refers to the Program Files folder. A typical path is C:\Program Files.

• The following directories were created:
• %Temp%\tmpasg
• %ProgramFiles%\AntiSpywareGuard

Memory Modifications

• There were new processes created in the system:

Process Name	Process Filename	Main Module Size
asg.exe	%ProgramFiles%\antispywareguard\asg.exe	2,850,816 bytes
[filename of the sample #1]	[file and pathname of the sample #1]	212,992 bytes
asg.exe	%Temp%\tmpasg\asg.exe	2,850,816 bytes

Registry Modifications

• The following Registry Key was created:
• HKEY_CURRENT_USER\Software\AntiSpywareGuard

• The newly created Registry Values are:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform]
• 3P_UASG 1.0.6.0 = ""
• [HKEY_CURRENT_USER\Software\AntiSpywareGuard]
• scns_time = 3C 74 71 49 00 00 00 00
• InfectionCount = 01 00 00 00
• LastScanTime = D9 07 01 00 05 00 10 00 16 00 02 00 04 00 37 01
• TotalScanCount = 02 00 00 00
• LastDetectTime = D9 07 01 00 05 00 10 00 16 00 02 00 08 00 7F 02

Other details

• Analysis of the file resources indicate the following possible countries of origin:

	Russian Federation
	Ukraine

• To mark the presence in the system, the following Mutex object was created:
• AntiMalwareGuard2008_8E0C904E-85D5-4fd8-9473-D173D4D31A9F