Submission Summary:

• Submission details:
• Submission received: 24 May 2008, 12:07:36
• Processing time: 4 min 25 sec
• Submitted sample:
• File MD5: 0x546CD0B4BC399168541F5988D5A705B5
• File SHA-1: 0x0EC9C16E9A7039013D07865468DEC874423DC54B
• Filesize: 44,544 bytes
• Alias:
• Infostealer.Gampass [Symantec]
• PWS-LegMir.gen.h [McAfee]

• Summary of the findings:

What's been found	Severity Level
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! Characteristics of the following security risk was identified in the system:

Security Risk	Description
Trojan-PWS.OnlineGames.IXL	Trojan-PWS.OnlineGames.IXL attempts to steal information associated to online games and send those information to the attacker.

• Attention! The following threat category was identified:

Threat Category	Description
	A keylogger program that can capture all user keystrokes (including confidential details such username, password, credit card number, etc.)

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%Temp%\LYMANGR.DLL %System%\LYMANGR.DLL	10,752 bytes	MD5: 0xA1D7C33069284D47A32D180F6E56FE6D SHA-1: 0x419FEA1F055BDE79591D9D1F9D6EEA9C151CFE6F	Infostealer.Gampass [Symantec] Generic PWS.y [McAfee] TSPY_ONLINE.AT [Trend Micro]
2	%Temp%\MSDEG32.DLL %System%\MSDEG32.DLL	16,896 bytes	MD5: 0x8C9012C5282810581B22412290E88029 SHA-1: 0x78B1378A07B5C7789CCD1A185FE0ECB8DFFE99F1	Infostealer.Gampass [Symantec] PWS-Mmorpg.gen [McAfee]
3	%System%\LYLOADER.EXE [file and pathname of the sample #1]	44,544 bytes	MD5: 0x546CD0B4BC399168541F5988D5A705B5 SHA-1: 0x0EC9C16E9A7039013D07865468DEC874423DC54B	Infostealer.Gampass [Symantec] PWS-LegMir.gen.h [McAfee]

• Notes:
• %Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).
• %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

Memory Modifications

• There was a new process created in the system:

• The following module was loaded into the address space of other process(es):

Module Name	Module Filename	Address Space Details
LYMANGR.DLL	%System%\LYMANGR.DLL	Process name: explorer.exe Process filename: %Windir%\explorer.exe Address space: 0x19B0000 - 0x19B6000

• Notes:
• %Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.

Registry Modifications

• The following Registry Keys were created:
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run

• The newly created Registry Value is:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run]
• MSDEG32 = "LYLoader.exe"
• MSDWG32 = "LYLoadbr.exe"
• MSDCG32 = "LYLeador.exe"
• MSDOG32 = "LYLoador.exe"
• MSDSG32 = "LYLoadar.exe"
• MSDMG32 = "LYLoadmr.exe"
• MSDHG32 = "LYLoadhr.exe"
• MSDQG32 = "LYLoadqr.exe"

Other details

• Analysis of the file resources indicate the following possible country of origin:

	China