Submission Summary:

• Submission details:
• Submission received: 27 September 2011, 00:52:11
• Processing time: 9 min 49 sec
• Submitted sample:
• File MD5: 0x63648816F3629F6AB2C33A78C04C3BAE
• File SHA-1: 0x638B2128B40F2899501D466677270961427D975A
• Filesize: 9,728 bytes
• Alias:
• Trojan.Virantix!sd6 [PCTools]
• Hoax.Win32.Renos.fei [Kaspersky Lab]
• Generic Dropper.bu [McAfee]
• Mal/EncPk-EQ [Sophos]
• TrojanDownloader:Win32/Renos [Microsoft]
• Virus.Win32.FakeAlert.AJ [Ikarus]
• Win-Trojan/Fakealert.9728.G [AhnLab]

• Summary of the findings:

What's been found	Severity Level
Downloads/requests other files from Internet.
Modifies some system settings that may have negative impact on overall system security state.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! Characteristics of the following security risks were identified in the system:

Security Risk	Description
Adware.Agent.ZO	Adware.Agent.ZO lowers some IE security settings and downloads RogueAntiSpyware without user's permission.
Trojan.Virantix!sd6	Trojan.Virantix!sd6 is a malicious program that does not infect other files but may represents security risk for your computer and/or network environment.

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%UserProfile%\UserData\09FYBNGD\pmocntr2[1].xml	40 bytes	MD5: 0x301E1298E130E7CC7D541A38FEC3F422 SHA-1: 0xB88E26D46E61B86EB4F39A680FD0676D5AB71ED0	(not available)
2	%UserProfile%\UserData\index.dat	32,768 bytes	MD5: 0xD1D5556DEE4A1D27E123993116EA40D4 SHA-1: 0x381CB4865DCA58DAEC4A3E550258E4A3684E48C2	(not available)
3	[file and pathname of the sample #1]	9,728 bytes	MD5: 0x63648816F3629F6AB2C33A78C04C3BAE SHA-1: 0x638B2128B40F2899501D466677270961427D975A	Trojan.Virantix!sd6 [PCTools] Hoax.Win32.Renos.fei [Kaspersky Lab] Generic Dropper.bu [McAfee] Mal/EncPk-EQ [Sophos] TrojanDownloader:Win32/Renos [Microsoft] Virus.Win32.FakeAlert.AJ [Ikarus] Win-Trojan/Fakealert.9728.G [AhnLab]

• Note:
• %UserProfile% is a variable that specifies the current user's profile folder. By default, this is C:\Documents and Settings\[UserName] (Windows NT/2000/XP).

• The following directories were created:
• %UserProfile%\UserData
• %UserProfile%\UserData\09FYBNGD
• %UserProfile%\UserData\59S0OUSI
• %UserProfile%\UserData\61XU88R4
• %UserProfile%\UserData\HDVOIOZI

Memory Modifications

• There was a new process created in the system:

Registry Modifications

• The following Registry Key was deleted:
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}

• The newly created Registry Values are:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0]
• 1208 = 0x00000000
• 2500 = 0x00000003
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1]
• 1208 = 0x00000000
• 2500 = 0x00000003
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2]
• 1208 = 0x00000000
• 2500 = 0x00000003
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3]
• 1208 = 0x00000000
• 2500 = 0x00000003
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4]
• 1208 = 0x00000000
• 2500 = 0x00000003
• [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
• Enable Browser Extensions = "yes"
• Search Bar = "http://www.google.com/ie"
• [HKEY_CURRENT_USER\Software\Microsoft\Security Center]
• AntiVirusDisableNotify = 0x00000001
• FirewallDisableNotify = 0x00000001
• UpdatesDisableNotify = 0x00000001

to disable notification of firewall, antivirus and/or update status through the Windows Security Center

• The following Registry Values were modified:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main]
• Default_Search_URL =
• Search Page =
• Start Page =
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Search]
• SearchAssistant =
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0]
• 1201 =
• 1804 =
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1]
• 1201 =
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2]
• 1201 =
• 1804 =
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3]
• 1201 =
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4]
• 1200 =
• 1201 =
• 1608 =
• 1804 =
• [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
• Start Page =
• Search Page =

Other details

• The following port was open in the system:

• There were registered attempts to establish connection with the remote hosts. The connection details are:

• The data identified by the following URLs was then requested from the remote web server:
• http://do-monster-progress.com/?wmid=1049&l=34&it=2&s=1
• http://domonster-progress.com/?wmid=1049&l=34&it=2&s=1
• http://do-step-scan.com/?wmid=1049&l=34&it=2&s=1
• http://do-stepscan.com/?wmid=1049&l=34&it=2&s=1
• http://doscan-progress.com/?wmid=1049&l=34&it=2&s=1
• http://do-fixed-progress.com/?wmid=1049&l=34&it=2&s=1
• http://do-managedscan.com/?wmid=1049&l=34&it=2&s=1
• http://domake-progress.com/?wmid=1049&l=34&it=2&s=1
• http://dostep-scan.com/?wmid=1049&l=34&it=2&s=1
• http://dopower-scan.com/?wmid=1049&l=34&it=2&s=1
• http://domanaged-scan.com/?wmid=1049&l=34&it=2&s=1
• http://do-powerscan.com/?wmid=1049&l=34&it=2&s=1
• http://ww1.domanaged-scan.com/?wmid=1049&l=34&it=2&s=1
• http://www.google.com/images/mgyhp_sm.png
• http://www.google.com/images/srpr/nav_logo80.png
• http://www.google.com/images/modules/buttons/g-button-chocobo-basic-1.gif
• http://www.google.com/images/modules/buttons/g-button-chocobo-basic-2.gif
• http://www.google.com/extern_js/f/CgJlbhICdXMrMEU4ACwrMFo4ACwrMA44ACwrMBc4ACwrMDw4ACwrMFE4ACwrMJgBOAAsKzAKOABAL5oCAmhlLCswFjgALCswGTgAmgICc2gsKzAlOAAsKzBNOAAsKzBOOAAsKzBUOAAsKzBjOAAsKzBpOAAsKzCSATgALCswrAE4ACwrMBg4ACwrMCY4AJoCA3d0bSyAAlCQAlA/Eg4vol71iOk.js
• http://www.google.com/
• http://www.google.com/csi?v=3&s=webhp&action=&e=28936,29813,30541,31775,32034,32445,32538,33020,33067&ei=nWSBTsiAPYu3twe_o-F0&imc=4&imn=4&imp=0&rt=xjsls.204,prt.1188,ol.1344,iml.1188,xjses.1391,xjsee.1641,xjs.1657
• http://www.google.com/images/close_sm.gif
• http://www.google.com/images/icons/product/chrome-48.png
• http://www.google.com/logos/2011/Googles_13th_Birthday-2011-hp.jpg