Submission Summary:

• Submission details:
• Submission received: 11 May 2009, 22:51:49
• Processing time: 7 min 38 sec
• Submitted sample:
• File MD5: 0x663F8497D5A8A681C735061F69C3ADD4
• File SHA-1: 0x6E57C542CD15F87B7E922B51DB6A0174AA52F2C9
• Filesize: 312,848 bytes

• Summary of the findings:

What's been found	Severity Level
Hosts file modification that may block access to the security web sites.
Downloads/requests other files from Internet.
Creates a startup registry entry.
Registers a 32-bit in-process server DLL.
Registers a Browser Helper Object (Microsoft's Internet Explorer plugin module).
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! Characteristics of the following security risks were identified in the system:

Security Risk	Description
RogueAntiSpyware.Sysguard	RogueAntiSpyware.Sysguard generates malfunctionality on the system by disabling some Windows features. It displays fake alerts in malware payloads in order to persuade users into buying the rogue antispyware products.
Adware.Component.Unrelated	These common components have files and keys that are in different threats but the threats are not related to one another in that the author of the signature is not the same. It is recommended that all these entries be removed.

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash
1	%Windir%\sysguard.exe [file and pathname of the sample #1]	312,848 bytes	MD5: 0x663F8497D5A8A681C735061F69C3ADD4 SHA-1: 0x6E57C542CD15F87B7E922B51DB6A0174AA52F2C9
2	%System%\iehelper.dll	10,752 bytes	MD5: 0x880035F66C1BA9B5192568E36B8F4A95 SHA-1: 0x87870D61770DCACF0FBF1B4D352771AE678A1706

• Notes:
• %Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.
• %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

• The following file was modified:
• %System%\drivers\etc\hosts

Memory Modifications

• There were new processes created in the system:

Process Name	Process Filename	Main Module Size
sysguard.exe	%Windir%\sysguard.exe	491,520 bytes
[filename of the sample #1]	[file and pathname of the sample #1]	491,520 bytes
[generic host process]	[generic host process filename]	20,480 bytes

• Notes:
• [generic host process filename] is a full path filename of [generic host process].

Registry Modifications

• The following Registry Keys were created:
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BBD4551A-9B23-41cd-9BCD-818AA2DA7B63}
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BBD4551A-9B23-41cd-9BCD-818AA2DA7B63}\InProcServer32
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BBD4551A-9B23-41cd-9BCD-818AA2DA7B63}
• HKEY_CURRENT_USER\Software\AvScan

• The newly created Registry Values are:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BBD4551A-9B23-41cd-9BCD-818AA2DA7B63}\InProcServer32]
• (Default) = "%System%\iehelper.dll"
• ThreadingModel = "Apartment"
• [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BBD4551A-9B23-41cd-9BCD-818AA2DA7B63}]
• (Default) = "BHO"
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BBD4551A-9B23-41cd-9BCD-818AA2DA7B63}]
• (Default) = ""
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
• system tool = "%Windir%\sysguard.exe"

so that sysguard.exe runs every time Windows starts

• [HKEY_CURRENT_USER\Software\AvScan]
• aazalirt = 0x00000001
• skaaanret = 0x00000001
• jungertab = 0x00000001
• zibaglertz = 0x00000001
• iddqdops = 0x00000001
• ronitfst = 0x00000001
• tobmygers = 0x00000001
• jikglond = 0x00000001
• tobykke = 0x00000001
• klopnidret = 0x00000001
• jiklagka = 0x00000001
• salrtybek = 0x00000001
• seeukluba = 0x00000001
• jrjakdsd = 0x00000001
• krkdkdkee = 0x00000001
• dkewiizkjdks = 0x00000001
• dkekkrkska = 0x00000001
• rkaskssd = 0x00000001
• kuruhccdsdd = 0x00000001
• krujmmwlrra = 0x00000001
• kkwknrbsggeg = 0x00000001
• ktknamwerr = 0x00000001
• iqmcnoeqz = 0x00000001
• ienotas = 0x00000001
• krkmahejdk = 0x00000001
• otpeppggq = 0x00000001
• krtawefg = 0x00000001
• oranerkka = 0x00000001
• kitiiwhaas = 0x00000001
• otowjdseww = 0x00000001
• otnnbektre = 0x00000001
• oropbbsee = 0x00000001
• irprokwks = 0x00000001
• ooorjaas = 0x00000001
• id = "1.0"

Other details

• Analysis of the file resources indicate the following possible country of origin:

	Russian Federation

• To mark the presence in the system, the following Mutex object was created:
• _!SHMSFTHISTORY!_

• The HOSTS file was updated with the following URL-to-IP mappings:

• The following Internet Connections were established:

• The following GET requests were made:
• check
• loads.php?r=1.0