Submission Summary:

• Submission details:
• Submission received: 13 November 2008, 14:05:46
• Processing time: 6 min 51 sec
• Submitted sample:
• File MD5: 0x6C161CF9AEFD577235547A0514EA7336
• File SHA-1: 0x909CD7E7417B8C4D4C18F58EA80A14F7965A0635
• Filesize: 56,320 bytes

• Summary of the findings:

What's been found	Severity Level
Capability to send out email message(s) with the built-in SMTP client engine.
Contains characteristics a SPAM bot, backdoor trojan, and a rootkit. The backdoor component allows the remote hacker to download/install additional components and instruct the bot to launch massive SPAM attacks from the compromised system.
Creates a startup registry entry.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! Characteristics of the following security risk was identified in the system:

Security Risk	Description
Adware.Component.Unrelated	These common components have files and keys that are in different threats but the threats are not related to one another in that the author of the signature is not the same. It is recommended that all these entries be removed.

• Attention! The following threat category was identified:

Threat Category	Description
	A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment

File System Modifications

• The following file was created in the system:

#	Filename(s)	File Size	File Hash
1	[file and pathname of the sample #1] %Windir%\winlogon.exe	56,320 bytes	MD5: 0x6C161CF9AEFD577235547A0514EA7336 SHA-1: 0x909CD7E7417B8C4D4C18F58EA80A14F7965A0635

• Note:
• %Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.

Memory Modifications

• There were new processes created in the system:

Process Name	Process Filename	Main Module Size
winlogon.exe	%Windir%\winlogon.exe	94,208 bytes
[filename of the sample #1]	[file and pathname of the sample #1]	94,208 bytes

• The following system services were modified:

Service Name	Display Name	New Status	Service Filename
ALG	Application Layer Gateway Service	"Stopped"	%System%\alg.exe
SharedAccess	Windows Firewall/Internet Connection Sharing (ICS)	"Stopped"	%System%\svchost.exe -k netsvcs
wscsvc	Security Center	"Stopped"	%System%\svchost.exe -k netsvcs

• Notes:
• %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

Registry Modifications

• The following Registry Keys were created:
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\winlogon
• HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall
• HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile
• HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile

• The newly created Registry Values are:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
• runwinlogon = "%Windir%\winlogon.exe"

so that winlogon.exe runs every time Windows starts

• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\winlogon]
• del = ""
• [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]
• EnableFirewall = 0x00000000
• [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]
• EnableFirewall = 0x00000000
• [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop]
• id = "106783121065"
• host = "127.0.0.1"

• The following Registry Value was modified:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
• FirewallOverride = 0x00000001

Other details

• The following ports were open in the system:

• The following Host Names were requested from a host database:
• mail.hotmail.com
• mail.yahoo.com
• 209.20.130.33
• mail.google.com
• mail.mail.com
• 206.51.229.118