Submission Summary:

• Submission details:
• Submission received: 18 July 2009, 04:49:15
• Processing time: 8 min 38 sec
• Submitted sample:
• File MD5: 0x79DAB0DEC01A0B13991BDBC888EF6335
• File SHA-1: 0x23346B62C59EBE6FFDE474987AEA921404D84D77
• Filesize: 3,202,048 bytes
• Alias & packer info:
• Spyware.Perfect [Symantec]
• Trojan-Banker.Win32.Banker.etk [Kaspersky Lab]
• Mal/DelpBanc-A, Mal/Banspy-F, Mal/Behav-249, Mal/Banspy-I [Sophos]
• Trojan-Banker.Win32.Banker [Ikarus]
• packed with: ASPack [Kaspersky Lab]

• Summary of the findings:

What's been found	Severity Level
Creates a startup registry entry.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! The following threat categories were identified:

Threat Category	Description
	A spyware program that represents security risk for a local system
	A code with the rootkit-specific techniques designed to hide the software presence in the system

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%System%\avg.exe [file and pathname of the sample #1]	3,202,048 bytes	MD5: 0x79DAB0DEC01A0B13991BDBC888EF6335 SHA-1: 0x23346B62C59EBE6FFDE474987AEA921404D84D77	Spyware.Perfect [Symantec] Trojan-Banker.Win32.Banker.etk [Kaspersky Lab] Mal/DelpBanc-A, Mal/Banspy-F, Mal/Behav-249, Mal/Banspy-I [Sophos] Trojan-Banker.Win32.Banker [Ikarus] packed with ASPack [Kaspersky Lab]
2	%System%\TS45.SYS	7,168 bytes	MD5: 0xABA452FD10F74AABCAC36B579046EDE8 SHA-1: 0x2005C6BC6AD5A6807D2F5F56D842B0013351F18B	Rootkit.Win32.Banker.b [Kaspersky Lab] Mal/Generic-A [Sophos] Rootkit.Win32.Banker.b [Ikarus]

• Note:
• %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

Memory Modifications

• There were new processes created in the system:

Process Name	Process Filename	Main Module Size
[filename of the sample #1]	[file and pathname of the sample #1]	28,385,280 bytes
avg.exe	%System%\avg.exe	28,385,280 bytes

• There was a new kernel-mode driver installed in the system:

Driver Name	Driver Filename
Driver	%System%\TS45.sys

Registry Modifications

• The following Registry Keys were created:
• HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\TS45
• HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\TS45\Security
• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TS45
• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TS45\Security
• HKEY_CURRENT_USER\avg

• The newly created Registry Values are:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
• EnableLUA = 0x00000000
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
• (Default) = "%System%\avg.exe"

so that avg.exe runs every time Windows starts

• [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\TS45\Security]
• Security = 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 0
• [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\TS45]
• Type = 0x00000001
• Start = 0x00000001
• ErrorControl = 0x00000001
• ImagePath = "%System%\TS45.sys"
• DisplayName = "Driver"
• [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TS45\Security]
• Security = 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 0
• [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TS45]
• Type = 0x00000001
• Start = 0x00000001
• ErrorControl = 0x00000001
• ImagePath = "%System%\TS45.sys"
• DisplayName = "Driver"

Other details

• Analysis of the file resources indicate the following possible country of origin:

	Brazil

• The following Host Name was requested from a host database:
• www.videopb.net