Submission Summary:

• Submission details:
• Submission received: 14 March 2009, 05:54:07
• Processing time: 11 min 9 sec
• Submitted sample:
• File MD5: 0x8DA6BE70C72786B775852D6434C77964
• File SHA-1: 0x028F820969EE929813960EAB9B2C2636A0440260
• Filesize: 49,152 bytes
• Alias:
• Packed.Win32.Krap.i [Kaspersky Lab]
• Spam-Mailbot.h.gen.a [McAfee]
• Spammer:Win32/Tedroo.I [Microsoft]
• Packed.Win32.Krap [Ikarus]

• Summary of the findings:

What's been found	Severity Level
Capability to send out email message(s) with the built-in SMTP client engine.
Contains characteristics a SPAM bot, backdoor trojan, and a rootkit. The backdoor component allows the remote hacker to download/install additional components and instruct the bot to launch massive SPAM attacks from the compromised system.
Creates a startup registry entry.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! Characteristics of the following security risk was identified in the system:

Security Risk	Description
Adware.Component.Unrelated	These common components have files and keys that are in different threats but the threats are not related to one another in that the author of the signature is not the same. It is recommended that all these entries be removed.

• Attention! The following threat category was identified:

Threat Category	Description
	A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment

File System Modifications

• The following file was created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%Windir%\services.exe [file and pathname of the sample #1]	49,152 bytes	MD5: 0x8DA6BE70C72786B775852D6434C77964 SHA-1: 0x028F820969EE929813960EAB9B2C2636A0440260	Packed.Win32.Krap.i [Kaspersky Lab] Spam-Mailbot.h.gen.a [McAfee] Spammer:Win32/Tedroo.I [Microsoft] Packed.Win32.Krap [Ikarus]

• Note:
• %Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.

Memory Modifications

• There were new processes created in the system:

Process Name	Process Filename	Main Module Size
services.exe	%Windir%\services.exe	11,554,816 bytes
[filename of the sample #1]	[file and pathname of the sample #1]	11,554,816 bytes

• The following system services were modified:

Service Name	Display Name	New Status	Service Filename
ALG	Application Layer Gateway Service	"Stopped"	%System%\alg.exe
SharedAccess	Windows Firewall/Internet Connection Sharing (ICS)	"Stopped"	%System%\svchost.exe -k netsvcs
wscsvc	Security Center	"Stopped"	%System%\svchost.exe -k netsvcs

• Notes:
• %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

Registry Modifications

• The following Registry Keys were created:
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\services
• HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall
• HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile
• HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile

• The newly created Registry Values are:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
• services = "%Windir%\services.exe"

so that services.exe runs every time Windows starts

• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\services]
• del = ""
• [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]
• EnableFirewall = 0x00000000
• [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]
• EnableFirewall = 0x00000000
• [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop]
• id = "278433610050"
• host = "127.0.0.1"

• The following Registry Value was modified:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
• FirewallOverride = 0x00000001

Other details

• The following ports were open in the system:

• The following Host Names were requested from a host database:
• 206.137.17.89
• mail.hotmail.com
• mail.yahoo.com
• 209.20.130.33
• mail.google.com
• mail.mail.com
• 66.96.248.21