Submission Summary:

• Submission details:
• Submission received: 16 February 2008, 02:00:31
• Processing time: 3 min 12 sec
• Submitted sample:
• File MD5: 0x938AFD4B705D5077E8930CE15FCDC8C9
• Filesize: 159,264 bytes
• Alias:
• Adware.DL.Winfixer.O [PCTools]
• not-a-virus:Downloader.Win32.WinFixer.z [Kaspersky Lab]

• Summary of the findings:

What's been found	Severity Level
Downloads/requests other files from Internet.
Creates a startup registry entry.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! Characteristics of the following security risks were identified in the system:

Security Risk	Description
RogueAntiSpyware.PCPrivacyTool	RogueAntiSpyware.PCPrivacyTool a Rogue Anti-Spyware product which downloaded and installed without the users consent.
Adware.LeosrvBar	Adware.LeosrvBar normally arrives on a system as a downloaded component of another malware. It is registered as a browser toolbar and attempts to persuade users into buying rogue antispyware products.

• Attention! The following threat category was identified:

Threat Category	Description
	A program that downloads files to the local computer that may represent security risk

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%DesktopDir%\Install PCPrivacyTool .lnk	1,616 bytes	MD5: 0x1FBDAB1694FAE4D598CB881B83C0293C	(not available)
2	%Temp%\NI.GDC_0001_N111C1909\settings.ini	40 bytes	MD5: 0xDF6B2C8F3F30F57B25A6EA04931A0937	(not available)
3	[file and pathname of the sample #1]	159,264 bytes	MD5: 0x938AFD4B705D5077E8930CE15FCDC8C9	Adware.DL.Winfixer.O [PCTools] not-a-virus:Downloader.Win32.WinFixer.z [Kaspersky Lab]

• Notes:
• %DesktopDir% is a variable that refers to the file system directory used to physically store file objects on the desktop. A typical path is C:\Documents and Settings\[UserName]\Desktop.
• %Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).

• The following directory was created:
• %Temp%\NI.GDC_0001_N111C1909

Memory Modifications

• There was a new process created in the system:

Registry Modifications

• The following Registry Key was created:
• HKEY_LOCAL_MACHINE\SOFTWARE\PCPrivacyTool

• The newly created Registry Values are:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
• NI.GDC_0001_N111C1909 = ""[file and pathname of the sample #1]" -nag "

so that [file and pathname of the sample #1] runs every time Windows starts

• [HKEY_LOCAL_MACHINE\SOFTWARE\PCPrivacyTool]
• EulGDC_0001_N111C1909 = 0x00000001

Other details

• Analysis of the file resources indicate the following possible country of origin:

	Russian Federation

• To mark the presence in the system, the following Mutex objects were created:
• GDCInstallerMutex
• 83609468248B40A8A3DC1E40B3893D60GDC_0001_N111C1909

• The following Host Name was requested from a host database:
• ilp.pcprivacytool.com

• The following Internet Connections were established: