Submission Summary:

• Submission details:
• Submission received: 22 February 2009, 06:58:58
• Processing time: 5 min 45 sec
• Submitted sample:
• File MD5: 0x93D1E90733F8F936EF1F292F104389DA
• File SHA-1: 0xE18E9D48DC34E4245CC121175FA3E5EF516B79C1
• Filesize: 107,388 bytes
• Alias:
• Trojan-GameThief.Win32.Magania.avlc [Kaspersky Lab]
• PWS-Gamania.gen.g [McAfee]
• Worm:Win32/Taterf.B [Microsoft]
• PWS.Win32 [Ikarus]

• Summary of the findings:

What's been found	Severity Level
Downloads/requests other files from Internet.
Modifies some system settings that may have negative impact on overall system security state.
Creates a startup registry entry.

Technical Details:

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	c:\autorun.inf	123 bytes	MD5: 0x5417E1920811BC6757B94C61727E2107 SHA-1: 0xE6D01C3E8966A8EA3B581778B2B11ADABB04D87B	(not available)
2	c:\nt.com %System%\ierdfgh.exe [file and pathname of the sample #1]	107,388 bytes	MD5: 0x93D1E90733F8F936EF1F292F104389DA SHA-1: 0xE18E9D48DC34E4245CC121175FA3E5EF516B79C1	Trojan-GameThief.Win32.Magania.avlc [Kaspersky Lab] PWS-Gamania.gen.g [McAfee] Worm:Win32/Taterf.B [Microsoft] PWS.Win32 [Ikarus]
3	%System%\pytdfse0.dll %System%\pytdfse1.dll	87,040 bytes	MD5: 0x90386100D722A717F62348CD33F21192 SHA-1: 0xD092DBC6D8F1B7955F64FD9632F31B996760939D	Packed.Win32.Krap.g [Kaspersky Lab] PWS-Gamania.gen.g [McAfee] Trojan:Win32/Inhoo.A [Microsoft]

• Note:
• %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

Memory Modifications

• There were new processes created in the system:

Process Name	Process Filename	Main Module Size
ierdfgh.exe	%System%\ierdfgh.exe	258,048 bytes
[filename of the sample #1]	[file and pathname of the sample #1]	258,048 bytes

• The following module was loaded into the address space of other process(es):

Module Name	Module Filename	Address Space Details
pytdfse0.dll	%System%\pytdfse0.dll	Process name: explorer.exe Process filename: %Windir%\explorer.exe Address space: 0x1C40000 - 0x1C75000

• Notes:
• %Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.

Registry Modifications

• The newly created Registry Value is:
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
• kxswsoft = "%System%\ierdfgh.exe"

so that ierdfgh.exe runs every time Windows starts

• The following Registry Value was modified:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL]
• CheckedValue = 0x00000000

so that hidden files and folders are not displayed in explorer when browsing the file system

Other details

• The following Internet download was started (the retrieved bits are saved into the local file):

• Notes:
• %Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).