Submission Summary:

• Submission details:
• Submission received: 16 October 2009, 07:18:10
• Processing time: 11 min 49 sec
• Submitted sample:
• File MD5: 0x958E5D61D6617806F649946E02FF04C8
• File SHA-1: 0x0B4A1D9843408DEB60C82E330DCB20AF1F919AA5
• Filesize: 43,520 bytes

• Summary of the findings:

What's been found	Severity Level
Downloads/requests other files from Internet.
Creates a startup registry entry.

Technical Details:

File System Modifications

• The following file was created in the system:

#	Filename(s)	File Size	File Hash
1	%AppData%\seres.exe %AppData%\svcst.exe [file and pathname of the sample #1]	43,520 bytes	MD5: 0x958E5D61D6617806F649946E02FF04C8 SHA-1: 0x0B4A1D9843408DEB60C82E330DCB20AF1F919AA5

• Note:
• %AppData% is a variable that refers to the file system directory that serves as a common repository for application-specific data. A typical path is C:\Documents and Settings\[UserName]\Application Data.

Memory Modifications

• There were new processes created in the system:

Process Name	Process Filename	Main Module Size
svcst.exe	%AppData%\svcst.exe	81,920 bytes
[filename of the sample #1]	[file and pathname of the sample #1]	81,920 bytes

Registry Modifications

• The following Registry Key was created:
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Associations

• The newly created Registry Values are:
• [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download]
• RunInvalidSignatures = 0x00000001
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Associations]
• LowRiskFileTypes = "zip;.rar;.cab;.txt;.exe;.reg;.msi;.htm;.html;.gif;.bmp;.jpg;.avi;.mov;.mp3;.wav"
• SaveZoneInformation = 0x00000001
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
• mserv = "%AppData%\seres.exe"
• svchost = "%AppData%\svcst.exe"

so that seres.exe runs every time Windows starts
so that svcst.exe runs every time Windows starts

Other details

• To mark the presence in the system, the following Mutex objects were created:
• {43789243789479324789327432}
• {vmc8743897vhdui754836csy76}

• The following Internet downloads were started (the retrieved bits are saved into the local file):

Downloaded File Summary:

• Download details:
• Download retrieved: 16 October 2009 07:30:00
• Processing time: 7 min 4 sec
• Downloaded sample:
• File MD5: 0x766A9559A11E6DB4E9EAA572A6511FEA
• File SHA-1: 0xC0469E88D9BA4ED87FF3BF71E4EDA15B45741B1A
• Filesize: 159,856 bytes

• Summary of the findings:

What's been found	Severity Level
Downloads/requests other files from Internet.

Technical Details:

File System Modifications

• The following file was created in the system:

• The following directory was created:
• %ProgramFiles%\AntivirusPro_2010

• Note:
• %ProgramFiles% is a variable that refers to the Program Files folder. A typical path is C:\Program Files.

Other details

• The following Internet downloads were started (the retrieved bits are saved into the local file):

• Notes:
• %Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).