Submission Summary:

• Submission details:
• Submission received: 19 June 2009, 19:17:52
• Processing time: 6 min 11 sec
• Submitted sample:
• File MD5: 0x9D14254087C34DFBCE98E259683F0EA5
• File SHA-1: 0xED35E4B632DF42EA8BDE23B5A3C5536ACB85F99E
• Filesize: 101,526 bytes
• Alias:
• Mal/Frethog-B [Sophos]
• Worm:Win32/Taterf.B [Microsoft]
• Trojan.Win32.Inhoo [Ikarus]

• Summary of the findings:

What's been found	Severity Level
Sets the drive to autoplay by creating autorun.inf file in its root directory. If the drive is shared across the network then other remote computers can be infected any time they try to access this share.
Downloads/requests other files from Internet.
Modifies some system settings that may have negative impact on overall system security state.
Creates a startup registry entry.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! Characteristics of the following security risk was identified in the system:

Security Risk	Description
Worm.Autorun.AAYF	Worm.Autorun.AAYF is a threat that spread through removable drives and it can run in the background without the knowledge of the user.

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	c:\autorun.inf	63 bytes	MD5: 0x6C435662540156D781D4657822D701EA SHA-1: 0x1A910E14A1598D2D9FFD2676DC4A0E8C29E48637	(not available)
2	c:\l6w2eaih.exe [file and pathname of the sample #1] %System%\uret463.exe	101,526 bytes	MD5: 0x9D14254087C34DFBCE98E259683F0EA5 SHA-1: 0xED35E4B632DF42EA8BDE23B5A3C5536ACB85F99E	Mal/Frethog-B [Sophos] Worm:Win32/Taterf.B [Microsoft] Trojan.Win32.Inhoo [Ikarus]
3	%System%\lhgjyit0.dll %System%\lhgjyit1.dll %System%\lhgjyit2.dll	80,896 bytes	MD5: 0x002DE2CCB2A116B6DD954EDB2E7381F2 SHA-1: 0xFA1D99182976029E230DE489E8F788BEA303B613	Troj/Virtum-Gen [Sophos] TrojanDownloader:Win32/Small.gen!AA [Microsoft] Worm.Win32.Taterf [Ikarus]

• Note:
• %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

• The following file was deleted:
• %System%\drivers\cdaudio.sys

Memory Modifications

• There were new processes created in the system:

Process Name	Process Filename	Main Module Size
uret463.exe	%System%\uret463.exe	266,240 bytes
[filename of the sample #1]	[file and pathname of the sample #1]	266,240 bytes
iexplore.exe	%ProgramFiles%\Internet Explorer\iexplore.exe	102,400 bytes

• Notes:
• %ProgramFiles% is a variable that refers to the Program Files folder. A typical path is C:\Program Files.

• The following modules were loaded into the address space of other process(es):

Module Name	Module Filename	Address Space Details
lhgjyit2.dll	%System%\lhgjyit2.dll	Process name: explorer.exe Process filename: %Windir%\explorer.exe Address space: 0x21F0000 - 0x2228000
lhgjyit0.dll	%System%\lhgjyit0.dll	Process name: IEXPLORE.EXE Process filename: %ProgramFiles%\internet explorer\iexplore.exe Address space: 0x1B10000 - 0x1B48000

• Notes:
• %Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.

Registry Modifications

• The following Registry Keys were created:
• HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\AVPsys
• HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\AVPsys\Security
• HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\AVPsys\Enum
• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AVPsys
• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AVPsys\Security
• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AVPsys\Enum

• The newly created Registry Values are:
• [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\AVPsys\Enum]
• Count = 0x00000000
• NextInstance = 0x00000000
• INITSTARTFAILED = 0x00000001
• [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\AVPsys\Security]
• Security = 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 0
• [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\AVPsys]
• Type = 0x00000001
• Start = 0x00000003
• ErrorControl = 0x00000001
• ImagePath = "%System%\drivers\cdaudio.sys"
• DisplayName = "AVPsys"
• [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AVPsys\Enum]
• Count = 0x00000000
• NextInstance = 0x00000000
• INITSTARTFAILED = 0x00000001
• [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AVPsys\Security]
• Security = 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 0
• [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AVPsys]
• Type = 0x00000001
• Start = 0x00000003
• ErrorControl = 0x00000001
• ImagePath = "%System%\drivers\cdaudio.sys"
• DisplayName = "AVPsys"
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
• dorfgwe = "%System%\uret463.exe"

so that uret463.exe runs every time Windows starts

• The following Registry Value was modified:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL]
• CheckedValue = 0x00000000

so that hidden files and folders are not displayed in explorer when browsing the file system

Other details

• The following Internet download was started (the retrieved bits are saved into the local file):

• Notes:
• %Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).