Submission Summary:

• Submission details:
• Submission received: 22 June 2009, 18:15:21
• Processing time: 7 min 28 sec
• Submitted sample:
• File MD5: 0x9D247408D6186E88B1C0856AC0415185
• File SHA-1: 0x754A062446937710DAAAF9928ED4ABA525026CE3
• Filesize: 39,936 bytes

• Summary of the findings:

What's been found	Severity Level
Downloads/requests other files from Internet.
Creates a startup registry entry.

Technical Details:

• The new window was created, as shown below:

File System Modifications

• The following file was created in the system:

Registry Modifications

• The following Registry Key was created:
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce

• The newly created Registry Value is:
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce]
• IAPRO = ""[file and pathname of the sample #1]" 0;B;"

so that [file and pathname of the sample #1] runs every time Windows starts

Other details

• To mark the presence in the system, the following Mutex object was created:
• IAPRO

• The data identified by the following URLs was then requested from the remote web server:
• http://ina4iv.com/download/InternetAntivirusPro.exe
• http://ina4iv.com/download/file.exe
• http://xoomer.alice.it/irbray/InternetAntivirusPro.exe
• http://xoomer.alice.it/irbray/file.exe

Downloaded File Summary:

• Download details:
• Download retrieved: 22 June 2009 18:22:53
• Processing time: 8 min 9 sec
• Downloaded sample #1:
• File MD5: 0xD235F7B1741F045D765009FBF0998A6E
• File SHA-1: 0xE659FF238F2CA5606AC4FAECBF864A4BEC173B44
• Filesize: 2,243,774 bytes
• Downloaded sample #2:
• File MD5: 0x723D521E52E471E7E161DB180D924BE0
• File SHA-1: 0x290782344BE270192BE0BB46FB15F67F20A9AED8
• Filesize: 30,208 bytes
• Downloaded sample #3:
• File MD5: 0xD0529FC533BA22A63F97A14D28DE5BB5
• File SHA-1: 0x2E376A5225D309804420DEDECBC86C72DC2A2F10
• Filesize: 2,214,033 bytes
• Alias:
• InternetAntivirus [Symantec]
• not-a-virus:FraudTool.Win32.InternetAntivirusPro.l [Kaspersky Lab]
• Mal/FakeAV-M [Sophos]
• Trojan:Win32/InternetAntivirus [Microsoft]
• not-a-virus:FraudTool.Win32.InternetAntivirusPro [Ikarus]
• Downloaded sample #4:
• File MD5: 0xC58A98B33E9F37B34B3EF470D66F0A24
• File SHA-1: 0x455E1DA8A1EC060CB4A08EF1E06C11F2BEFBEA95
• Filesize: 28,672 bytes
• Alias:
• Trojan.TDSS!sd6 [PCTools]
• Downloader [Symantec]
• Trojan.Win32.TDSS.abzw [Kaspersky Lab]
• Generic FakeAlert.k [McAfee]
• Mal/TDSSPack-L, Mal/TDSSPack-K [Sophos]
• Win-Trojan/Xema.variant [AhnLab]

• Summary of the findings:

What's been found	Severity Level
Creates a startup registry entry.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! Characteristics of the following security risks were identified in the system:

Security Risk	Description
Trojan.TDSS!sd6	Trojan.TDSS!sd6 is a malicious program that does not infect other files but may represents security risk for your computer and/or network environment.
Trojan-Spy.Chadem	Trojan-Spy.Chadem is a trojan that can steal user's information on infected machine.

• Attention! The following threat categories were identified:

Threat Category	Description
	A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment
	A program that downloads files to the local computer that may represent security risk

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%AppData%\Microsoft\Windows\winlogon.exe [file and pathname of the sample #4]	28,672 bytes	MD5: 0xC58A98B33E9F37B34B3EF470D66F0A24 SHA-1: 0x455E1DA8A1EC060CB4A08EF1E06C11F2BEFBEA95	Trojan.TDSS!sd6 [PCTools] Downloader [Symantec] Trojan.Win32.TDSS.abzw [Kaspersky Lab] Generic FakeAlert.k [McAfee] Mal/TDSSPack-L, Mal/TDSSPack-K [Sophos] Win-Trojan/Xema.variant [AhnLab]
2	[file and pathname of the sample #1]	2,243,774 bytes	MD5: 0xD235F7B1741F045D765009FBF0998A6E SHA-1: 0xE659FF238F2CA5606AC4FAECBF864A4BEC173B44	(not available)
3	[file and pathname of the sample #2]	30,208 bytes	MD5: 0x723D521E52E471E7E161DB180D924BE0 SHA-1: 0x290782344BE270192BE0BB46FB15F67F20A9AED8	(not available)
4	[file and pathname of the sample #3]	2,214,033 bytes	MD5: 0xD0529FC533BA22A63F97A14D28DE5BB5 SHA-1: 0x2E376A5225D309804420DEDECBC86C72DC2A2F10	InternetAntivirus [Symantec] not-a-virus:FraudTool.Win32.InternetAntivirusPro.l [Kaspersky Lab] Mal/FakeAV-M [Sophos] Trojan:Win32/InternetAntivirus [Microsoft] not-a-virus:FraudTool.Win32.InternetAntivirusPro [Ikarus]

• Note:
• %AppData% is a variable that refers to the file system directory that serves as a common repository for application-specific data. A typical path is C:\Documents and Settings\[UserName]\Application Data.

Memory Modifications

• There were new processes created in the system:

Process Name	Process Filename	Main Module Size
[filename of the sample #1 without extension].tmp	%Temp%\is-UBK6N.tmp\[filename of the sample #1 without extension].tmp	815,104 bytes
[filename of the sample #4]	[file and pathname of the sample #4]	163,840 bytes
[filename of the sample #3 without extension].tmp	%Temp%\is-03C74.tmp\[filename of the sample #3 without extension].tmp	802,816 bytes
[filename of the sample #3]	[file and pathname of the sample #3]	139,264 bytes
[filename of the sample #2]	[file and pathname of the sample #2]	167,936 bytes
winlogon.exe	%AppData%\Microsoft\Windows\winlogon.exe	163,840 bytes
[filename of the sample #1]	[file and pathname of the sample #1]	151,552 bytes

• Notes:
• %Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).

Registry Modifications

• The newly created Registry Value is:
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
• Microsoft Windows logon process = "%AppData%\Microsoft\Windows\winlogon.exe"

so that winlogon.exe runs every time Windows starts