Submission Summary:

• Submission details:
• Submission received: 23 September 2012, 08:08:58
• Processing time: 9 min 2 sec
• Submitted sample:
• File MD5: 0xA4E6EB9E2CDDEC13957FCCF903AF9154
• File SHA-1: 0x2CE79B0E1D16B33D3F2668A053A0F4A7DC563652
• Filesize: 618,496 bytes
• Alias: Trojan:Win32/Klovbot.B [Microsoft]

• Summary of the findings:

What's been found	Severity Level
Creates a startup registry entry.

Technical Details:

File System Modifications

• The following file was created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%AppData%\svchost.exe [file and pathname of the sample #1]	618,496 bytes	MD5: 0xA4E6EB9E2CDDEC13957FCCF903AF9154 SHA-1: 0x2CE79B0E1D16B33D3F2668A053A0F4A7DC563652	Trojan:Win32/Klovbot.B [Microsoft]

• Note:
• %AppData% is a variable that refers to the file system directory that serves as a common repository for application-specific data. A typical path is C:\Documents and Settings\[UserName]\Application Data.

Memory Modifications

• There was a new process created in the system:

Registry Modifications

• The newly created Registry Value is:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
• Google Inc = "%AppData%\svchost.exe"

so that svchost.exe runs every time Windows starts

Other details

• Analysis of the file resources indicate the following possible country of origin:

	United Kingdom

• To mark the presence in the system, the following Mutex object was created:
• BYVOLK