Submission Summary:

• Submission details:
• Submission received: 28 May 2008, 17:33:51
• Processing time: 3 min 27 sec
• Submitted sample:
• File MD5: 0xAE3648117F3854EE308D2F1F8BF32B9C
• File SHA-1: 0xC00AC667082659CB122B4112A0CFAF879690B2BA
• Filesize: 461,080 bytes
• Alias:
• RogueAntiSpyware.AntiSpywareMaster [PCTools]
• Winfixer [McAfee]

• Summary of the findings:

What's been found	Severity Level
Downloads/requests other files from Internet.
Creates a startup registry entry.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! Characteristics of the following security risk was identified in the system:

Security Risk	Description
RogueAntiSpyware.AntiSpywareMaster	RogueAntiSpyware.AntiSpywareMaster is an unwanted rogue application which comes bundled along with a malicious downloader. It is downloaded and installed without the users consent.

• Attention! The following threat category was identified:

Threat Category	Description
	A spyware program that represents security risk for a local system

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%CommonPrograms%\AntiSpywareMaster\AntiSpywareMaster.lnk	692 bytes	MD5: 0x290D2761171A7BEC079A85544377F204 SHA-1: 0x964CCEE22134E78B6C3D2C0115562973F23F51BC	(not available)
2	%CommonPrograms%\AntiSpywareMaster\Uninstall AntiSpywareMaster.lnk	714 bytes	MD5: 0x3514B73B01F1790699443C4987049646 SHA-1: 0x9273EF9F8AD8380785B6A83FC4B51D20FCBB3740	(not available)
3	%DesktopDir%\AntiSpywareMaster.lnk	680 bytes	MD5: 0x2F5D0D309F4F30F77E00387536C1A110 SHA-1: 0x19B35B40105CE05DB720982B9322D8146BEF4FED	(not available)
4	%ProgramFiles%\AntiSpywareMaster\asm.exe [file and pathname of the sample #1]	461,080 bytes	MD5: 0xAE3648117F3854EE308D2F1F8BF32B9C SHA-1: 0xC00AC667082659CB122B4112A0CFAF879690B2BA	RogueAntiSpyware.AntiSpywareMaster [PCTools] Winfixer [McAfee]

• Notes:
• %CommonPrograms% is a variable that refers to the file system directory that contains the directories for the common program groups that appear on the Start menu for all users. A typical path is C:\Documents and Settings\All Users\Start Menu\Programs (Windows NT/2000/XP).
• %DesktopDir% is a variable that refers to the file system directory used to physically store file objects on the desktop. A typical path is C:\Documents and Settings\[UserName]\Desktop.
• %ProgramFiles% is a variable that refers to the Program Files folder. A typical path is C:\Program Files.

• The following directories were created:
• %CommonPrograms%\AntiSpywareMaster
• %ProgramFiles%\AntiSpywareMaster

Memory Modifications

• There were new processes created in the system:

Process Name	Process Filename	Main Module Size
asm.exe	%ProgramFiles%\AntiSpywareMaster\asm.exe	1,495,040 bytes
[filename of the sample #1]	[file and pathname of the sample #1]	1,495,040 bytes

Registry Modifications

• The following Registry Key was created:
• HKEY_CURRENT_USER\Software\AntiSpywareMaster

• The newly created Registry Values are:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
• AntiSpywareMaster = "%ProgramFiles%\AntiSpywareMaster\asm.exe"

so that asm.exe runs every time Windows starts

• [HKEY_CURRENT_USER\Software\AntiSpywareMaster]
• InstallDate = D8 07 01 00 01 00 07 00 0F 00 0E 00 3B 00 67 01
• InfectionCount = 01 00 00 00
• LastScanTime = D8 07 01 00 01 00 07 00 0F 00 10 00 1E 00 EA 00
• TotalScanCount = 02 00 00 00

Other details

• To mark the presence in the system, the following Mutex object was created:
• AntiSpywareMaster8E0C904E-85D5-4fd8-9473-D173D4D31A9F

• The following Internet Connection was established: