Submission Summary:

• Submission details:
• Submission received: 19 November 2010, 07:30:58
• Processing time: 11 min 19 sec
• Submitted sample:
• File MD5: 0xBA2D1C78C4B3B3FC35770749E9AD5F86
• File SHA-1: 0x888BA69F247886D09274BF4833E17B5E302A607D
• Filesize: 111,104 bytes

• Summary of the findings:

What's been found	Severity Level
Produces outbound traffic.
Downloads/requests other files from Internet.

Technical Details:

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%ProgramFiles%\Microsoft\WaterMark.exe	225,131 bytes	MD5: 0x1630012AFBA2A5A059DB7314C8C8EB8D SHA-1: 0xF5E815C3788A48EE1B9EAC206B01D60C0B335030	W32.Ramnit.B!inf [Symantec] W32/NGVCK [McAfee] Virus:Win32/Ramnit.I [Microsoft] Win32/Ramnit [AhnLab]
2	%System%\dmlconf.dat	16 bytes	MD5: 0x7501E23DD144D8D8E67D3D0C36860567 SHA-1: 0x0E3364EA16D82BAE3135D01827979809689701F1	(not available)
3	[file and pathname of the sample #1]	111,104 bytes	MD5: 0xBA2D1C78C4B3B3FC35770749E9AD5F86 SHA-1: 0x888BA69F247886D09274BF4833E17B5E302A607D	(not available)

• Notes:
• %ProgramFiles% is a variable that refers to the Program Files folder. A typical path is C:\Program Files.
• %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

• The following files were modified:
• c:\contacts.html
• c:\Inetpub\wwwroot\index.html
• %ProgramFiles%\Common Files\designer\MSADDNDR.DLL
• %ProgramFiles%\Common Files\designer\MSHTMPGD.DLL
• %ProgramFiles%\Common Files\designer\MSHTMPGR.DLL
• [pathname with a string SHARE]\Blank.htm
• [pathname with a string SHARE]\Citrus Punch.htm
• [pathname with a string SHARE]\Clear Day.htm
• [pathname with a string SHARE]\Fiesta.htm
• [pathname with a string SHARE]\Glacier.htm
• [pathname with a string SHARE]\Ivy.htm
• [pathname with a string SHARE]\Leaves.htm
• [pathname with a string SHARE]\Maize.htm
• [pathname with a string SHARE]\Nature.htm
• [pathname with a string SHARE]\Network Blitz.htm
• [pathname with a string SHARE]\Pie Charts.htm
• [pathname with a string SHARE]\Sunflower.htm
• [pathname with a string SHARE]\Sweets.htm
• [pathname with a string SHARE]\Technical.htm
• %ProgramFiles%\Common Files\System\ado\MDACReadme.htm
• %ProgramFiles%\Common Files\System\Ole DB\MSDAIPP.DLL
• %ProgramFiles%\MSN\MSNCoreFiles\OOBE\obelog.dll
• %ProgramFiles%\MSN\MSNCoreFiles\OOBE\obemetal.dll
• %ProgramFiles%\MSN\MSNCoreFiles\OOBE\obepopc.dll
• %ProgramFiles%\MSN\MSNIA\custdial.dll
• %ProgramFiles%\MSN\MSNIA\msniasvc.exe
• %ProgramFiles%\MSN\MSNIA\prestp.exe
• %ProgramFiles%\MSN\MsnInstaller\iasvcstb.dll
• %ProgramFiles%\MSN\MsnInstaller\msdbxi.dll
• %ProgramFiles%\MSN\MsnInstaller\msninst.dll
• %ProgramFiles%\MSN\MsnInstaller\msninst.exe
• %ProgramFiles%\MSN\MsnInstaller\msnsign.dll
• %ProgramFiles%\NetMeeting\netmeet.htm

• The following directory was created:
• %ProgramFiles%\Microsoft

Memory Modifications

• There were new memory pages created in the address space of the system process(es):

Process Name	Process Filename	Allocated Size
services.exe	%System%\services.exe	36,864 bytes
lsass.exe	%System%\lsass.exe	36,864 bytes
svchost.exe	%System%\svchost.exe	36,864 bytes
svchost.exe	%System%\svchost.exe	36,864 bytes
svchost.exe	%System%\svchost.exe	53,248 bytes
svchost.exe	%System%\svchost.exe	36,864 bytes

Registry Modifications

• The following Registry Value was modified:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
• Userinit =

Other details

• There were registered attempts to establish connection with the remote hosts. The connection details are:

• The data identified by the following URL was then requested from the remote web server:
• http://www.google.com/pack/download/Google_Updater?hl=ru&srchcb=on&forcesrch=on&hpdisp=on&hpcb=on&stub=on&ciNum=0&file=Google_Updater.exe

Outbound traffic (potentially malicious)

• There was an outbound traffic produced on port 443: