Submission Summary:

• Submission details:
• Submission received: 23 January 2010, 17:42:58
• Processing time: 6 min 46 sec
• Submitted sample:
• File MD5: 0xBB97CF958F1D383E1316A0DB06202E22
• File SHA-1: 0x7429A0B46B5C3D9763C4B1B88E76307A3046678B
• Filesize: 434,176 bytes
• Alias:
• Generic.dx [McAfee]
• possible-Threat.Riskware.Ultrasurf [Ikarus]

• Summary of the findings:

What's been found	Severity Level
Produces outbound traffic.

Technical Details:

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%Temp%\Dgpphpgl	18 bytes	MD5: 0x080AADBB29F59AD76027D1AA53AE8F14 SHA-1: 0xB4B12854D0A3BFEBF3317A88EE6DB4E06391D534	(not available)
2	[file and pathname of the sample #1]	434,176 bytes	MD5: 0xBB97CF958F1D383E1316A0DB06202E22 SHA-1: 0x7429A0B46B5C3D9763C4B1B88E76307A3046678B	Generic.dx [McAfee] possible-Threat.Riskware.Ultrasurf [Ikarus]

• Note:
• %Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).

Memory Modifications

• There was a new process created in the system:

Registry Modifications

• The newly created Registry Values are:
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
• Lwzihkjv = 0x00000617
• ProxyServer = "127.0.0.1:9666"
• ProxyOverride = "local"
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3]
• CurrentLevel = 00 00 00 00
• 1C00 = 00 00 00 00

• The following Registry Value was deleted:
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3]
• CurrentLevel = 0x00000000
• 1C00 = 0x00010000

• The following Registry Values were modified:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\8B24CD8D8B58C6DA72ACE097C7B1E3CEA4DC3DC6]
• Blob =
• [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
• ProxyEnable =
• [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Hardware Profiles\Current\Software\Microsoft\windows\CurrentVersion\Internet Settings]
• ProxyEnable =
• [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
• ProxyEnable =
• [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Hardware Profiles\Current\Software\Microsoft\windows\CurrentVersion\Internet Settings]
• ProxyEnable =
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
• ProxyEnable =

Other details

• Analysis of the file resources indicate the following possible country of origin:

	China

• The following ports were open in the system:

• There were registered attempts to establish connection with the remote hosts. The connection details are:

Outbound traffic (potentially malicious)

• There was an outbound traffic produced on port 443: