Submission Summary:

• Submission details:
• Submission received: 1 May 2009, 07:35:09
• Processing time: 6 min 7 sec
• Submitted sample:
• File MD5: 0xBBE3924E01FB0BCB83B0D16CBA8C8710
• File SHA-1: 0x518DC00788C639600BD35FD13C03F121A82146BC
• Filesize: 110,592 bytes
• Alias:
• Trojan Horse [Symantec]
• Generic.dx [McAfee]
• Mal/Behav-035 [Sophos]
• Virus.Win32.AutoRun [Ikarus]

• Summary of the findings:

What's been found	Severity Level
Capability to block access to several security-related Web sites by modifying the hosts file.
Sets the drive to autoplay by creating autorun.inf file in its root directory. If the drive is shared across the network then other remote computers can be infected any time they try to access this share.
Hosts file modification that may block access to the security web sites.
Creates a startup registry entry.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! Characteristics of the following security risks were identified in the system:

Security Risk	Description
Backdoor.Bifrose	Backdoor.Bifrose is a backdoor trojan that attempts to propagate by exploiting local network shares. It will also attempt to join a predefined IRC server and channel in order to participate in DDoS attacks.
Adware.Component.Unrelated	These common components have files and keys that are in different threats but the threats are not related to one another in that the author of the signature is not the same. It is recommended that all these entries be removed.

• Attention! The following threat category was identified:

Threat Category	Description
	A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	c:\autorun.inf	176 bytes	MD5: 0x95AD5E8036A83FF920CD9308FE42AEA8 SHA-1: 0x9AD4E0E778A63DFDF11A0E335CA836FF195D6838	W32/Autokx.worm [McAfee]
2	c:\Mi Musica.exe c:\Mis Documentos.exe c:\Mis Fotos.exe c:\Mis Imagenes.exe	110,592 bytes	MD5: 0xC36BB11E85925238FCF36F7DBC3C71B8 SHA-1: 0x2B1BBC2F32CBEC424F12142A4AAF1D3F9383F5F9	(not available)
3	c:\svchost.exe %Windir%\regedit\svchost.exe %Windir%\system.exe [file and pathname of the sample #1]	110,592 bytes	MD5: 0xBBE3924E01FB0BCB83B0D16CBA8C8710 SHA-1: 0x518DC00788C639600BD35FD13C03F121A82146BC	Trojan Horse [Symantec] Generic.dx [McAfee] Mal/Behav-035 [Sophos] Virus.Win32.AutoRun [Ikarus]

• Note:
• %Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.

• The following file was modified:
• %System%\drivers\etc\hosts

• Notes:
• %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

• The following directory was created:
• %Windir%\regedit

Memory Modifications

• There were new processes created in the system:

Process Name	Process Filename	Main Module Size
system.exe	%Windir%\system.exe	110,592 bytes
[filename of the sample #1]	[file and pathname of the sample #1]	110,592 bytes

Registry Modifications

• The newly created Registry Value is:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
• Svchost = "%Windir%\regedit\svchost.exe"

so that svchost.exe runs every time Windows starts

Other details

• Analysis of the file resources indicate the following possible country of origin:

	Spain

• The HOSTS file was updated with the following URL-to-IP mappings: