Submission Summary:

• Submission details:
• Submission received: 6 January 2008, 15:37:30
• Processing time: 3 min 9 sec
• Submitted sample:
• File MD5: 0xC5B56FB0B0B6CC32F984A33D2C65164E
• Filesize: 182,784 bytes
• Alias:
• Bloodhound.Unknown [Symantec]
• not-a-virus:Downloader.Win32.WinFixer.au [Kaspersky Lab]

• Summary of the findings:

What's been found	Severity Level
Downloads/requests other files from Internet.
Creates a startup registry entry.
Contains characteristics of an identified security risk.

Technical Details:

• The new window was created, as shown below:

Possible Security Risk

• Attention! Characteristics of the following security risk was identified in the system:

Security Risk	Description
RogueAntiSpyware.AVSystemCare	RogueAntiSpyware.AVSystemCare is a Rogue Anti-Spyware product which comes bundled along with a malicious downloader. It is downloaded and installed without the users consent.

• Attention! The following threat category was identified:

Threat Category	Description
	A program that downloads files to the local computer that may represent security risk

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%DesktopDir%\Installeer AntiVirusScherm .lnk	1,600 bytes	MD5: 0xBEA8E59043D617B1529998F5295E0243	(not available)
2	%Temp%\NI.UGA6PM_0001_N122M3010\settings.ini	23 bytes	MD5: 0xD29A41779C93E3C4D17209A0A45C1262	(not available)
3	[file and pathname of the sample #1]	182,784 bytes	MD5: 0xC5B56FB0B0B6CC32F984A33D2C65164E	Bloodhound.Unknown [Symantec] not-a-virus:Downloader.Win32.WinFixer.au [Kaspersky Lab]

• Notes:
• %DesktopDir% is a variable that refers to the file system directory used to physically store file objects on the desktop. A typical path is C:\Documents and Settings\[UserName]\Desktop.
• %Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).

• The following directory was created:
• %Temp%\NI.UGA6PM_0001_N122M3010

Memory Modifications

• There was a new process created in the system:

Registry Modifications

• The following Registry Key was created:
• HKEY_LOCAL_MACHINE\SOFTWARE\AntivirusScherm

• The newly created Registry Values are:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
• NI.UGA6PM_0001_N122M3010 = ""[file and pathname of the sample #1]""

so that [file and pathname of the sample #1] runs every time Windows starts

• [HKEY_LOCAL_MACHINE\SOFTWARE\AntivirusScherm]
• EulaUGA6PM_0001_N122M3010 = 0x00000001

Other details

• To mark the presence in the system, the following Mutex objects were created:
• UGA6PMInstallerMutex
• 83609468248B40A8A3DC1E40B3893D60UGA6PM_0001_N122M3010

• The following ports were open in the system:

• The following Host Name was requested from a host database:
• arettich.antivirusscherm.com

• The following Internet Connections were established: