Submission Summary:

• Submission details:
• Submission received: 14 October 2009, 02:49:04
• Processing time: 6 min 42 sec
• Submitted sample:
• File MD5: 0xC7573658EB7BA865E43A1B389D752139
• File SHA-1: 0xF2DA53DFE7A313C81E83BC87F660EB3DFCD0018D
• Filesize: 3,397,512 bytes

• Summary of the findings:

What's been found	Severity Level
Downloads/requests other files from Internet.

Technical Details:

• The new window was created, as shown below:

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%Temp%\AnvirHook61.dll	102,112 bytes	MD5: 0x745F345E4AEC8A1C7ABC109C2B4910B4 SHA-1: 0x3BEC4BC0457A6BC95030D235095F8DD1A55FD3A6	(not available)
2	%Temp%\AnVirSet.exe	3,102,944 bytes	MD5: 0xC9856A7FA939F253DB6572239FD878A6 SHA-1: 0x68B31E4451E1DA1778787DD0E196F72F5110B11A	packed with PE_Patch [Kaspersky Lab]
3	%Temp%\anvir_en.txt	40,285 bytes	MD5: 0x3BB0C3D96716BCAD417CC086A8866A91 SHA-1: 0xA0E13C93FEDED2353DE94936FAA9E14AAEA9556A	(not available)
4	%Temp%\DealioToolbar-stub-1.exe	381,892 bytes	MD5: 0x2853EEF5151FC42EFF1C6303EF14AE33 SHA-1: 0x23C15C61EBAC5159854C0E2FD2F25B5699BA49DE	(not available)
5	%Temp%\portable.txt	3,856 bytes	MD5: 0xCBE3D467506691F319D7C1964C2AB7D5 SHA-1: 0xE6D6DE32C17FB85B1A9979C90108CF8FDEA837F6	(not available)
6	%Temp%\tweaker.exe	746,720 bytes	MD5: 0x29E9C9F647D69845C70625F20B760B75 SHA-1: 0xFCB56682EC78856882A9D5F9489869F675AF5172	packed with PE_Patch.UPX [Kaspersky Lab]
7	%Temp%\tweaker.log	110 bytes	MD5: 0xA16C5F0B04EAE76CD7A48BE4D590ACF2 SHA-1: 0x2FB045B8097910CBFDF624D89C6A856C5B83B1E3	(not available)
8	%Temp%\tweaker_en.lng	32,636 bytes	MD5: 0x9E2C1405280817F750B1DCBD02AD14A6 SHA-1: 0x05BF9495E4B337BD9E753FAD20A9A57E6C5FEC0C	(not available)
9	%Temp%\tweaker_it.lng	36,020 bytes	MD5: 0xC76315D23C69F6B5A6BAA5712FA68A47 SHA-1: 0x5BFACE695D57B7C2DCBF58977933869F970C45D5	(not available)
10	%Temp%\tweaker_ja.lng	32,650 bytes	MD5: 0x9D9C124A0F3BCD3229B99932B373B830 SHA-1: 0x9A94BAE7E33BDF74A91D5AF819AB1C76A4AD3B69	(not available)
11	%Temp%\tweaker_ko.lng	31,283 bytes	MD5: 0x20615D3D5CA1FC230FD7160BBB2AEED3 SHA-1: 0x17F45851EA50F6437260E36A80D813868CAE97F8	(not available)
12	%Temp%\tweaker_license.txt	18,349 bytes	MD5: 0xFDAFC691AA5FB7F8E2A9E9521FEF771B SHA-1: 0x1E492D0D7C3EA5C426D38EF46715FB6E30F9988E	(not available)
13	%Temp%\tweaker_pl.lng	33,404 bytes	MD5: 0xBBD46D6005EC5B6F46A0BB2D2ECC7EDB SHA-1: 0x8FD7DF54B4A46EAA9C236993156232B1BFCF9E01	(not available)
14	%Temp%\VirusTotalUpload.exe	69,632 bytes	MD5: 0x913AD8736920259A14A4A6FE43F19824 SHA-1: 0xB19BFBDDA5542A710936675E13DEDDE02F613E82	(not available)
15	%Temp%\{5F9ADBE0-0AD2-41B1-995B-8FF45D7E6399}\0x0409.ini	6,187 bytes	MD5: 0x26A9B54F250E00693773481B837E03CC SHA-1: 0x554A407BF23984026785430E3BBDFFDD1285BE06	(not available)
16	%Temp%\{5F9ADBE0-0AD2-41B1-995B-8FF45D7E6399}\0x0809.ini	6,129 bytes	MD5: 0x8DCF70A87218342DB9114FFA9392463B SHA-1: 0xDE4B009966D3DA29E19CFECCFEA1ED4C0243CD09	(not available)
17	%Temp%\{5F9ADBE0-0AD2-41B1-995B-8FF45D7E6399}\1033.MST	3,584 bytes	MD5: 0x9A42714E617D956C0F8B2C4619EE97E8 SHA-1: 0x6541AABE485322E2AD3BE665C28F3C88566D6161	(not available)
18	%Temp%\{5F9ADBE0-0AD2-41B1-995B-8FF45D7E6399}\Setup.INI	2,871 bytes	MD5: 0x708130745FF84D7FCDEBECAFBB9910E5 SHA-1: 0x6EF3A8BFBD27D3365FD7A32D2FCE80ECA9040BE0	(not available)
19	%Temp%\{5F9ADBE0-0AD2-41B1-995B-8FF45D7E6399}\_ISMSIDEL.INI	393 bytes	MD5: 0x77E55E4DDF1C738A3ADCFFAE2D40071A SHA-1: 0x4F387DE9EAE55CD71B75ED4E3131BB804A0B4790	(not available)
20	[file and pathname of the sample #1]	3,397,512 bytes	MD5: 0xC7573658EB7BA865E43A1B389D752139 SHA-1: 0xF2DA53DFE7A313C81E83BC87F660EB3DFCD0018D	(not available)

• Note:
• %Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).

• The following directories were created:
• %Temp%\{5F9ADBE0-0AD2-41B1-995B-8FF45D7E6399}
• %AppData%\AnVir

• Notes:
• %AppData% is a variable that refers to the file system directory that serves as a common repository for application-specific data. A typical path is C:\Documents and Settings\[UserName]\Application Data.

Memory Modifications

• There were new processes created in the system:

Process Name	Process Filename	Main Module Size
AnVirSet.exe	%Temp%\anvirset.exe	6,569,984 bytes
DealioToolbar-stub-1.exe	%Temp%\dealiotoolbar-stub-1.exe	372,736 bytes
tweaker.exe	%Temp%\tweaker.exe	2,170,880 bytes
VirusTotalUpload.exe	%Temp%\virustotalupload.exe	77,824 bytes

Registry Modifications

• The following Registry Keys were created:
• HKEY_CURRENT_USER\Software\AnVir
• HKEY_CURRENT_USER\Software\AnVir\Tweaker

• The newly created Registry Value is:
• [HKEY_CURRENT_USER\Software\AnVir\Tweaker]
• RestorePoint = 0x00000001

Other details

• The following ports were open in the system:

• There was registered attempt to establish connection with the remote host. The connection details are:

• The data identified by the following URL was then requested from the remote web server:
• http://download.mybrowserbar.com/vkits/dlv1/0/DealioToolbar.msi