ThreatExpert Report: Trojan Horse, Worm.Win32.AutoRun.sla, WORM

Visit ThreatExpert web site

Close Report

Submission Summary:

Submission details:

Submission received: 21 November 2008, 06:19:26
Processing time: 7 min 12 sec
Submitted sample:

File MD5: 0xD849C641C10AEBC3DD498B33D7E6B375
File SHA-1: 0x5E9F286014763EAC7985B3E2C615F27D8B78E75C
Filesize: 13,824 bytes
Alias:

Trojan Horse [Symantec]
Worm.Win32.AutoRun.sla [Kaspersky Lab]
WORM_AUTORUN.BMY [Trend Micro]
Mal/Emogen-E, Mal/Basine-C [Sophos]
Worm:Win32/Autorun.gen!DI [Microsoft]
Win32.SuspectCrc [Ikarus]

Summary of the findings:

What's been found	Severity Level
Sets the drive to autoplay by creating autorun.inf file in its root directory. If the drive is shared across the network then other remote computers can be infected any time they try to access this share.
Downloads/requests other files from Internet.
Compromises SafeBoot registry key(s) in an attempt to disable the Safe Mode.
Creates a startup registry entry.
Installs a default debugger that is injected into the execution sequence of a target application. If a threat is installed as a default debugger, it will be run every time a target application is attempted to be launched - either to mimic it and hide its own presence (e.g. an open port or a running process), or simply to be activated as often as possible.
Packed with a packer that is known to be used by malware (e.g. to complicate threat analysis or detection).
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

Attention! The following threat categories were identified:

Threat Category	Description
	A network-aware worm that attempts to replicate across the existing network(s)
	A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment

File System Modifications

The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	c:\AUTORUN.INF	151 bytes	MD5: 0x9CA0AAB650128D05A2B39A2B53BEA49E SHA-1: 0x724D0F2F2435402DCBCC2F2984C460BAF1C247EA	INF.Autorun.Gen [PCTools] Generic!atr [McAfee]
2	%Profiles%\1010.pif %Profiles%\11.pif %Profiles%\22.pif %Profiles%\3.pif %Profiles%\4.pif %Profiles%\5.pif %Profiles%\66.pif %Profiles%\7.pif %Profiles%\8.pif %Profiles%\99.pif %ProgramFiles%\ccd.pif	125 bytes	MD5: 0x7C5F5A68051F6B0C0E9A2AD33C40D415 SHA-1: 0x120865765927A61AF83F02B83DC297EEDE61EC41	(not available)
3	c:\HCZP.PIF	13,824 bytes	MD5: 0x4ACA406F6BD699A7ED40CDD388E69831 SHA-1: 0x86EF0A9BAA57E0F0EA829235D86EBA29835FD6BB	(not available)
4	c:\ttmm.tep	57,856 bytes	MD5: 0x7435B108B935E42EA92CA94F59C8E717 SHA-1: 0xC0C79C39A7F4D4E491BFF70810439C1AAE3E5006	(not available)
5	%System%\aktwkss.dll	612,352 bytes	MD5: 0x3F795D6FB4050C93CBBD0FF699A2635A SHA-1: 0xD6F6FF1E3809C980CA78710E842AC3F1C1697E92	(not available)
6	%System%\dllcache\spoolsv.exe [file and pathname of the sample #1]	13,824 bytes	MD5: 0xD849C641C10AEBC3DD498B33D7E6B375 SHA-1: 0x5E9F286014763EAC7985B3E2C615F27D8B78E75C	Trojan Horse [Symantec] Worm.Win32.AutoRun.sla [Kaspersky Lab] WORM_AUTORUN.BMY [Trend Micro] Mal/Emogen-E, Mal/Basine-C [Sophos] Worm:Win32/Autorun.gen!DI [Microsoft] Win32.SuspectCrc [Ikarus]

Notes:

%Profiles% is a variable that refers to the file system directory containing user profile folders. A typical path is C:\Documents and Settings.
%ProgramFiles% is a variable that refers to the Program Files folder. A typical path is C:\Program Files.
%System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

The following files were deleted:

%System%\drivers\etc\hosts
%System%\mfc71.dll

The following file was modified:

%System%\spoolsv.exe

Memory Modifications

There was a new process created in the system:

Process Name	Process Filename	Main Module Size
[filename of the sample #1]	[file and pathname of the sample #1]	65,536 bytes

The following system services were modified:

Service Name	Display Name	New Status	Service Filename
ALG	Application Layer Gateway Service	"Stopped"	%System%\alg.exe
SharedAccess	Windows Firewall/Internet Connection Sharing (ICS)	"Stopped"	%System%\svchost.exe -k netsvcs

Registry Modifications

The following Registry Keys were created:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360rpt.EXE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360safe.EXE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360safebox.EXE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.EXE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ANTIARP.EXE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ArSwp.EXE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ast.EXE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AutoRun.EXE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AutoRunKiller.EXE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AvMonitor.EXE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVP.COM
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVP.EXE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CCenter.EXE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Frameworkservice.EXE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GFUpd.EXE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GuardField.EXE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HijackThis.EXE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IceSword.EXE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Iparmor.EXE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KASARP.EXE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kav32.EXE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVPFW.EXE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kavstart.EXE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kissvc.EXE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kmailmon.EXE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPfwSvc.EXE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KRegEx.EXE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVMonxp.KXP
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVSrvXP.EXE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVWSC.EXE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kwatch.EXE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Mmsk.EXE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.EXE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Navapsvc.EXE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32krn.EXE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nod32kui.EXE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PFW.EXE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQDoctor.EXE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RAV.EXE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavStub.EXE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regedit.EXE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwmain.EXE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwProxy.EXE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwsrv.EXE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwstub.EXE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RSTray.EXE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Runiep.EXE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\safeboxTray.EXE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SREngLdr.EXE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TrojanDetector.EXE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Trojanwall.EXE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TrojDie.KXP
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VPC32.EXE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VPTRAY.EXE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WOPTILITIES.EXE

The following Registry Keys were deleted:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318}
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318}

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\run]

internetnet = "%System%\spoolsv.exe"

so that spoolsv.exe runs every time Windows starts

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360rpt.EXE]

debugger = "%System%\dllcache\spoolsv.exe"

so that spoolsv.exe is injected into the execution sequence of 360rpt.EXE by being installed as its default debugger

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360safe.EXE]

debugger = "%System%\dllcache\spoolsv.exe"

so that spoolsv.exe is injected into the execution sequence of 360safe.EXE by being installed as its default debugger

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360safebox.EXE]

debugger = "%System%\dllcache\spoolsv.exe"

so that spoolsv.exe is injected into the execution sequence of 360safebox.EXE by being installed as its default debugger

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.EXE]

debugger = "%System%\dllcache\spoolsv.exe"

so that spoolsv.exe is injected into the execution sequence of 360tray.EXE by being installed as its default debugger

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ANTIARP.EXE]

debugger = "%System%\dllcache\spoolsv.exe"

so that spoolsv.exe is injected into the execution sequence of ANTIARP.EXE by being installed as its default debugger

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ArSwp.EXE]

debugger = "%System%\dllcache\spoolsv.exe"

so that spoolsv.exe is injected into the execution sequence of ArSwp.EXE by being installed as its default debugger

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ast.EXE]

debugger = "%System%\dllcache\spoolsv.exe"

so that spoolsv.exe is injected into the execution sequence of Ast.EXE by being installed as its default debugger

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AutoRun.EXE]

debugger = "%System%\dllcache\spoolsv.exe"

so that spoolsv.exe is injected into the execution sequence of AutoRun.EXE by being installed as its default debugger

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AutoRunKiller.EXE]

debugger = "%System%\dllcache\spoolsv.exe"

so that spoolsv.exe is injected into the execution sequence of AutoRunKiller.EXE by being installed as its default debugger

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AvMonitor.EXE]

debugger = "%System%\dllcache\spoolsv.exe"

so that spoolsv.exe is injected into the execution sequence of AvMonitor.EXE by being installed as its default debugger

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVP.COM]

debugger = "%System%\dllcache\spoolsv.exe"

so that spoolsv.exe is injected into the execution sequence of AVP.COM by being installed as its default debugger

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVP.EXE]

debugger = "%System%\dllcache\spoolsv.exe"

so that spoolsv.exe is injected into the execution sequence of AVP.EXE by being installed as its default debugger

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CCenter.EXE]

debugger = "%System%\dllcache\spoolsv.exe"

so that spoolsv.exe is injected into the execution sequence of CCenter.EXE by being installed as its default debugger

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Frameworkservice.EXE]

debugger = "%System%\dllcache\spoolsv.exe"

so that spoolsv.exe is injected into the execution sequence of Frameworkservice.EXE by being installed as its default debugger

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GFUpd.EXE]

debugger = "%System%\dllcache\spoolsv.exe"

so that spoolsv.exe is injected into the execution sequence of GFUpd.EXE by being installed as its default debugger

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GuardField.EXE]

debugger = "%System%\dllcache\spoolsv.exe"

so that spoolsv.exe is injected into the execution sequence of GuardField.EXE by being installed as its default debugger

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HijackThis.EXE]

debugger = "%System%\dllcache\spoolsv.exe"

so that spoolsv.exe is injected into the execution sequence of HijackThis.EXE by being installed as its default debugger

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IceSword.EXE]

debugger = "%System%\dllcache\spoolsv.exe"

so that spoolsv.exe is injected into the execution sequence of IceSword.EXE by being installed as its default debugger

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Iparmor.EXE]

debugger = "%System%\dllcache\spoolsv.exe"

so that spoolsv.exe is injected into the execution sequence of Iparmor.EXE by being installed as its default debugger

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KASARP.EXE]

debugger = "%System%\dllcache\spoolsv.exe"

so that spoolsv.exe is injected into the execution sequence of KASARP.EXE by being installed as its default debugger

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kav32.EXE]

debugger = "%System%\dllcache\spoolsv.exe"

so that spoolsv.exe is injected into the execution sequence of kav32.EXE by being installed as its default debugger

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVPFW.EXE]

debugger = "%System%\dllcache\spoolsv.exe"

so that spoolsv.exe is injected into the execution sequence of KAVPFW.EXE by being installed as its default debugger

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kavstart.EXE]

debugger = "%System%\dllcache\spoolsv.exe"

so that spoolsv.exe is injected into the execution sequence of kavstart.EXE by being installed as its default debugger

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kissvc.EXE]

debugger = "%System%\dllcache\spoolsv.exe"

so that spoolsv.exe is injected into the execution sequence of kissvc.EXE by being installed as its default debugger

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kmailmon.EXE]

debugger = "%System%\dllcache\spoolsv.exe"

so that spoolsv.exe is injected into the execution sequence of kmailmon.EXE by being installed as its default debugger

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPfwSvc.EXE]

debugger = "%System%\dllcache\spoolsv.exe"

so that spoolsv.exe is injected into the execution sequence of KPfwSvc.EXE by being installed as its default debugger

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KRegEx.EXE]

debugger = "%System%\dllcache\spoolsv.exe"

so that spoolsv.exe is injected into the execution sequence of KRegEx.EXE by being installed as its default debugger

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVMonxp.KXP]

debugger = "%System%\dllcache\spoolsv.exe"

so that spoolsv.exe is injected into the execution sequence of KVMonxp.KXP by being installed as its default debugger

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVSrvXP.EXE]

debugger = "%System%\dllcache\spoolsv.exe"

so that spoolsv.exe is injected into the execution sequence of KVSrvXP.EXE by being installed as its default debugger

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVWSC.EXE]

debugger = "%System%\dllcache\spoolsv.exe"

so that spoolsv.exe is injected into the execution sequence of KVWSC.EXE by being installed as its default debugger

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kwatch.EXE]

debugger = "%System%\dllcache\spoolsv.exe"

so that spoolsv.exe is injected into the execution sequence of kwatch.EXE by being installed as its default debugger

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Mmsk.EXE]

debugger = "%System%\dllcache\spoolsv.exe"

so that spoolsv.exe is injected into the execution sequence of Mmsk.EXE by being installed as its default debugger

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.EXE]

debugger = "%System%\dllcache\spoolsv.exe"

so that spoolsv.exe is injected into the execution sequence of msconfig.EXE by being installed as its default debugger

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Navapsvc.EXE]

debugger = "%System%\dllcache\spoolsv.exe"

so that spoolsv.exe is injected into the execution sequence of Navapsvc.EXE by being installed as its default debugger

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32krn.EXE]

debugger = "%System%\dllcache\spoolsv.exe"

so that spoolsv.exe is injected into the execution sequence of nod32krn.EXE by being installed as its default debugger

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nod32kui.EXE]

debugger = "%System%\dllcache\spoolsv.exe"

so that spoolsv.exe is injected into the execution sequence of Nod32kui.EXE by being installed as its default debugger

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PFW.EXE]

debugger = "%System%\dllcache\spoolsv.exe"

so that spoolsv.exe is injected into the execution sequence of PFW.EXE by being installed as its default debugger

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQDoctor.EXE]

debugger = "%System%\dllcache\spoolsv.exe"

so that spoolsv.exe is injected into the execution sequence of QQDoctor.EXE by being installed as its default debugger

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RAV.EXE]

debugger = "%System%\dllcache\spoolsv.exe"

so that spoolsv.exe is injected into the execution sequence of RAV.EXE by being installed as its default debugger

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavStub.EXE]

debugger = "%System%\dllcache\spoolsv.exe"

so that spoolsv.exe is injected into the execution sequence of RavStub.EXE by being installed as its default debugger

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regedit.EXE]

debugger = "%System%\dllcache\spoolsv.exe"

so that spoolsv.exe is injected into the execution sequence of Regedit.EXE by being installed as its default debugger

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwmain.EXE]

debugger = "%System%\dllcache\spoolsv.exe"

so that spoolsv.exe is injected into the execution sequence of rfwmain.EXE by being installed as its default debugger

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwProxy.EXE]

debugger = "%System%\dllcache\spoolsv.exe"

so that spoolsv.exe is injected into the execution sequence of rfwProxy.EXE by being installed as its default debugger

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwsrv.EXE]

debugger = "%System%\dllcache\spoolsv.exe"

so that spoolsv.exe is injected into the execution sequence of rfwsrv.EXE by being installed as its default debugger

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwstub.EXE]

debugger = "%System%\dllcache\spoolsv.exe"

so that spoolsv.exe is injected into the execution sequence of rfwstub.EXE by being installed as its default debugger

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RSTray.EXE]

debugger = "%System%\dllcache\spoolsv.exe"

so that spoolsv.exe is injected into the execution sequence of RSTray.EXE by being installed as its default debugger

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Runiep.EXE]

debugger = "%System%\dllcache\spoolsv.exe"

so that spoolsv.exe is injected into the execution sequence of Runiep.EXE by being installed as its default debugger

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\safeboxTray.EXE]

debugger = "%System%\dllcache\spoolsv.exe"

so that spoolsv.exe is injected into the execution sequence of safeboxTray.EXE by being installed as its default debugger

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SREngLdr.EXE]

debugger = "%System%\dllcache\spoolsv.exe"

so that spoolsv.exe is injected into the execution sequence of SREngLdr.EXE by being installed as its default debugger

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TrojanDetector.EXE]

debugger = "%System%\dllcache\spoolsv.exe"

so that spoolsv.exe is injected into the execution sequence of TrojanDetector.EXE by being installed as its default debugger

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Trojanwall.EXE]

debugger = "%System%\dllcache\spoolsv.exe"

so that spoolsv.exe is injected into the execution sequence of Trojanwall.EXE by being installed as its default debugger

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TrojDie.KXP]

debugger = "%System%\dllcache\spoolsv.exe"

so that spoolsv.exe is injected into the execution sequence of TrojDie.KXP by being installed as its default debugger

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VPC32.EXE]

debugger = "%System%\dllcache\spoolsv.exe"

so that spoolsv.exe is injected into the execution sequence of VPC32.EXE by being installed as its default debugger

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VPTRAY.EXE]

debugger = "%System%\dllcache\spoolsv.exe"

so that spoolsv.exe is injected into the execution sequence of VPTRAY.EXE by being installed as its default debugger

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WOPTILITIES.EXE]

debugger = "%System%\dllcache\spoolsv.exe"

so that spoolsv.exe is injected into the execution sequence of WOPTILITIES.EXE by being installed as its default debugger

The following Registry Values were deleted:

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}]

(Default) = "DiskDrive"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318}]

(Default) = "DiskDrive"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}]

(Default) = "DiskDrive"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318}]

(Default) = "DiskDrive"

The following Registry Value was modified:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL]

CheckedValue = 0x00000002

Other details

Analysis of the file resources indicate the following possible country of origin:

China

To mark the presence in the system, the following Mutex object was created:

XIAXUE

The following Internet Connection was established:

Server Name	Server Port	Connect as User	Connection Password
w.cdd6.com	80	(null)	(null)

The following GET requests were made:

dd/x.gif
dd/1.exe
dd/2.exe
dd/3.exe
dd/4.exe
dd/5.exe
dd/6.exe
dd/7.exe
dd/8.exe
dd/9.exe
dd/10.exe

Downloaded File Summary:

Download details:

Download retrieved: 21 November 2008 06:27:14
Processing time: 11 min 0 sec
Downloaded sample #1:

File MD5: 0x6DB408FEB7DD40C8D642A3A52CEA52F6
File SHA-1: 0xD86A1D7600FE888F781F9799A81D2DE60C5D874A
Filesize: 13,119 bytes
Alias: Trojan-Downloader.Win32.Banload [Ikarus]

Downloaded sample #2:

File MD5: 0xBEAFE9738265395B738159B0C02DB43A
File SHA-1: 0xD8AFFE3D392A2F5BDFDAE39BC44F4F1200A544F1
Filesize: 45,224 bytes
Alias & packer info:

Packed.Generic.181 [Symantec]
New Malware.aj [McAfee]
Trojan-PWS.Win32.OnLineGames [Ikarus]
packed with: PE_Patch [Kaspersky Lab]

Downloaded sample #3:

File MD5: 0x340D385B85BD438082E03C79DC01D4B3
File SHA-1: 0xEF833633637FA2CE96A95E8C6955F1AE2D8C05C7
Filesize: 151,184 bytes
Alias:

Adware.AdMedia!sd6 [PCTools]
Trojan.Cinmeng [Symantec]
not-a-virus:AdWare.Win32.AdMedia.ed [Kaspersky Lab]
Adware-Cinmus [McAfee]
Generic.Adw.Cinmus.2 [Ikarus]

Downloaded sample #4:

File MD5: 0x4BEAC39548721A8D6DEFC0440B441A0D
File SHA-1: 0x56991DD5EFDC2A37C55DA9489C53E390D3A84FA8
Filesize: 139,092 bytes
Alias: not-a-virus:AdWare.Win32.BHO.dzf [Kaspersky Lab]

Downloaded sample #5:

File MD5: 0xE28C84D43BA8C9AEF02D48BE18C13816
File SHA-1: 0xA7BA98F8590688C0C956026388F3B62963492C49
Filesize: 184,832 bytes
Alias & packer info:

Packed.Generic.181 [Symantec]
New Malware.u [McAfee]
Mal/Packer [Sophos]
MalwareScope.Worm.Viking.4 [Ikarus]
packed with: NSPack [Kaspersky Lab]

Summary of the findings:

What's been found	Severity Level
Downloads/requests other files from Internet.
Registers a 32-bit in-process server DLL.
Registers a Browser Helper Object (Microsoft's Internet Explorer plugin module).
Packed with a packer that is known to be used by malware (e.g. to complicate threat analysis or detection).
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

Attention! Characteristics of the following security risks were identified in the system:

Security Risk	Description
Adware.Sogou	Adware.Sogou comes bundled with various trojans and is secretly installed onto the unsuspecting users computer. It produces pop-up and pop-under advertisements.
Exploit.IMG-WMF!sd6	Exploit.IMG-WMF!sd6 is a detection of the code that takes advantage of an existing software vulnerability.
Trojan.Popuper	Trojan.Popuper hijacks the default Internet Explorer settings and changes your Internet Explorer homepage. It also appears as a security alert notifying users that their PC has been compromised and then downloads rogue antispyware products onto their PC.
Trojan-Downloader.Small!sd6	Trojan-Downloader.Small!sd6 attempts to download malicious files to the local computer and execute them.
Adware.AdMedia!sd6	Adware.AdMedia!sd6 is a potentially unwanted adware program that could be used to display various pop-up advertisements.
Trojan-Downloader.Agent.AEN	Trojan-Downloader.Agent.AEN is a trojan with rootkit capabilities which is able to hide malware on infected machines. It contacts a remote server to get a list of files to download and install other malware on the affected machine. It also attempts to disable security-related applications based on their filenames.

Attention! The following threat categories were identified:

Threat Category	Description
	A potentially unwanted adware program designed to deliver various advertisements to the users' systems
	An exploit code that takes advantage of an existing software vulnerability
	A program that downloads files to the local computer that may represent security risk
	A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment
	A hacktool that could be used by attackers to break into a system

File System Modifications

The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	c:\DEL.bat	106 bytes	MD5: 0xBFCAB4F7BFD63B25FE539FCD82EC5D83 SHA-1: 0x5B88C70C593606A6C9E110518C9D58854F16B50F	(not available)
2	%ProgramFiles%\Common Files\PushWare\cpush.dll	196,608 bytes	MD5: 0x4210DB586A0D4AD0D943E7F0F5EE9842 SHA-1: 0xB30495A7264FEBDE5B94DD53275C5FE6D67E3B66	Adware.CPush [Symantec] not-a-virus:AdWare.Win32.BHO.dzf [Kaspersky Lab] AdClicker-BJ [McAfee] Troj/AdClick-ER [Sophos] Program:Win32/Sogou [Microsoft] Virus.Win32.BHO.GG [Ikarus]
3	%ProgramFiles%\Common Files\PushWare\Uninst.exe	33,058 bytes	MD5: 0xD10F0D03BD7E1C981874FE932E23E55B SHA-1: 0x9B08F8A87ED06F1749BF8C343DEC8EC0389DFC4C	Generic PUP.x [McAfee] Troj/FakeAV-CL [Sophos] Win32.SuspectCrc [Ikarus]
4	%DownloadedProgramFiles%\svchost.exe	3,740 bytes	MD5: 0xD2C3349A566A814A3D793F82AD7D8A65 SHA-1: 0x66F23C6633B21702B3EA3A936358907CA35A593E	Exploit.IMG-WMF!sd6 [PCTools] Packed.Generic.181 [Symantec] Exploit.Win32.IMG-WMF.fk [Kaspersky Lab] Generic.dx [McAfee] Trojan.Zlob [Ikarus] packed with PE_Patch [Kaspersky Lab]
5	%FontsDir%\svchost.exe	13,744 bytes	MD5: 0x3AD8A2755C0C9B6CA3BE26FE1F4DD473 SHA-1: 0x61D342C456861FF6F15A217D7E133B55DE2C2B98	Trojan.Popuper [PCTools] Downloader [Symantec] Trojan-GameThief.Win32.OnLineGames.trxn [Kaspersky Lab] New Malware.aj [McAfee] Mal/Generic-A [Sophos] Trojan.Zlob [Ikarus]
6	%System%\350safe.exe	15,384 bytes	MD5: 0x526C2F533CE9302C02325EF21BEDB81C SHA-1: 0x39AC762DDBC19247A266EBCB217A51CCC4249518	Packed.Generic.181 [Symantec] Trojan-GameThief.Win32.OnLineGames.ttgp [Kaspersky Lab] Generic.dx [McAfee] Trojan-PWS.Win32.Agent.hf [Ikarus] packed with PE_Patch [Kaspersky Lab]
7	%System%\drivers\Atieccx.sys	13,696 bytes	MD5: 0xC4B355714322B38A74491AA58FD3F943 SHA-1: 0xF698CB5054893DC8B35CDDC48F1DB510E13DFB69	Trojan-Downloader.Small!sd6 [PCTools] Trojan.Drondog [Symantec] Trojan-Downloader.Win32.Small.xxh [Kaspersky Lab] Downloader-BJN.sys [McAfee] Mal/Generic-A [Sophos] Trojan:Win32/Abndog.A [Microsoft] Trojan-Downloader.Win32.Small [Ikarus]
8	%System%\mshuahuaua.dll	18,432 bytes	MD5: 0x313B44482474F88FE6827D3C363ACFCC SHA-1: 0xE3A226D1E92BAD3A458D430BFF39E26E6F64EF67	Trojan-Dropper.SFU [Ikarus]
9	[file and pathname of the sample #1]	13,119 bytes	MD5: 0x6DB408FEB7DD40C8D642A3A52CEA52F6 SHA-1: 0xD86A1D7600FE888F781F9799A81D2DE60C5D874A	Trojan-Downloader.Win32.Banload [Ikarus]
10	[file and pathname of the sample #2]	45,224 bytes	MD5: 0xBEAFE9738265395B738159B0C02DB43A SHA-1: 0xD8AFFE3D392A2F5BDFDAE39BC44F4F1200A544F1	Packed.Generic.181 [Symantec] New Malware.aj [McAfee] Trojan-PWS.Win32.OnLineGames [Ikarus] packed with PE_Patch [Kaspersky Lab]
11	[file and pathname of the sample #3]	151,184 bytes	MD5: 0x340D385B85BD438082E03C79DC01D4B3 SHA-1: 0xEF833633637FA2CE96A95E8C6955F1AE2D8C05C7	Adware.AdMedia!sd6 [PCTools] Trojan.Cinmeng [Symantec] not-a-virus:AdWare.Win32.AdMedia.ed [Kaspersky Lab] Adware-Cinmus [McAfee] Generic.Adw.Cinmus.2 [Ikarus]
12	[file and pathname of the sample #4]	139,092 bytes	MD5: 0x4BEAC39548721A8D6DEFC0440B441A0D SHA-1: 0x56991DD5EFDC2A37C55DA9489C53E390D3A84FA8	not-a-virus:AdWare.Win32.BHO.dzf [Kaspersky Lab]
13	[file and pathname of the sample #5]	184,832 bytes	MD5: 0xE28C84D43BA8C9AEF02D48BE18C13816 SHA-1: 0xA7BA98F8590688C0C956026388F3B62963492C49	Packed.Generic.181 [Symantec] New Malware.u [McAfee] Mal/Packer [Sophos] MalwareScope.Worm.Viking.4 [Ikarus] packed with NSPack [Kaspersky Lab]
14	%System%\wacstdlt.exe	13,531 bytes	MD5: 0xCA42539E85A7F9BB372DA8124F7A3254 SHA-1: 0x94ADA2EAF210D3669B9D6873A5463EDA6207A12A	Trojan-Downloader.Agent.AEN [PCTools] Hacktool [Symantec] not-a-virus:NetTool.Win32.Agent.b [Kaspersky Lab] BackDoor-AWQ [McAfee] Mal/EncPk-AI [Sophos] Trojan:Win32/Pepatch.E [Microsoft] Backdoor.Win32.Popwin [Ikarus]

Notes:

%ProgramFiles% is a variable that refers to the Program Files folder. A typical path is C:\Program Files.
%DownloadedProgramFiles% is a variable that refers to the file system directory containing downloaded program files. A typical path is C:\Windows\Downloaded Program Files.
%FontsDir% is a variable that refers to a virtual folder containing fonts. A typical path is C:\Windows\Fonts.
%System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

The following directory was created:

%ProgramFiles%\Common Files\PushWare

Memory Modifications

There were new processes created in the system:

Process Name	Process Filename	Main Module Size
svchost.exe	%FontsDir%\svchost.exe	102,400 bytes
cmdd	%FontsDir%\cmdd	118,784 bytes
[filename of the sample #4]	[file and pathname of the sample #4]	3,854,336 bytes
[filename of the sample #5]	[file and pathname of the sample #5]	749,568 bytes
wacstdlt.exe	%System%\wacstdlt.exe	61,440 bytes
[filename of the sample #2]	[file and pathname of the sample #2]	204,800 bytes
[filename of the sample #3]	[file and pathname of the sample #3]	626,688 bytes
svchost.exe	%DownloadedProgramFiles%\svchost.exe	57,344 bytes

There was a new kernel-mode driver installed in the system:

Driver Name	Driver Filename
MyDog	%System%\Drivers\Atieccx.sys

Registry Modifications

The following Registry Keys were created:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11F09AFD-75AD-4E51-AB43-E09E9351CE16}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11F09AFD-75AD-4E51-AB43-E09E9351CE16}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11F09AFD-75AD-4E51-AB43-E09E9351CE16}\ProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11F09AFD-75AD-4E51-AB43-E09E9351CE16}\Programmable
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11F09AFD-75AD-4E51-AB43-E09E9351CE16}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11F09AFD-75AD-4E51-AB43-E09E9351CE16}\VersionIndependentProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{34A12A06-48C0-420D-8F11-73552EE9631A}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{34A12A06-48C0-420D-8F11-73552EE9631A}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{34A12A06-48C0-420D-8F11-73552EE9631A}\ProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{34A12A06-48C0-420D-8F11-73552EE9631A}\Programmable
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{34A12A06-48C0-420D-8F11-73552EE9631A}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{34A12A06-48C0-420D-8F11-73552EE9631A}\VersionIndependentProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CDE9EB54-A08E-4570-B748-13F5DDB5781C}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CDE9EB54-A08E-4570-B748-13F5DDB5781C}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CDE9EB54-A08E-4570-B748-13F5DDB5781C}\ProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CDE9EB54-A08E-4570-B748-13F5DDB5781C}\Programmable
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CDE9EB54-A08E-4570-B748-13F5DDB5781C}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CDE9EB54-A08E-4570-B748-13F5DDB5781C}\VersionIndependentProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0AD3AB16-6D0E-4F04-8660-FB1F36BC2DC0}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0AD3AB16-6D0E-4F04-8660-FB1F36BC2DC0}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0AD3AB16-6D0E-4F04-8660-FB1F36BC2DC0}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0AD3AB16-6D0E-4F04-8660-FB1F36BC2DC0}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2F685B36-C53A-4653-9231-1DAE5736DE45}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2F685B36-C53A-4653-9231-1DAE5736DE45}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2F685B36-C53A-4653-9231-1DAE5736DE45}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2F685B36-C53A-4653-9231-1DAE5736DE45}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{50C4CDD9-22D7-49FF-AC6D-7D4D528A3AB2}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{50C4CDD9-22D7-49FF-AC6D-7D4D528A3AB2}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{50C4CDD9-22D7-49FF-AC6D-7D4D528A3AB2}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{50C4CDD9-22D7-49FF-AC6D-7D4D528A3AB2}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{DE2267BD-B163-407F-9E8D-6ADEC771E7AB}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{DE2267BD-B163-407F-9E8D-6ADEC771E7AB}\1.0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{DE2267BD-B163-407F-9E8D-6ADEC771E7AB}\1.0\0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{DE2267BD-B163-407F-9E8D-6ADEC771E7AB}\1.0\0\win32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{DE2267BD-B163-407F-9E8D-6ADEC771E7AB}\1.0\FLAGS
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{DE2267BD-B163-407F-9E8D-6ADEC771E7AB}\1.0\HELPDIR
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NewAdPopup.ToolbarDetector
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NewAdPopup.ToolbarDetector\CLSID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NewAdPopup.ToolbarDetector\CurVer
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NewAdPopup.ToolbarDetector.1
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NewAdPopup.ToolbarDetector.1\CLSID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NewszAdsPopup.BMLogc
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NewszAdsPopup.BMLogc\CLSID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NewszAdsPopup.BMLogc\CurVer
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NewszAdsPopup.BMLogc.1
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NewszAdsPopup.BMLogc.1\CLSID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NewzCocoMediaPop.PopCoco
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NewzCocoMediaPop.PopCoco\CLSID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NewzCocoMediaPop.PopCoco\CurVer
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NewzCocoMediaPop.PopCoco.1
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NewzCocoMediaPop.PopCoco.1\CLSID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{11F09AFD-75AD-4E51-AB43-E09E9351CE16}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ContentMatch
HKEY_LOCAL_MACHINE\SOFTWARE\cpush
HKEY_LOCAL_MACHINE\SOFTWARE\cpush\update
HKEY_LOCAL_MACHINE\SOFTWARE\MicroPlugins
HKEY_LOCAL_MACHINE\SOFTWARE\MicroPlugins\Common
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_MYDOG
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_MYDOG\0000
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MyDog
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MyDog\Security
HKEY_CURRENT_USER\Software\newpush
HKEY_CURRENT_USER\Software\newpush\ErrorUrl
HKEY_CURRENT_USER\Software\Sysisoft
HKEY_CURRENT_USER\Software\Sysisoft\Other

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11F09AFD-75AD-4E51-AB43-E09E9351CE16}\VersionIndependentProgID]

(Default) = "NewszAdsPopup.BMLogc"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11F09AFD-75AD-4E51-AB43-E09E9351CE16}\TypeLib]

(Default) = "{DE2267BD-B163-407F-9E8D-6ADEC771E7AB}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11F09AFD-75AD-4E51-AB43-E09E9351CE16}\ProgID]

(Default) = "NewszAdsPopup.BMLogc.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11F09AFD-75AD-4E51-AB43-E09E9351CE16}\InprocServer32]

(Default) = "%ProgramFiles%\Common Files\PushWare\cpush.dll"
ThreadingModel = "apartment"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11F09AFD-75AD-4E51-AB43-E09E9351CE16}]

(Default) = "CAdLogic Object"
AppID = ""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{34A12A06-48C0-420D-8F11-73552EE9631A}\VersionIndependentProgID]

(Default) = "NewAdPopup.ToolbarDetector"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{34A12A06-48C0-420D-8F11-73552EE9631A}\TypeLib]

(Default) = "{DE2267BD-B163-407F-9E8D-6ADEC771E7AB}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{34A12A06-48C0-420D-8F11-73552EE9631A}\ProgID]

(Default) = "NewAdPopup.ToolbarDetector.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{34A12A06-48C0-420D-8F11-73552EE9631A}\InprocServer32]

(Default) = "%ProgramFiles%\Common Files\PushWare\cpush.dll"
ThreadingModel = "apartment"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{34A12A06-48C0-420D-8F11-73552EE9631A}]

(Default) = "CToolbarDetector Object"
AppID = ""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CDE9EB54-A08E-4570-B748-13F5DDB5781C}\VersionIndependentProgID]

(Default) = "NewzCocoMediaPop.PopCoco"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CDE9EB54-A08E-4570-B748-13F5DDB5781C}\TypeLib]

(Default) = "{DE2267BD-B163-407F-9E8D-6ADEC771E7AB}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CDE9EB54-A08E-4570-B748-13F5DDB5781C}\ProgID]

(Default) = "NewzCocoMediaPop.PopCoco.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CDE9EB54-A08E-4570-B748-13F5DDB5781C}\InprocServer32]

(Default) = "%ProgramFiles%\Common Files\PushWare\cpush.dll"
ThreadingModel = "apartment"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CDE9EB54-A08E-4570-B748-13F5DDB5781C}]

(Default) = "CPopupBlock Object"
AppID = ""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0AD3AB16-6D0E-4F04-8660-FB1F36BC2DC0}\TypeLib]

(Default) = "{DE2267BD-B163-407F-9E8D-6ADEC771E7AB}"
Version = "1.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0AD3AB16-6D0E-4F04-8660-FB1F36BC2DC0}\ProxyStubClsid32]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0AD3AB16-6D0E-4F04-8660-FB1F36BC2DC0}\ProxyStubClsid]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0AD3AB16-6D0E-4F04-8660-FB1F36BC2DC0}]

(Default) = "IAdLogic"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2F685B36-C53A-4653-9231-1DAE5736DE45}\TypeLib]

(Default) = "{DE2267BD-B163-407F-9E8D-6ADEC771E7AB}"
Version = "1.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2F685B36-C53A-4653-9231-1DAE5736DE45}\ProxyStubClsid32]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2F685B36-C53A-4653-9231-1DAE5736DE45}\ProxyStubClsid]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2F685B36-C53A-4653-9231-1DAE5736DE45}]

(Default) = "IToolbarDetector"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{50C4CDD9-22D7-49FF-AC6D-7D4D528A3AB2}\TypeLib]

(Default) = "{DE2267BD-B163-407F-9E8D-6ADEC771E7AB}"
Version = "1.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{50C4CDD9-22D7-49FF-AC6D-7D4D528A3AB2}\ProxyStubClsid32]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{50C4CDD9-22D7-49FF-AC6D-7D4D528A3AB2}\ProxyStubClsid]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{50C4CDD9-22D7-49FF-AC6D-7D4D528A3AB2}]

(Default) = "IPopupBlock"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{DE2267BD-B163-407F-9E8D-6ADEC771E7AB}\1.0\0\win32]

(Default) = "%ProgramFiles%\Common Files\PushWare\cpush.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{DE2267BD-B163-407F-9E8D-6ADEC771E7AB}\1.0\HELPDIR]

(Default) = "%ProgramFiles%\Common Files\PushWare\"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{DE2267BD-B163-407F-9E8D-6ADEC771E7AB}\1.0\FLAGS]

(Default) = "0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{DE2267BD-B163-407F-9E8D-6ADEC771E7AB}\1.0]

(Default) = "NewAdPopup 1.0 Type Library"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NewAdPopup.ToolbarDetector\CurVer]

(Default) = "NewAdPopup.ToolbarDetector.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NewAdPopup.ToolbarDetector\CLSID]

(Default) = "{34A12A06-48C0-420D-8F11-73552EE9631A}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NewAdPopup.ToolbarDetector]

(Default) = "CToolbarDetector Object"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NewAdPopup.ToolbarDetector.1\CLSID]

(Default) = "{34A12A06-48C0-420D-8F11-73552EE9631A}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NewAdPopup.ToolbarDetector.1]

(Default) = "CToolbarDetector Object"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NewszAdsPopup.BMLogc\CurVer]

(Default) = "NewszAdsPopup.BMLogc.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NewszAdsPopup.BMLogc\CLSID]

(Default) = "{11F09AFD-75AD-4E51-AB43-E09E9351CE16}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NewszAdsPopup.BMLogc]

(Default) = "CAdLogic Object"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NewszAdsPopup.BMLogc.1\CLSID]

(Default) = "{11F09AFD-75AD-4E51-AB43-E09E9351CE16}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NewszAdsPopup.BMLogc.1]

(Default) = "CAdLogic Object"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NewzCocoMediaPop.PopCoco\CurVer]

(Default) = "NewzCocoMediaPop.PopCoco.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NewzCocoMediaPop.PopCoco\CLSID]

(Default) = "{CDE9EB54-A08E-4570-B748-13F5DDB5781C}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NewzCocoMediaPop.PopCoco]

(Default) = "CPopupBlock Object"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NewzCocoMediaPop.PopCoco.1\CLSID]

(Default) = "{CDE9EB54-A08E-4570-B748-13F5DDB5781C}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NewzCocoMediaPop.PopCoco.1]

(Default) = "CPopupBlock Object"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{11F09AFD-75AD-4E51-AB43-E09E9351CE16}]

(Default) = "AdPopup"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ContentMatch]

DisplayName = "Adsense based PopAd"
UninstallString = "%ProgramFiles%\Common Files\PushWare\Uninst.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\cpush\update]

Ad_Version = "1,1,1,3"

[HKEY_LOCAL_MACHINE\SOFTWARE\cpush]

UserID = "{7F7E8795-954A-48F8-BFA1-2B896179FBCC}"

[HKEY_LOCAL_MACHINE\SOFTWARE\MicroPlugins\Common]

param = "sid=ad"
size = 0x010F4A85

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_MYDOG\0000]

Service = "MyDog"
Legacy = 0x00000001
ConfigFlags = 0x00000000
Class = "LegacyDriver"
ClassGUID = "{8ECC055D-047F-11D1-A537-0000F8753ED1}"
DeviceDesc = "MyDog"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_MYDOG]

NextInstance = 0x00000001

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MyDog\Security]

Security = 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 0

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MyDog]

Type = 0x00000001
Start = 0x00000004
ErrorControl = 0x00000000
ImagePath = "%System%\Drivers\Atieccx.sys"
DisplayName = "MyDog"
DeleteFlag = 0x00000001

[HKEY_CURRENT_USER\Software\newpush]

date = "2008-10-19"
popup_times = 0x00000000

[HKEY_CURRENT_USER\Software\Sysisoft\Other]

LastResetTD = 0x48FBE267

Other details

Analysis of the file resources indicate the following possible country of origin:

China

To mark the presence in the system, the following Mutex objects were created:

ssss4a1f
52D77ECE7B32424dB93B9A6EFBDDB0DF

The following Host Name was requested from a host database:

push.cpushpop.com

There was registered attempt to establish connection with the remote host. The connection details are:

Remote Host	Port Number
push.cpushpop.com	1138

The following Internet Connections were established:

Server Name	Server Port	Connect as User	Connection Password
liaobamm.com	80	(null)	(null)
127.0.0.138	80	127.0.0.138	127.0.0.138
127.0.0.136	80	127.0.0.136	127.0.0.136

The following GET requests were made:

index.html
index.jpg

The data identified by the following URL was then requested from the remote web server:

http://update.cpushpop.com/cpush/version.txt

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.

The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.