Submission Summary:

• Submission details:
• Submission received: 17 January 2012, 02:31:36
• Processing time: 13 min 48 sec
• Submitted sample:
• File MD5: 0xE140F5F9BA61D1306934AB176382389F
• File SHA-1: 0xF4D17088F9888B932051FA6AEB65BFCBB6A5A756
• Filesize: 258,048 bytes
• Alias:
• Worm.Win32.AutoRun.hqs [Kaspersky Lab]
• W32/Autorun.worm.bbr [McAfee]
• Worm:Win32/Autorun.ABP [Microsoft]
• Virus.Worm.SuspectCRC [Ikarus]

• Summary of the findings:

What's been found	Severity Level
Creates an executable file in the fake Recycle Bin folder with the purpose of concealing its presence in the system.
Creates desktop.ini system file in the fake Recycle Bin folder in order to register it in Windows as a valid Recycle Bin.
Creates fake Recycle Bin folder.
Creates a startup registry entry.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! The following threat category was identified:

Threat Category	Description
	A network-aware worm that attempts to replicate across the existing network(s)

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	c:\Documents and Settings.exe c:\Inetpub.exe c:\Program Files.exe c:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\smartmgr.exe %Windir%\system\csrss.exe %Windir%\system\windows.exe %System%\lsas.exe [file and pathname of the sample #1] %Windir%\windowsxp.exe c:\WINDOWS.exe	258,048 bytes	MD5: 0xE140F5F9BA61D1306934AB176382389F SHA-1: 0xF4D17088F9888B932051FA6AEB65BFCBB6A5A756	Worm.Win32.AutoRun.hqs [Kaspersky Lab] W32/Autorun.worm.bbr [McAfee] Worm:Win32/Autorun.ABP [Microsoft] Virus.Worm.SuspectCRC [Ikarus]
2	c:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\Desktop.ini	63 bytes	MD5: 0xE783BDD20A976EAEAAE1FF4624487420 SHA-1: 0xC2A44FAB9DF00B3E11582546B16612333C2F9286	(not available)

• Notes:
• %Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.
• %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

• The following directory was created:
• c:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013

Registry Modifications

• The following Registry Key was created:
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{28ABC5C0-4FCB-11CF-AAX5-81CX1C635612}

• The newly created Registry Values are:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{28ABC5C0-4FCB-11CF-AAX5-81CX1C635612}]
• StubPath = "C:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\smartmgr.exe"

so that smartmgr.exe runs every time Windows starts

• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
• [file and pathname of the sample #1] = "[file and pathname of the sample #1]"
• %Windir%\system\csrss.exe = "%Windir%\system\csrss.exe"
• %Windir%\system\windows.exe = "%Windir%\system\windows.exe"

so that [file and pathname of the sample #1] runs every time Windows starts
so that csrss.exe runs every time Windows starts
so that windows.exe runs every time Windows starts