Submission Summary:

• Submission details:
• Submission received: 24 July 2008, 18:29:01
• Processing time: 3 min 32 sec
• Submitted sample:
• File MD5: 0xE6CCB9C7C60FB56B22BF620DF772A596
• File SHA-1: 0xF9A8DDCC742290E92A6BF44C207A76047FA3CF22
• Filesize: 66,048 bytes
• Alias: Trojan.Srizbi!sd6 [PCTools]

• Summary of the findings:

What's been found	Severity Level
Contains characteristics a SPAM bot, backdoor trojan, and a rootkit. The backdoor component allows the remote hacker to download/install additional components and instruct the bot to launch massive SPAM attacks from the compromised system.
Capability to send out email message(s) with the built-in SMTP client engine.
Stealth-mode characteristics common to Rootkits.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! Characteristics of the following security risks were identified in the system:

Security Risk	Description
Hacktool.Rootkit!sd6	Hacktool.Rootkit!sd6 is a malicious application that could be used by attackers to break into a system.
Trojan.Srizbi!sd6	Trojan.Srizbi!sd6 is a malicious program that does not infect other files but may represents security risk for your computer and/or network environment.

• Attention! The following threat categories were identified:

Threat Category	Description
	A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment
	A hacktool that could be used by attackers to break into a system

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%System%\pqasghjd.sys	62,384 bytes	MD5: 0x39C69645D67D49273F0E9F5F00114294 SHA-1: 0x323B0C052AF198B17E48CEA7497F0D9ECDBAF134	Hacktool.Rootkit!sd6 [PCTools] Hacktool.Rootkit [Symantec] Generic BackDoor [McAfee]
2	[file and pathname of the sample #1]	66,048 bytes	MD5: 0xE6CCB9C7C60FB56B22BF620DF772A596 SHA-1: 0xF9A8DDCC742290E92A6BF44C207A76047FA3CF22	Trojan.Srizbi!sd6 [PCTools]

• Note:
• %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

Memory Modifications

• There was a new process created in the system:

• There were new memory pages created in the address space of the system process(es):

Process Name	Process Filename	Allocated Size
services.exe	%System%\services.exe	65,536 bytes
services.exe	%System%\services.exe	98,304 bytes

• There was a new kernel-mode driver installed in the system:

Driver Name	Driver Filename
pqasghjd.sys	%System%\pqasghjd.sys

Registry Modifications

• The following Registry Keys were created:
• HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\pqasghjd
• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\pqasghjd

• Attention! There was hidden Registry Key created:
• HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\pqasghjd\Security

• Attention! The newly created hidden Registry Values are:
• [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\pqasghjd\Security]
• Security = 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 0
• [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\pqasghjd]
• Type = 0x00000001
• Start = 0x00000001
• ErrorControl = 0x00000000
• ImagePath = "%System%\pqasghjd.sys"
• ExtParamD = CE 83 0D 58 D3 28 6D C9 00 00

Other details

• The following Host Names were requested from a host database:
• google.com
• 208.72.169.15
• 208.72.169.54
• pro-tuning.org
• pro-tuning.name
• pro-tuning.mobi
• professional-tuning.info
• professional-tuning.in
• centerkras-tv.name
• centerkras-tv.info
• centerkras-tv.biz
• centerkras-tv.tv
• iloveeverybody.kz
• iloveeverybody.tj