Submission Summary:

• Submission details:
• Submission received: 18 May 2008, 19:38:30
• Processing time: 3 min 27 sec
• Submitted sample:
• File MD5: 0xEA1BC020306731DDD0F4CB03DE31FBD4
• File SHA-1: 0xEC8CE9B060A8F3C1C1782237C105BC205CDF8DD5
• Filesize: 105,984 bytes
• Alias:
• Adware.Insider!sd5 [PCTools]
• Downloader-BCF [McAfee]
• TROJ_DROPPER.AIO [Trend Micro]

• Summary of the findings:

What's been found	Severity Level
Downloads/requests other files from Internet.
Creates a startup registry entry.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! Characteristics of the following security risks were identified in the system:

Security Risk	Description
Adware.Insider!sd5	Adware.Insider!sd5 is a potentially unwanted adware program that could be used to display various pop-up advertisements.
Adware.MaxSearch!sd5	Adware.MaxSearch!sd5 is a potentially unwanted adware program that could be used to display various pop-up advertisements.

• Attention! The following threat category was identified:

Threat Category	Description
	A potentially unwanted adware program designed to deliver various advertisements to the users' systems

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%ProgramFiles%\JavaCore\JavaCore.exe	147,456 bytes	MD5: 0xAEC74161BFE589927DBEC42ABA37BE9B SHA-1: 0xE21E73287F97337EFC440506D40A3917785C9CA2	Adware.Insider!sd5 [PCTools] Matcash [McAfee]
2	%ProgramFiles%\JavaCore\UnInstall.exe	12,288 bytes	MD5: 0x3A0D175FFDB02FE8BA64DB1CD976E08E SHA-1: 0x5AAEB5F2C3FD70D39EC334CA76A915C2E2AE1B7C	Adware.MaxSearch!sd5 [PCTools]
3	[file and pathname of the sample #1]	105,984 bytes	MD5: 0xEA1BC020306731DDD0F4CB03DE31FBD4 SHA-1: 0xEC8CE9B060A8F3C1C1782237C105BC205CDF8DD5	Adware.Insider!sd5 [PCTools] Downloader-BCF [McAfee] TROJ_DROPPER.AIO [Trend Micro]

• Note:
• %ProgramFiles% is a variable that refers to the Program Files folder. A typical path is C:\Program Files.

• The following directories were created:
• %ProgramFiles%\InetGet2
• %ProgramFiles%\JavaCore

Memory Modifications

• There were new processes created in the system:

Process Name	Process Filename	Main Module Size
JavaCore.exe	%ProgramFiles%\javacore\javacore.exe	233,472 bytes
[filename of the sample #1]	[file and pathname of the sample #1]	188,416 bytes
Installeur.exe	%ProgramFiles%\InetGet2\Installeur.exe	172,032 bytes

Registry Modifications

• The following Registry Keys were created:
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\BO1jiZmwnF2zhi
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\BO1jiZmwnF2zhi\JavaCore
• HKEY_CURRENT_USER\Software\Classes\CLSID\{F0CD1A40-0C77-1033-0410-0710070001}

• The newly created Registry Values are:
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
• JavaCore = "%ProgramFiles%\\JavaCore\\JavaCore.exe"

so that JavaCore.exe runs every time Windows starts

• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\BO1jiZmwnF2zhi\JavaCore]
• DisplayName = "JavaCore"
• UninstallString = "%ProgramFiles%\\JavaCore\\UnInstall.exe"
• [HKEY_CURRENT_USER\Software\Classes\CLSID\{F0CD1A40-0C77-1033-0410-0710070001}]
• b152 = "yes"

Other details

• Analysis of the file resources indicate the following possible country of origin:

	France

• The following Host Name was requested from a host database:
• 208.67.222.222

• The following Internet download was started (the retrieved bits are saved into the local file):

• Notes:
• %Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).