ThreatExpert Report: Rootkit.NT!ct, TROJ_RENOS.AHJ, Win32.SuspectCrc, BackDoor-AWQ..

Submission Summary:

Submission details:

Submission received: 12 May 2009, 17:35:15
Processing time: 9 min 9 sec
Submitted sample:

File MD5: 0xEC8497D2277413C13950F3A446F9D143
File SHA-1: 0xA80C3ECB541D67B9A2007337B162CD0866E0B29A
Filesize: 2,167,568 bytes
Alias: Rootkit.NT!ct [PCTools]

Summary of the findings:

What's been found	Severity Level
Downloads/requests other files from Internet.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

Attention! Characteristics of the following security risks were identified in the system:

Security Risk	Description
RogueAntiSpyware.NoAdware	RogueAntiSpyware.NoAdware is a Rogue Anti-Spyware application which produces many detections that are not malicious in order to persuade the user into buying their product before they can remove these spurious detections.
Rootkit.NT!ct	Rootkit.NT!ct is a threat that relies on rootkit-specific techniques in order to hide its presence in the system

File System Modifications

The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%CommonPrograms%\NoAdware\NoAdware .lnk	664 bytes	MD5: 0xE0DD7FC4B104FB1BA3DD7D0BB87572DD SHA-1: 0x0AAFC1F27DEF9E87074F252DF46A6B197E6F528C	(not available)
2	%CommonPrograms%\NoAdware\Uninstall NoAdware .lnk	659 bytes	MD5: 0x519C630856245C7E3E5F1A1DA2F8ACCB SHA-1: 0x66A1A9E9A727BE8DCDD7FEBEE1C0BCB2F908497E	(not available)
3	%DesktopDir%\NoAdware.lnk	710 bytes	MD5: 0x3ED66794D6E32D0F36B5747363158CAF SHA-1: 0x9CD18FFBE66FD6ABE824ADD9346D5BACEC1E579E	(not available)
4	%ProgramFiles%\NoAdware5.0\noadware4_011108.na	0 bytes	MD5: 0xD41D8CD98F00B204E9800998ECF8427E SHA-1: 0xDA39A3EE5E6B4B0D3255BFEF95601890AFD80709	(not available)
5	%ProgramFiles%\NoAdware5.0\NoAdware5.exe	1,695,744 bytes	MD5: 0xC5A63FC079F4006365AEB71466BC31BD SHA-1: 0x2E8A7E680E1F49957D83477CEB92613DC5401DCC	TROJ_RENOS.AHJ [Trend Micro] Win32.SuspectCrc [Ikarus]
6	%ProgramFiles%\NoAdware5.0\nutils.dll	131,072 bytes	MD5: 0xFF45FB110B15FE1F9BBC52C7B4319206 SHA-1: 0x79CAC8E2E9ED00BDB92B543EAB93911A9DF99D8B	BackDoor-AWQ [McAfee] FraudTool.Win32.NoAdware [Ikarus] Win-Trojan/Horse.131072 [AhnLab]
7	%ProgramFiles%\NoAdware5.0\unins000.dat	2,838 bytes	MD5: 0x1C2861814630D00B90D55DBBA83AE1BA SHA-1: 0xF195C34C033C35C4F12AF67DA09460F6A7DAF2E2	(not available)
8	%ProgramFiles%\NoAdware5.0\unins000.exe	690,969 bytes	MD5: 0x8CA056D26EA15FD5388E94456F1B7503 SHA-1: 0xFC3EA38258EFFBC8E487A1912BF9ECD74A07ED16	(not available)
9	[file and pathname of the sample #1]	2,167,568 bytes	MD5: 0xEC8497D2277413C13950F3A446F9D143 SHA-1: 0xA80C3ECB541D67B9A2007337B162CD0866E0B29A	Rootkit.NT!ct [PCTools]

Notes:

%CommonPrograms% is a variable that refers to the file system directory that contains the directories for the common program groups that appear on the Start menu for all users. A typical path is C:\Documents and Settings\All Users\Start Menu\Programs (Windows NT/2000/XP).
%DesktopDir% is a variable that refers to the file system directory used to physically store file objects on the desktop. A typical path is C:\Documents and Settings\[UserName]\Desktop.
%ProgramFiles% is a variable that refers to the Program Files folder. A typical path is C:\Program Files.

The following directories were created:

%CommonPrograms%\NoAdware
%ProgramFiles%\NoAdware5.0
%ProgramFiles%\NoAdware5.0\logs

Memory Modifications

There were new processes created in the system:

Process Name	Process Filename	Main Module Size
[filename of the sample #1].tmp	%Temp%\is-L19TK.tmp\[filename of the sample #1].tmp	741,376 bytes
[filename of the sample #1]	[file and pathname of the sample #1]	81,920 bytes

Notes:

%Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).

Registry Modifications

The following Registry Keys were created:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\NoAdware 5.0_is1
HKEY_CURRENT_USER\Software\NoAdware5

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\NoAdware 5.0_is1]

Inno Setup: Setup Version = "5.2.1"
Inno Setup: App Path = "%ProgramFiles%\NoAdware5.0"
InstallLocation = "%ProgramFiles%\NoAdware5.0\"
Inno Setup: Icon Group = "NoAdware"
Inno Setup: User = "%UserName%"
Inno Setup: Selected Tasks = "desktopicon"
Inno Setup: Deselected Tasks = ""
DisplayName = "NoAdware v5.0"
UninstallString = ""%ProgramFiles%\NoAdware5.0\unins000.exe""
QuietUninstallString = ""%ProgramFiles%\NoAdware5.0\unins000.exe" /SILENT"
NoModify = 0x00000001
NoRepair = 0x00000001
InstallDate = "20090512"

[HKEY_CURRENT_USER\Software\NoAdware5]

pv = "5.0"
df = "noadware4_011108.na"
un = ""
rc = ""
ver = "1"
ras = "0"
sas = "0"
mtst = "0"
asl = "1"
scantype = 0x00000001
scnlg = "0"
abrs = "1"
acu = "0"
clsshlds = "0"
dntstrtshld = "0"
nowarn = "0"
Schedule Scan = "0"
Weekly Scan = "0"
Periodic = "0"
WeekDay = "0"
Period = "0"
Time = "0"
shup = "1"
ghmpg = "1"
hmpg = "about:blank"
gfv = "1"
iehj = "1"
hsts = "1"
rltime = "1"
acbl = "0"
path = "%ProgramFiles%\noadware5.0"
xpath = "%ProgramFiles%\noadware5.0\xblk.na"
lfp = "%ProgramFiles%\noadware5.0\logs"
rfp = "%ProgramFiles%\noadware5.0\noadware4_011108.na"
firstrun = "0"
cokieshld = "0"
strupshld = "1"
srchpge = "http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"

The following Registry Value was modified:

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]

Local Page = "\blank.htm"

Other details

Analysis of the file resources indicate the following possible country of origin:

Netherlands

The data identified by the following URL was then requested from the remote web server:

http://www.noadware.net/def/def_zip.html

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.

The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.