Submission Summary:

• Submission details:
• Submission received: 10 April 2009, 05:09:17
• Processing time: 6 min 2 sec
• Submitted sample:
• File MD5: 0xEDF654FC52D47D93FCA1BC37E8D9E5A1
• File SHA-1: 0x7FF7672B72BD45228347B400A684E6D1754299AE
• Filesize: 363,008 bytes
• Alias:
• W32.SillyFDC [Symantec]
• Virus.Win32.Sality.aa [Kaspersky Lab]
• W32/Sality.gen [McAfee]
• PE_SALITY.BU [Trend Micro]
• Mal/Sality-B [Sophos]
• Virus:Win32/Sality.AM [Microsoft]
• Worm.Win32.Noxjasm [Ikarus]
• Win32/Kashu.B [AhnLab]

• Summary of the findings:

What's been found	Severity Level
Sets the drive to autoplay by creating autorun.inf file in its root directory. If the drive is shared across the network then other remote computers can be infected any time they try to access this share.
Downloads/requests other files from Internet.
Modifies some system settings that may have negative impact on overall system security state.
Creates a startup registry entry.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! Characteristics of the following security risk was identified in the system:

Security Risk

Description

Worm.IM.Sohanad

Worm.IM.Sohanad spreads via Yahoo Messenger and infects Windows. It sends a message to all Yahoo Messenger contacts of an infected user. The message contains a link enticing users to download the worm. The worm also disable certain Windows functionalities abd hijacks Internet Explorer homepage. It also downloads other maware and it will also attempt to propagate via the means of creating copies of itself onto removable devices such as USB flash and hard drives.

• Attention! The following threat category was identified:

Threat Category	Description
	A virus capable to modify other files by infecting, prepending, or overwriting them them with its own body

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	c:\autorun.inf %System%\autorun.ini	103 bytes	MD5: 0x9C62D87DD836FDD9BA5AFCE8FF0B3D22 SHA-1: 0x22D5D6F10301394C382586D5E256EF7C316D0ABD	Virus.Win32.AutoIt.f [Kaspersky Lab] Virus.Win32.AutoIt [Ikarus]
2	%Temp%\0004B6D9_Rar\[filename of the sample #1] %Temp%\0005A88C_Rar\logoneui.exe %Temp%\0005D5C6_Rar\logoneui.exe c:\Jojo.exe c:\logoneui.exe %System%\logoneui.exe [file and pathname of the sample #1] %Windir%\Web\connection.dat	363,008 bytes	MD5: 0xEDF654FC52D47D93FCA1BC37E8D9E5A1 SHA-1: 0x7FF7672B72BD45228347B400A684E6D1754299AE	W32.SillyFDC [Symantec] Virus.Win32.Sality.aa [Kaspersky Lab] W32/Sality.gen [McAfee] PE_SALITY.BU [Trend Micro] Mal/Sality-B [Sophos] Virus:Win32/Sality.AM [Microsoft] Worm.Win32.Noxjasm [Ikarus] Win32/Kashu.B [AhnLab]
3	c:\info.bat	345 bytes	MD5: 0x09582DF94BC67FA984B8C0D251DEC636 SHA-1: 0x7BA09FA1F94D1124CE6E3D811819AADCC5E76555	(not available)
4	%System%\boote\boot.ini	211 bytes	MD5: 0xFA579938B0733B87066546AFE951082C SHA-1: 0x944710DBCD4A072F95A32EA9A23BB749E22D53B4	(not available)

• Notes:
• %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).
• %Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).
• %Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.

• The following file was deleted:
• c:\boot.ini

• The following directories were created:
• %Temp%\0004B6D9_Rar
• %Temp%\0005A88C_Rar
• %Temp%\0005D5C6_Rar
• %System%\boote

Memory Modifications

• There were new processes created in the system:

Process Name	Process Filename	Main Module Size
[filename of the sample #1]	[file and pathname of the sample #1]	806,912 bytes
logoneui.exe	%System%\logoneui.exe	806,912 bytes

Registry Modifications

• The following Registry Keys were created:
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System
• HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer
• HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control Panel

• The newly created Registry Values are:
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
• NofolderOptions = 0x00000001

to remove the Folder Options item from all Windows Explorer menus and from Control Panel

• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
• DisableTaskMgr = 0x00000001
• DisableRegistryTools = 0x00000001

to prevent users from starting Task Manager (Taskmgr.exe)
to disable the Windows registry editors (Regedt32.exe and Regedit.exe)

• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
• firewall 2008 = "%System%\logoneui.exe"

so that logoneui.exe runs every time Windows starts

• [HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control Panel]
• HomePage = "1"

• The following Registry Values were modified:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
• Shell = "Explorer.exe logoneui.exe"

so that logoneui.exe runs every time Windows starts

• [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
• Start Page = "http://famous2.topcities.com"

Other details

• Analysis of the file resources indicate the following possible country of origin:

	United Kingdom

• To mark the presence in the system, the following Mutex objects were created:
• Op1mutx9
• _!SHMSFTHISTORY!_

• The following Internet Connection was established:

• The following GET requests were made:
• index.html
• index.jpg