Submission Summary:

• Submission details:
• Submission received: 27 September 2008, 16:16:31
• Processing time: 4 min 37 sec
• Submitted sample:
• File MD5: 0xFBAC5D5FC9C3350A5CD015A577E5C2AA
• File SHA-1: 0xB8D3EF5186BB362912EC0C285C8A04C902385DAA
• Filesize: 110,077 bytes
• Alias:
• Win32.Virut.Gen.4 [PCTools]
• W32.Virut.W [Symantec]
• Virus.Win32.Virut.y [Kaspersky Lab]
• PWS-Gamania.gen.a [McAfee]
• PE_VIRUT.XV [Trend Micro]
• W32/Virut-V [Sophos]
• Virus:Win32/Virut.Q [Microsoft]

• Summary of the findings:

What's been found	Severity Level
Downloads/requests other files from Internet.
Modifies some system settings that may have negative impact on overall system security state.
Creates a startup registry entry.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! Characteristics of the following security risks were identified in the system:

Security Risk	Description
Trojan-PWS.Onlinegames.BS	Trojan.PWS.Onlinegames.BS is a Trojan that will start itself automatically and steal passwords of onlinegames on the infected machines.
Trojan-PWS.OnlineGames.ARun	Trojan-PWS.OnlineGames.ARun attempts to steal password information associated to popular online games such as MapleStory, Legend of Mir and World of Warcraft. It has the ability to spread itself via removable disk such as USB drives.

• Attention! The following threat categories were identified:

Threat Category	Description
	A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment
	A keylogger program that can capture all user keystrokes (including confidential details such username, password, credit card number, etc.)
	A virus capable to modify other files by infecting, prepending, or overwriting them them with its own body

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	c:\autorun.inf	537 bytes	MD5: 0xD5A2AEC96333FAF8A77C47A4655421D6 SHA-1: 0x4141C084E01559F510A8FA21A3D401145BF9AA4C	Trojan-PSW.Win32.OnLineGames.yoi [Kaspersky Lab] Mal/AutoInf-A [Sophos]
2	%Temp%\5qno.dll	26,707 bytes	MD5: 0x8B5AD96792052C71F84F23F53820181C SHA-1: 0xC25DC7A108C3D7BB8F8EE64100341EAEC0E786DF	Trojan-PWS.OnlineGames.ARun [PCTools] Bloodhound.Packed.Jmp [Symantec] Trojan-PSW.Win32.OnLineGames.yoi [Kaspersky Lab] PWS-Gamania.gen.a [McAfee] TROJ_ONLINEG.WDK [Trend Micro] Mal/EncPk-CE [Sophos] VirTool:WinNT/Vanti.gen!C [Microsoft]
3	c:\jiwsxh39.exe %System%\amvo.exe [file and pathname of the sample #1]	110,077 bytes	MD5: 0xFBAC5D5FC9C3350A5CD015A577E5C2AA SHA-1: 0xB8D3EF5186BB362912EC0C285C8A04C902385DAA	Win32.Virut.Gen.4 [PCTools] W32.Virut.W [Symantec] Virus.Win32.Virut.y [Kaspersky Lab] PWS-Gamania.gen.a [McAfee] PE_VIRUT.XV [Trend Micro] W32/Virut-V [Sophos] Virus:Win32/Virut.Q [Microsoft]
4	%System%\amvo0.dll %System%\amvo1.dll	70,656 bytes	MD5: 0x7D82232293A4DBEBB5C3F4DCA97C99F1 SHA-1: 0x28D4098F0162298327AB97B787F800E73FE79977	Trojan.Lineage.Gen!Pac.3 [PCTools] Trojan.Packed.NsAnti [Symantec] Trojan-PSW.Win32.OnLineGames.yoi [Kaspersky Lab] PWS-Gamania.gen.a [McAfee] Mal/EncPk-CE [Sophos] Worm:Win32/Taterf.A.dll [Microsoft]

• Notes:
• %Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).
• %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

Memory Modifications

• There were new processes created in the system:

Process Name	Process Filename	Main Module Size
amvo.exe	%System%\amvo.exe	221,184 bytes
[filename of the sample #1]	[file and pathname of the sample #1]	221,184 bytes

• The following module was loaded into the address space of other process(es):

Module Name	Module Filename	Address Space Details
amvo0.dll	%System%\amvo0.dll	Process name: explorer.exe Process filename: %Windir%\explorer.exe Address space: 0x1D10000 - 0x1D32000

• Notes:
• %Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.

Registry Modifications

• The newly created Registry Value is:
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
• amva = "%System%\amvo.exe"

so that amvo.exe runs every time Windows starts

• The following Registry Value was modified:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL]
• CheckedValue = 0x00000000

so that hidden files and folders are not displayed in explorer when browsing the file system

Other details

• The following Internet download was started (the retrieved bits are saved into the local file):