Submission Summary:

• Submission details:
• Submission received: 3 August 2008, 14:43:39
• Processing time: 7 min 50 sec
• Submitted sample:
• File MD5: 0xFBB72FEA8C0E528F257C4B59EA9291CC
• File SHA-1: 0x078B2176EFE61872DB4B386DD9B4F1F79421F84D
• Filesize: 1,871,872 bytes
• Alias:
• W32.IRCBot [Symantec]
• Trojan:Win32/Womcodi.gen [Microsoft]

• Summary of the findings:

What's been found	Severity Level
Capability to terminate Antivirus, Firewall and other security related processes.
Creates a startup registry entry.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! Characteristics of the following security risk was identified in the system:

Security Risk	Description
Trojan-Dropper.Agent.CE	Trojan-Dropper.Agent.CE is a trojan dropper that drops and executes other malicious threats which will try to download additional malware onto the infected computer.

• Attention! The following threat categories were identified:

Threat Category	Description
	A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment
	A malicious backdoor trojan that runs in the background and allows remote access to the compromised system

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%UserProfile%\!\! # Blaze Media Pro 6.1 crack.zip %UserProfile%\!\! # eBay Entrepreneur Kit (updated).zip %UserProfile%\!\! # SiSoftware Sandra XII SP1 CRACK.zip %UserProfile%\!\! #CRACK #Wizardbrush 6.zip %UserProfile%\!\! #CRACK# F-Secure Anti-Virus 2008.zip %UserProfile%\!\! #CRACK# SpyRemover 2.74.zip %UserProfile%\!\! #CRACK#News Rover 11.zip %UserProfile%\!\! (9Down COM) Microsoft.Desktop.Optimization.Pack.2008.For.Software.Assurance.x86.and.x64-ETH0.zip %UserProfile%\!\! (9Down COM)3DMark.Vantage.Professional.v1.0.Incl.Keymaker-CORE.zip %UserProfile%\!\! (9Down.COM) Kaspersky Emergency CD 2008 ISO.zip %UserProfile%\!\! -CDRoller v7 00 - Crack Included.zip %UserProfile%\!\! Advanced Karaoke Player v3.5.zip %UserProfile%\!\! Advanced Karaoke Player v3.6.zip %UserProfile%\!\! Advanced Karaoke Player3.3.zip %UserProfile%\!\! Angel iPod Video and PSP Video Converter V1.8.zip %UserProfile%\!\! Angel Video Converter v1.7.zip %UserProfile%\!\! Any DVD Converter Professional 3.5.3.zip %UserProfile%\!\! AnyDVD & AnyDVD HD 6.3.0.7 - RES.zip %UserProfile%\!\! AnyDVD & AnyDVD HD 6.3.0.8.zip %UserProfile%\!\! ANYDVD 6.3.0.6 [FUSION].zip %UserProfile%\!\! ANYDVD EHD 6.3.1.0.zip %UserProfile%\!\! Ashampoo.Movie.Shrink.and.Burn.3.v3.02-TE.zip %UserProfile%\!\! AsianSuite X2 5 crack.zip %UserProfile%\!\! Assist for Excel 1.6.0.586 for Office 2007 [FUSIONTEAM].zip %UserProfile%\!\! Auction Wizard 2008for ebay sellers or buers rar.zip %UserProfile%\!\! AutoRun Professional 3.1.6.zip %UserProfile%\!\! BulletProof FTP Client 2 Cracker.zip %UserProfile%\!\! Cheetah DVD Burner Cracker.zip %UserProfile%\!\! CLONEDVD 2.9.1.5 FINAL.zip %UserProfile%\!\! CloneDVDtrade; 2.9.1.3.zip %UserProfile%\!\! Crack Photo Pos Pro.zip %UserProfile%\!\! Cracked CoffeeCup Direct FTP 6.2.zip %UserProfile%\!\! Crazy Talk 4.6 RETAIL [FUSIONTEAM].zip %UserProfile%\!\! Create For Excel v3.0.0.322 for Office 2007 [FUSIONTEAM].zip %UserProfile%\!\! DVDFab Platinum 4.0.5.0 [FUSIONTEAM].zip %UserProfile%\!\! DVDFAB PLATINUM 4.0.5.5.zip %UserProfile%\!\! elby CloneDVDtrade; 2.9.1.3.zip %UserProfile%\!\! FREE - FLV Player v2.0.24.zip %UserProfile%\!\! Fresh Diagnose 7.74 crack.zip %UserProfile%\!\! K Media Center v7 6 mininova.zip %UserProfile%\!\! K-Lite Codec Pack 3.95 full.zip %UserProfile%\!\! Kaspersky Blacklist Key Patch - WORKS 100x100.zip %UserProfile%\!\! Kaspersky Internet Security 2008 Updated With Working Key.zip %UserProfile%\!\! LView Pro 2006 Serial.zip %UserProfile%\!\! OfficeReady 4.0 Professional [FUSIONTEAM].zip %UserProfile%\!\! Portable Internet Explorer 7 - Amazing don't need activation.zip %UserProfile%\!\! Real VNC 4 4 1 (June 2008 release).zip %UserProfile%\!\! Registry Mechanic 7 cracker.zip %UserProfile%\!\! Sateira CD&DVD Burner 2.71 Cracker.zip %UserProfile%\!\! SERIAL Ashampoo PowerUp 3.zip %UserProfile%\!\! SlySoft.CloneDVD.v2.9.1.4.Incl.KeyMaker-DVT.zip %UserProfile%\!\! SpyHunter 3.2 CRACK.zip %UserProfile%\!\! TextAloud 2.261 CRACK.zip %UserProfile%\!\! Tournament Indicator v1 0 4 WinAll Cracked-ZARDOZ.zip %UserProfile%\!\! Winning POKE (R) system 2007 odds software for windows xp.zip %UserProfile%\!\! WinRAR v3.80 FINAL Cracked - NEW!!!.zip %UserProfile%\!\! Xara3D 6.0 SERIAL.zip %UserProfile%\!\! [FUSION] CoffeeCup Flash Firestarter 7 Crack.zip %UserProfile%\!\! [FUSION] GoldWave 5 crack.zip %UserProfile%\!\! [FUSION] HyperCam Crack.zip %UserProfile%\!\! [FUSION] LiangZhu Software Photo To Color Sketch v6.65,Lz0.zip %UserProfile%\!\! [FUSION] LimeWire Pro v4.16.0 WinAll Retail-TUkEY.zip %UserProfile%\!\! [FUSION] Maximum Software PC Power Suite v1.2005 Pro Retail.zip %UserProfile%\!\! [FUSION] NXPowerLite v3.0.5 INCL.KEYMAKERCORE.zip %UserProfile%\!\! [FUSION] PhotoFiltre Studio 9.1.0 All languages.AT4RE.zip %UserProfile%\!\! [FUSION] Recover Lost Data 3.1.2.2-EMBRACE.zip %UserProfile%\!\! [FUSION] Spyware Doctor 5.5.0.178 Final.zip %UserProfile%\!\! [FUSION] Xp To Mac Transformation Pack 3.5.zip %UserProfile%\!\!! (9Down COM) Cyberlink PowerDVD Ultra v8 0 Multilingual Full KeyGen.zip %UserProfile%\!\!! Avira AntiVir GmbH PersonalEdition Classic (Great Free Antivirus).zip %UserProfile%\!\!! CleanCenter KeyGen.zip %UserProfile%\!\!! Free Youtube Downloader.zip %UserProfile%\!\!! MioMap v3 2 Western and Central maps, cracked [pda - wm5 - MULTI22].zip %UserProfile%\!\!! Software and Games for N95 - Pack 3 [JARSIS - MULTI].zip %UserProfile%\!\!! [FUSION] Gertrudis Pro 3.5.zip %UserProfile%\!\!! [FUSION] PCDJ VJ v1.0.6-EDGE.zip %UserProfile%\!\!! [FUSION] Power Data Recovery 4.0.0.zip %UserProfile%\!\!!! AMAZING Webcam Program !!! Fix8.zip %UserProfile%\!\!!! Crack Media Jukebox 8.0.zip %UserProfile%\!\!!!!!![DVD ReBuilder 1.26.6 PRO] FUSIONTEAM.ORG.zip %UserProfile%\!\!!!!![FUSION] DVDFAB PLATINUM 4.0.4.0 - RES.zip %UserProfile%\!\!!!!skins for winamp!!!! zip.zip %UserProfile%\!\!!!![FUSION] TwistedBrushPro15 04 RES rar.zip %UserProfile%\!\!!!Core FTP Lite 2.0 build 1539 Serial.zip %UserProfile%\!\!!!HideIP1 12 CRACK-UNION!!!.zip %UserProfile%\!\!!!IP Shifter v2 2 2-CRACKED!!!.zip %UserProfile%\!\!!!Kaspersky Anti-Virus 7 0 1 325 crack fresh keys!!!.zip %UserProfile%\!\!!!NEW Firegraphic 9.0.9 crack.zip %UserProfile%\!\!!!NEW!!! Nero Burning Rom 6 3 0 0 ITA Keygen Mp3PRO Plugin zip.zip %UserProfile%\!\!!!Portrait Professional Max v6 3 5-CRACKED!!!.zip %UserProfile%\!\!!!Satellite TV for PC Elite Edition!!!.zip %UserProfile%\!\!!!Tekken138!!! Cyberlink PowerDVD 8 Setup.zip %UserProfile%\!\!!!WinPatrol 2007 Crack.zip %UserProfile%\!\!!-1-CREW-winrar370pro-SEC-RELEASE.zip %UserProfile%\!\!![FUSION] SWIFTDOG Products Pack 2008.zip %UserProfile%\!\!150 Brushes for Adobe Photoshop.zip.zip %UserProfile%\!\!CValley FILTERiT v4.2 for Adobe Illustrator - FOSI [FUSION].zip %UserProfile%\!\!DAEMON Tools Pro Advanced v4 12 220[www Demonoid com].zip %UserProfile%\!\!Digital Element Aurora 2.10 for Photoshop [FUSION].zip %UserProfile%\!\!Divx Pro v6 8 3 9[www Demonoid com].zip	15,231 bytes	MD5: 0x920500D965DECEA51BB22D572FEDE4E7 SHA-1: 0x78ADD6472C3598C50F7868306AF917A47057A3C7	Backdoor.Trojan [Symantec] Trojan.Win32.Agent.uvi [Kaspersky Lab]
2	%UserProfile%\!\#1 DVD RIPPER.zip %UserProfile%\!\34-programs for pc by gpn7.zip %UserProfile%\!\3D.Studio.Max.9 Tutorials Keygen.nfo - TheFinder.zip %UserProfile%\!\3gp video converter.zip %UserProfile%\!\6001.18000.080118-1840_iso_client_sp_wave0-frmcsp0_dvd.img.zip %UserProfile%\!\78 Flash sites by Designload.net.zip %UserProfile%\!\Abexo Registry Cleaner 5.3.zip %UserProfile%\!\Absolute MP3 Splitter & Converter 2.7.1.zip %UserProfile%\!\ACDSee Photo Manager v10.0.238 English.zip %UserProfile%\!\Ace Utilities 4.1.1 Build 4053.zip %UserProfile%\!\Acker.DVD.Ripper.v2.0.80.Incl.Keygen-Lz0.zip %UserProfile%\!\Acronis Disk Director Server 10.0 Build 2169.zip %UserProfile%\!\Acronis Recovery for MS SQL Server 1.0.150.zip %UserProfile%\!\Acronis True Image Echo Server 9.5.8018.zip %UserProfile%\!\Acronis True Image Enterprise Server 9.1 with Universal Restore.zip %UserProfile%\!\Active File Recovery 7.3 Build 101.zip %UserProfile%\!\Active.Partition.Recovery.v5.1.595.Enterprise [App].rar.zip %UserProfile%\!\ActivePartition Recovery Enterprise 5.1.595 - RETAIL.zip %UserProfile%\!\Ad-Aware.2007-7.0.2.6-MKDEV.TEAM.LATEST.UPDATE.zip %UserProfile%\!\Adobe Audition 3.0.zip %UserProfile%\!\Adobe Photoshop CS3 10 Extended Crack.zip %UserProfile%\!\Adobe Photoshop CS3 Extended Full.zip %UserProfile%\!\Adobe Photoshop CS3 Extended [Keygen Included].zip %UserProfile%\!\Adobe Photoshop Lightroom 1.3.1 Multilingual.zip %UserProfile%\!\Adobe PhotoshopCS3 Crack Working 100 % !.zip %UserProfile%\!\Advanced XP Tweak v2.52 Build 272.zip %UserProfile%\!\Aimersoft DVD Ripper v1.1.14 Keygen.zip %UserProfile%\!\Alcohol 120% 1.9.6 Build 5429 Retail - TheOneX.zip %UserProfile%\!\Alcohol 120% 1.9.7.6022.zip %UserProfile%\!\AltoMP3 Gold CD Ripper 5.12.zip %UserProfile%\!\Amiga Format Coverdisc AFCD47 (magazine Issue 131).zip %UserProfile%\!\AmpliTube 2.1.2 Jimi Hendrix 1.0.1.zip %UserProfile%\!\Anapod Explorer 9.0.3 with Keygen.zip %UserProfile%\!\AnyDVD.HD.6.3.0.3-RES.rar.zip %UserProfile%\!\Apollo DVD Copy v4.8.13.zip %UserProfile%\!\Arial Audio Converter 2.3.62.zip %UserProfile%\!\ArtRage v2.5.19 Full Edition.zip %UserProfile%\!\ArtyTorrent Pack 44-Hip Hop Drum Loops 100-109 bpm-WAV samples.zip %UserProfile%\!\ArtyTorrent Pack 45-RnB Funk Drum Loops 100-109 bpm-WAV sample.zip %UserProfile%\!\ArtyTorrent Pack 46-Rock Drum Loops 100-109 bpm-WAV samples.zip %UserProfile%\!\ArtyTorrent Pack 47-Audio Damage VST FX plug-ins-Liquid, Replica.zip %UserProfile%\!\ArtyTorrent Pack 48-Downtempo Disco House Loops 110-109 bpm-WAV.zip %UserProfile%\!\ArtyTorrent Pack 49-Electro Drum Loops 110-119 bpm-WAV samples.zip %UserProfile%\!\ArtyTorrent Pack 50-MusicLab RealStrat Guitar VSTi DXi Crack.zip %UserProfile%\!\Audacity 1.3.4 Beta (Unicode).zip %UserProfile%\!\Audio Enhancement Megapack for ALL Players.zip %UserProfile%\!\Aurora Media Workshop 3.3.47.zip %UserProfile%\!\Autocad 2008 CZ.zip %UserProfile%\!\Backup4all Professional Multilang 3.10.289.zip %UserProfile%\!\Blackmagic - cracked.zip %UserProfile%\!\Boris Final Effect Complete v5.0 Crack[ App][MULTI].rar.zip %UserProfile%\!\BSplayer Pro MultiLang 2.26 Build 956.zip %UserProfile%\!\BusinessCards MX v3.42.zip %UserProfile%\!\C-Xbox tools v2.0.6.zip %UserProfile%\!\Call of duty 4 Linux server.zip %UserProfile%\!\Camfrog Video Chat 4.0.61 by Shazz.zip %UserProfile%\!\Camtasia.Studio.v5.0.2.PRECRACKED - Christley.zip %UserProfile%\!\CCleaner v2.04.543 Full Version.zip %UserProfile%\!\Cheetah DVD Burner 2.25.zip %UserProfile%\!\Cinema Craft Encoder SP2.zip %UserProfile%\!\Clean MemXP v9.2.zip %UserProfile%\!\clone.rar.zip %UserProfile%\!\CoffeeCup Visual Site Designer 5.8.zip %UserProfile%\!\Collectorz.com.Movie.Collector.Pro.v5.4.1 Crack [App].rar.zip %UserProfile%\!\ConvertHQ Premium 1.1.0.1.zip %UserProfile%\!\Coral Draw X4.zip %UserProfile%\!\CoreAVC Professional Edition.v1.6.5.0 Key [App].rar.zip %UserProfile%\!\CorelDRAW Graphics Suite X4 14.0 FULL.zip %UserProfile%\!\CU Amiga magazine Super CD-ROM 23 (June 1998).zip %UserProfile%\!\Cucusoft DVD to iPhone Converter Suite.zip %UserProfile%\!\Cucusoft Full Version iPod Video Converter DVD to iPod Suite.zip %UserProfile%\!\Cucusoft Ultimate DVD Video Converter Suite 7.8.7.6.zip %UserProfile%\!\CuteFTP 8.1.0 Build 11.12.2007.7 Professional Edition.zip %UserProfile%\!\CyberScrub Privacy Suite Professional Edition 5.0.0.126.zip %UserProfile%\!\CyberScrub V5.zip %UserProfile%\!\Dameware NT Utilities 6.7.0.2.zip %UserProfile%\!\Dameware NT Utilities 6.7.0.3.zip %UserProfile%\!\Dameware NT Utilities 6.7.0.5.zip %UserProfile%\!\DAZ 3D Cararra 6 Pro - Hexagon 2.2 and Bonus Content Suite.zip %UserProfile%\!\Daz3D - Morph Loader 1.8.1.zip %UserProfile%\!\Denso Saab 9-5 Navigation WESTERN EUROPE.zip %UserProfile%\!\Dorlands Spellcheck.iso.zip %UserProfile%\!\DownloadStudio 4.0.2.0.zip %UserProfile%\!\Dreamlinux 3.0 beta 3.zip %UserProfile%\!\Droppix Recorder 2.5.2.zip %UserProfile%\!\DVD Fab Platinum 4.0.6.2 (with serial key).zip %UserProfile%\!\DVD-Cloner V 5.10 Build 967.zip %UserProfile%\!\DVDFab Platinium 4.0.5.5 Full-Ghosthunter.zip %UserProfile%\!\DVDFab Platinum & Gold 3.2.1.0 Patch.zip %UserProfile%\!\DVDFab Platinum 4.0.5.5 -FULL Personalized.zip %UserProfile%\!\DVDInfo Pro HD.v4.79 Key [App].rar.zip %UserProfile%\!\Easy CD-DA Extractor 11.1.1.1.zip %UserProfile%\!\Elby CloneDVD 2.9.1.5 - Final.zip %UserProfile%\!\Elecard XMuxer Pro 2.5.71213.zip %UserProfile%\!\Emulator bios files.zip %UserProfile%\!\EpGuides.com Watcher.zip %UserProfile%\!\EVERYTHING ABOUT THE LINUX KERNEL.zip %UserProfile%\!\Extra Video Converter v1.0.0.1 (2008) Crack [App].rar.zip %UserProfile%\!\eXtreme Movie Manager 6.1.1.0 Deluxe Edition.zip %UserProfile%\!\eyetoy drivers, fully working.zip	15,231 bytes	MD5: 0x0FEE073B381279439F7A5C629B26CA63 SHA-1: 0x7CA6EB2EA7E40C2208F6B3A05CE2499618741AFB	(not available)
3	%UserProfile%\svchost.exe [file and pathname of the sample #1]	1,871,872 bytes	MD5: 0xFBB72FEA8C0E528F257C4B59EA9291CC SHA-1: 0x078B2176EFE61872DB4B386DD9B4F1F79421F84D	W32.IRCBot [Symantec] Trojan:Win32/Womcodi.gen [Microsoft]

• Note:
• %UserProfile% is a variable that specifies the current user's profile folder. By default, this is C:\Documents and Settings\[UserName] (Windows NT/2000/XP).

• The following directory was created:
• %UserProfile%\!

Memory Modifications

• There were new processes created in the system:

Process Name	Process Filename	Main Module Size
svchost.exe	%UserProfile%\svchost.exe	1,871,872 bytes
[filename of the sample #1]	[file and pathname of the sample #1]	1,871,872 bytes

Registry Modifications

• The newly created Registry Value is:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
• Host Process = "%UserProfile%\svchost.exe"

so that svchost.exe runs every time Windows starts