Submission Summary:

• Submission details:
• Submission received: 28 January 2009, 08:48:47
• Processing time: 6 min 13 sec
• Submitted sample:
• File MD5: 0xFC039650B5152A40C5637FCD1ABCD4C6
• File SHA-1: 0xDE4165FF888794BFB6511096DA831701AAC0B453
• Filesize: 10,240 bytes
• Alias:
• Trojan.Virantix!sd6 [PCTools]
• Trojan.Virantix [Symantec]
• Generic Dropper.bu [McAfee]
• Mal/EncPk-EQ [Sophos]
• TrojanDownloader:Win32/Renos [Microsoft]
• Virus.Win32.Virut.au [Ikarus]

• Summary of the findings:

What's been found	Severity Level
Downloads/requests other files from Internet.
Modifies some system settings that may have negative impact on overall system security state.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! Characteristics of the following security risks were identified in the system:

Security Risk	Description
Adware.Agent.ZO	Adware.Agent.ZO lowers some IE security settings and downloads RogueAntiSpyware without user's permission.
Trojan.Virantix!sd6	Trojan.Virantix!sd6 is a malicious program that does not infect other files but may represents security risk for your computer and/or network environment.

• Attention! The following threat category was identified:

Threat Category	Description
	A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	[file and pathname of the sample #1]	10,240 bytes	MD5: 0xFC039650B5152A40C5637FCD1ABCD4C6 SHA-1: 0xDE4165FF888794BFB6511096DA831701AAC0B453	Trojan.Virantix!sd6 [PCTools] Trojan.Virantix [Symantec] Generic Dropper.bu [McAfee] Mal/EncPk-EQ [Sophos] TrojanDownloader:Win32/Renos [Microsoft] Virus.Win32.Virut.au [Ikarus]
2	%System%\wini10253.exe	0 bytes	MD5: 0xD41D8CD98F00B204E9800998ECF8427E SHA-1: 0xDA39A3EE5E6B4B0D3255BFEF95601890AFD80709	(not available)

• Note:
• %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

Memory Modifications

• There was a new process created in the system:

Registry Modifications

• The newly created Registry Values are:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0]
• 1208 = 0x00000000
• 2500 = 0x00000003
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1]
• 1208 = 0x00000000
• 2500 = 0x00000003
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2]
• 1208 = 0x00000000
• 2500 = 0x00000003
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3]
• 1208 = 0x00000000
• 2500 = 0x00000003
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4]
• 1208 = 0x00000000
• 2500 = 0x00000003
• [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
• Enable Browser Extensions = "yes"
• Search Bar = "http://www.google.com/ie"
• [HKEY_CURRENT_USER\Software\Microsoft\Security Center]
• AntiVirusDisableNotify = 0x00000001
• FirewallDisableNotify = 0x00000001
• UpdatesDisableNotify = 0x00000001

to disable notification of firewall, antivirus and/or update status through the Windows Security Center

• The following Registry Values were modified:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main]
• Default_Search_URL = "http://www.google.com/ie"
• Search Page = "http://www.google.com"
• Start Page = "http://www.google.com"
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Search]
• SearchAssistant = "http://www.google.com"
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0]
• 1201 = 0x00000000
• 1804 = 0x00000001
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1]
• 1201 = 0x00000000
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2]
• 1201 = 0x00000000
• 1804 = 0x00000001
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3]
• 1201 = 0x00000000
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4]
• 1200 = 0x00000000
• 1201 = 0x00000000
• 1608 = 0x00000000
• 1804 = 0x00000001
• [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
• Start Page = "http://www.google.com"
• Search Page = "http://www.google.com"

Other details

• To mark the presence in the system, the following Mutex object was created:
• {432780427656663764673647663354632}

• The following Internet Connection was established:

• The following GET requests were made:
• index.html
• index.jpg

• The following Internet downloads were started (the retrieved bits are saved into the local file):