Submission Summary:

• Submission details:
• Submission received: 5 October 2012, 09:35:15
• Processing time: 13 min 55 sec
• Submitted sample:
• File MD5: 0xFC590204AFE21D1767FE25DBD535B687
• File SHA-1: 0x9950D4CEEB09A06F08540520FB74F6497113338F
• Filesize: 192,512 bytes
• Alias:
• Trojan:Win32/EyeStye.N [Microsoft]
• Trojan.Win32.Yakes [Ikarus]

• Summary of the findings:

What's been found	Severity Level
Downloads/requests other files from Internet.
Creates a startup registry entry.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! The following threat category was identified:

Threat Category	Description
	A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment

File System Modifications

• The following files were created in the system:

• The following directory was created:
• c:\asfd23f.Brf

Memory Modifications

• There were new processes created in the system:

Registry Modifications

• The following Registry Keys were created:
• HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\PhishingFilter
• HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Recovery
• HKEY_CURRENT_USER\Software\Microsoft Windows

• The newly created Registry Values are:
• [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\PhishingFilter]
• EnabledV8 = 0x00000000
• ShownServiceDownBalloon = 0x00000000
• [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Recovery]
• ClearBrowsingHistoryOnExit = 0x00000000
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
• ProxyHttp1.1 = 0x00000001
• WarnOnPostRedirect = 0x00000000
• WarnOnIntranet = 0x00000000
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0]
• 1409 = 0x00000003
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1]
• 1409 = 0x00000003
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2]
• 1409 = 0x00000003
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3]
• 1409 = 0x00000003
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4]
• 1409 = 0x00000003
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
• 8AVFYF4XZGUX6D1EYMOL = "C:\asfd23f.Brf\83186881DAE.exe /q"

so that 83186881DAE.exe runs every time Windows starts

Other details

• To mark the presence in the system, the following Mutex objects were created:
• Global\afwe323143ew34
• zXeRY3a_PtW
• Iexplore.XPExceptionFilter

• The following Host Names were requested from a host database:
• adidaspadlock.net
• www.microsoft.com
• capabilitesidentically.net
• ccedjapanese.net
• determinescepocket.net
• persistedcounts.net
• pupscoping.net
• resoundingpreios.net
• xmlpreand.net

• The following HTTP URL was started reading:
• http://www.microsoft.com/index.html