ThreatExpert Report

Submission Summary:

Submission details:

Submission received: 3 March 2009, 12:55:45
Processing time: 5 min 59 sec
Submitted sample:

File MD5: 0xFF87A5EE6472783276DDAF5F8D9B43EC
File SHA-1: 0xAF904E65A11A13B618A1A946496E5801EDAC3D35
Filesize: 417,792 bytes

Summary of the findings:

What's been found	Severity Level
Downloads/requests other files from Internet.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

Attention! Characteristics of the following security risk was identified in the system:

Security Risk	Description
Trojan.Lop_com	Lop.com bundled with other software such as Patchou's Messenger Plus, WarezP2P etc, adds a toolbar and favourites to your Internet Explorer, shortcut icons to your desktop, and shows occasional popup ads.

File System Modifications

The following file was created in the system:

#	Filename(s)	File Size	File Hash
1	[file and pathname of the sample #1]	417,792 bytes	MD5: 0xFF87A5EE6472783276DDAF5F8D9B43EC SHA-1: 0xAF904E65A11A13B618A1A946496E5801EDAC3D35

Memory Modifications

There was a new process created in the system:

Process Name	Process Filename	Main Module Size
[filename of the sample #1]	[file and pathname of the sample #1]	434,176 bytes

Registry Modifications

The following Registry Keys were created:

HKEY_CURRENT_USER\Software\OptionBowsBoob2
HKEY_CURRENT_USER\Software\OptionBowsBoob2\ReadmeDefy

The newly created Registry Value is:

[HKEY_CURRENT_USER\Software\OptionBowsBoob2]

knob software = 27 1E 91 32 6A F5 AF 41 4C FE 25 64 CE 93 BF E3 5F 18 40 96 AD 2C 3A D0 36 D8 B5 DF 08 CA A1 E4 5F 48 38 14 A7 F0 55 EE F1 9B B7 24 F1 1F A9 C5 5D 14 84 3B 28 74 19 85 22 5C 27 E1 F3 31 81 E5 CA 94 47 35 D2 95 03 8D 42 29 DC 19 46 F6 CE 52 67 57 B5 6

Other details

The data identified by the following URL was then requested from the remote web server:

http://b10748.nb.host-domain-lookup.com/bins/int/9kgen_up.int?fxp=886eba84886eec5a886eec5a92d97ed988247ccb0913fc1d9e5c03e22870ec5aa01e56de

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.

The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.