Submission Summary:

• Submission details:
• Submission received: 19 January 2008, 16:19:39
• Processing time: 3 min 25 sec
• Submitted sample:
• File MD5: 0x5786EA6F31F8AECA3FC70B4ECF0EEF18
• Filesize: 55,808 bytes
• Alias: Adware.Vundo.V.Gen [PCTools]

• Summary of the findings:

What's been found	Severity Level
Capability to block security-related software by modifying firewall settings and by disabling security services, such as Windows Update, Norton Autoprotect, Kaspersky Anti-Virus, etc.
Threat characteristics of Vundo (aka VirtuMonde/VirtuMundo), a trojan horse that cause popups and advertises rogue antispyware programs. Vundo can be installed by visiting a Web site link contained in a spammed email. It is known to create a DLL file in the Windows system32 directory and inject it into system processes winlogon.exe and explorer.exe.
Registers a Winlogon notification package so that the installed module is loaded into the address space of winlogon.exe.
Registers a 32-bit in-process server DLL.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! Characteristics of the following security risk was identified in the system:

Security Risk	Description
Trojan.Virtumonde	Virtumonde modifies the Windows Internet connection mechanism and display various pop-up advertisements.

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%Temp%\removalfile.bat	43 bytes	MD5: 0x9A7EF09167A6F4433681B94351509043	(not available)
2	%System%\yaywwur.dll	38,400 bytes	MD5: 0xFB72FBCB114B88BBDAD5FCBCAC64B65E	Adware.Vundo.V.Gen [PCTools]

• Notes:
• %Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).
• %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

Memory Modifications

• There was a new process created in the system:

• The following modules were loaded into the address space of other process(es):

Module Name	Module Filename	Address Space Details
yaywwur.dll	%System%\yaywwur.dll	Process name: explorer.exe Process filename: %Windir%\explorer.exe Address space: 0x19B0000 - 0x19C4000
yaywwur.dll	%System%\yaywwur.dll	Process name: IEXPLORE.EXE Process filename: %ProgramFiles%\internet explorer\iexplore.exe Address space: 0x1B20000 - 0x1B34000

• Notes:
• %Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.
• %ProgramFiles% is a variable that refers to the Program Files folder. A typical path is C:\Program Files.

Registry Modifications

• The following Registry Keys were created:
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5AAF23D8-4489-43D8-A064-319D1254ABCA}
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5AAF23D8-4489-43D8-A064-319D1254ABCA}\InprocServer32
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\Settings
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\yaywwur
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\00cd0861

• The newly created Registry Values are:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5AAF23D8-4489-43D8-A064-319D1254ABCA}\InprocServer32]
• (Default) = "%System%\yaywwur.dll"
• ThreadingModel = "Both"
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\Settings]
• Time = 20 16 28 21 83 51 C8 01 00 00 00 00
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
• {5AAF23D8-4489-43D8-A064-319D1254ABCA} = ""
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\yaywwur]
• Asynchronous = 0x00000001
• DllName = "yaywwur.dll"
• Impersonate = 0x00000000
• Logon = "o"
• Logoff = "f"

so that yaywwur.dll is installed as a Winlogon notification package

• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\00cd0861]
• (Default) = "A91FE206B0B441D793ADE1C11C88B399&"
• [HKEY_CURRENT_USER\Software\Microsoft\Installer]
• (Default) = F8 5C 3A 22 83 51 C8 01

Other details

• There was application-defined hook procedure installed into the hook chain (e.g. to monitor keystrokes). The installed hook is handled by the following module:
• %System%\yaywwur.dll