ThreatExpert Report: DNSChanger.gen, Worm.Win32.AutoRun.nuu, Generic!atr, W32/Autorun-KO..

Submission Summary:

Submission details:

Submission received: 2 November 2008, 09:30:12
Processing time: 6 min 10 sec
Submitted sample:

File MD5: 0x04DD45D9F68C741646C2680AAB41F8D9
File SHA-1: 0x15A15ED0B44CA1ABC5E7EC3BEBFA14E01591DE93
Filesize: 97,562 bytes
Alias: DNSChanger.gen [McAfee]

Summary of the findings:

What's been found	Severity Level
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

Attention! Characteristics of the following security risks were identified in the system:

Security Risk	Description
Trojan-Downloader.Agent!sd6	Trojan-Downloader.Agent!sd6 attempts to download malicious files to the local computer and execute them.
Trojan.Fakeavalert!sd6	Trojan.Fakeavalert!sd6 is a malicious program that does not infect other files but may represents security risk for your computer and/or network environment.

Attention! The following threat categories were identified:

Threat Category	Description
	A network-aware worm that attempts to replicate across the existing network(s)
	A program that downloads files to the local computer that may represent security risk
	A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment

File System Modifications

The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	c:\autorun.inf	103 bytes	MD5: 0x73726CD0474FBB7DB602E5B4D6D27525 SHA-1: 0x31223CD75C1392F6186260BBF336EB30DF11617B	Worm.Win32.AutoRun.nuu [Kaspersky Lab] Generic!atr [McAfee] W32/Autorun-KO [Sophos] Trojan:Win32/Alureon!inf [Microsoft]
2	%Temp%\tmp4.tmp	7,466 bytes	MD5: 0xCB2726F1ED9697CE626ADBB9E91E9FF1 SHA-1: 0xC179132467D3D4759E1D73E82F0994AADB40B843	Trojan-Downloader.Agent!sd6 [PCTools] W32.SillyDC [Symantec] Trojan-Downloader.Win32.Agent.ahcg [Kaspersky Lab] W32/Autorun.worm.bl [McAfee] Trojan:Win32/Alureon.gen!O [Microsoft]
3	%Temp%\tmp5.tmp	616,960 bytes	MD5: 0x11519FE91FBC53B89172B58F581AA993 SHA-1: 0xE5C7072BA69E4F83E0CE7B8326173FC5DCE046B2	Trojan.Fakeavalert!sd6 [PCTools] Trojan.Fakeavalert [Symantec] Generic.dx [McAfee] W32/Autorun-KO [Sophos]
4	%Temp%\WERf592.dir00\appcompat.txt	16,296 bytes	MD5: 0xF560A82E9385739415E085B4553CBA8F SHA-1: 0x958B55E9517896C07D689F6BDDED4EF10D0718A9	(not available)
5	%Temp%\WERf592.dir00\manifest.txt	1,720 bytes	MD5: 0x38AFC6C182200D871D079177D5B566F1 SHA-1: 0xC38010B24D66C652CD8ECF2B25AB61A616912176	(not available)
6	%Temp%\WERf592.dir00\spoolsv.exe.hdmp	2,403,657 bytes	MD5: 0x75BB6F020FAFD774EBDABD498C9D21A3 SHA-1: 0x3F4214B363747D404AD7416A872ACF61CB97F4DB	(not available)
7	%Temp%\WERf592.dir00\spoolsv.exe.mdmp	52,564 bytes	MD5: 0x19C41C6785BFE9226B649FC30B3F0FED SHA-1: 0x58D111E8298B3EE13896C69CEA7AA9BDCDE5E3C8	(not available)
8	%Programs%\sexvid\Uninstall.lnk	683 bytes	MD5: 0xB73EA9353EE6EF8F52B7A507727A9C98 SHA-1: 0x1FEE205560D43C1A4EFB7B5532597211A4043390	(not available)
9	%ProgramFiles%\sexvid\Uninstall.exe	62,548 bytes	MD5: 0x47B73258795617B6C46C635F2E9DFF66 SHA-1: 0xFF4C99DEC3C8879E7C0DDBD1771D301D6D28FA97	(not available)
10	c:\resycled\boot.com	28,672 bytes	MD5: 0xCF845A781C107EC1346E849C9DD1B7E8 SHA-1: 0xB44CCC7F7D519352422E59EE8B0BDBAC881768A7	(not available)
11	[file and pathname of the sample #1]	97,562 bytes	MD5: 0x04DD45D9F68C741646C2680AAB41F8D9 SHA-1: 0x15A15ED0B44CA1ABC5E7EC3BEBFA14E01591DE93	DNSChanger.gen [McAfee]
12	%Windir%\Temp\tmp6.tmp	28,672 bytes	MD5: 0xE635BDE0CD1752B02DF8CFA3C35959DA SHA-1: 0x96AFFB7F91D1ADDF8526324EBC8D5234D125A6F0	DNSChanger.gen [McAfee] Trojan:Win32/Alureon.gen!J [Microsoft]

Notes:

%Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).
%Programs% is a variable that refers to the file system directory that contains the user's program groups. A typical path is C:\Documents and Settings\[UserName]\Start Menu\Programs.
%ProgramFiles% is a variable that refers to the Program Files folder. A typical path is C:\Program Files.
%Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.

The following directories were created:

%Temp%\WERf592.dir00
%Programs%\sexvid
%ProgramFiles%\sexvid
c:\resycled

Memory Modifications

There were new processes created in the system:

Process Name	Process Filename	Main Module Size
[filename of the sample #1]	[file and pathname of the sample #1]	217,088 bytes
jah30003.exe	%Temp%\jah30003.exe	65,536 bytes
boot.com	c:\resycled\boot.com	65,536 bytes

The following module was loaded into the address space of other process(es):

Module Name	Module Filename	Address Space Details
dll.dll	%System%\dll.dll	Process name: spoolsv.exe Process filename: %System%\spoolsv.exe Address space: 0x10000000 - 0x100041BC

Notes:

%System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

Registry Modifications

The following Registry Keys were created:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\sexvid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\sexvid\CLSID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\sexvid
HKEY_CURRENT_USER\Software\sexvid
HKEY_CURRENT_USER\Software\{NSINAME}

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*]

DocumentInfo = 0x00000047
GlobalTip = 0x00000BFF
AutoTip = "??

[{]

x}" = HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*

[Reserved]

0x6C8E9D09 = HKEY_LOCAL_MACHINE\SOFTWARE\Classes\sexvid\CLSID

[(Default)]

"{6BF52A52-394A-11D3-B153-00C04F79FAA6}" = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\sexvid
"%ProgramFiles%\sexvid" = HKEY_CURRENT_USER\Software\{NSINAME}

[UninstallString]

""%ProgramFiles%\sexvid\Uninstall.exe"" = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\sexvid

[InstallLocation]

"%ProgramFiles%\sexvid" = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\sexvid

[DisplayName]

"sexvid" = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\sexvid

[DisplayIcon]

"%ProgramFiles%\sexvid\Uninstall.exe,0" = HKEY_CURRENT_USER\Software\sexvid

The following Registry Values were modified:

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ServiceCurrent]

(Default) = 0x0000000C

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ServiceCurrent]

(Default) = 0x0000000C

Other details

There was registered attempt to establish connection with the remote host. The connection details are:

Remote Host	Port Number
78.157.142.108	80

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.

The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.