Submission Summary:

• Submission details:
• Submission received: 7 November 2009, 17:28:49
• Processing time: 8 min 59 sec
• Submitted sample:
• File MD5: 0x205DB6FF3429A288F7C6E3A62F592831
• File SHA-1: 0xB3EF7F2E0B3082D29DB7FECDA4B5CD873BCC17EE
• Filesize: 150,016 bytes
• Alias:
• Packed.Win32.Krap.ag [Kaspersky Lab]
• Mal/Krap-A [Sophos]

• Summary of the findings:

What's been found	Severity Level
Downloads/requests other files from Internet.
Creates a startup registry entry.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! Characteristics of the following security risk was identified in the system:

Security Risk	Description
Trojan.FakeAlert	Trojan.FakeAlert will hijack the desktop background with an image alerting the user that their computer system has been infected with spyware. It also changes some settings of windows which include:- disabling permissions for the user to change the background image and setting the active desktop to 'show web content'. It is usually installed in conjunction with a rogue anti-spyware application.

File System Modifications

• The following file was created in the system:

Memory Modifications

• There was a new process created in the system:

Registry Modifications

• The following Registry Keys were created:
• HKEY_CURRENT_USER\Software\TurboNet
• HKEY_CURRENT_USER\Software\XML

• The newly created Registry Values are:
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
• TurboNet = "[file and pathname of the sample #1]"

so that [file and pathname of the sample #1] runs every time Windows starts

• [HKEY_CURRENT_USER\Software\TurboNet]
• Az2 = "xC7aKZ+O6wyPlq1krRM4sG7m2LFGsYtHjHOagBf10Uk/n4gL8s8xs9LeD5KQVh3/j+XFa0mnr175UElKKyciA2gn6tUEA721Fj4P"
• Av2 = 0x01CA60DC
• Av3 = 0x3B040030
• Av6 = 0x00000004
• Av6 = 0x00000005

Other details

• To mark the presence in the system, the following Mutex objects were created:
• NfeAhn02Gc9NqPBvmEc8
• Global\{CC0CEB4A-442B-43d2-803D-A415683D1045}

• The following ports were open in the system:

• The following Host Names were requested from a host database:
• thepicturesonline.com
• searchproductkey.com

• The following Internet Connections were established: