Norman Scanner Engine 5.90.  7
Sandbox 05.90, dated 21/01-2006

Your message ID (for later reference): 20060224-027

nepenthes-12fe829615cd1dffd114f5514c69dc44-eraseme_47461.exe : [SANDBOX] contains a security risk - W32/Downloader (Signature: W32/SDBot.YRY)
 [ General information ]
    * **IMPORTANT: PLEASE SEND THE SCANNED FILE TO: ANALYSIS@NORMAN.NO - REMEMBER TO ENCRYPT IT (E.G. ZIP WITH PASSWORD)**.
    * Anti debug/emulation code present.
    * File length:        61440 bytes.
    * MD5 hash: 12fe829615cd1dffd114f5514c69dc44.

 [ Changes to filesystem ]
    * Creates file C:\WINDOWS\win32ssr.exe.
    * Creates file C:\U.exe.

 [ Changes to registry ]
    * Creates key "HKLM\Software\\Microsoft\\Windows".
    * Sets value "MeltMe"="c:\sample.exe" in key "HKLM\Software\\Microsoft\\Windows".
    * Creates key "HKLM\System\CurrentControlSet\Services\Win32Sr".
    * Sets value "ImagePath"=""C:\WINDOWS\win32ssr.exe"" in key "HKLM\System\CurrentControlSet\Services\Win32Sr".
    * Sets value "DisplayName"="Win32Sr" in key "HKLM\System\CurrentControlSet\Services\Win32Sr".

 [ Network services ]
    * Downloads file from http://http.down.love.witlog.com/tds.exe as C:\U.exe.

 [ Security issues ]
    * Starting downloaded file - potential security problem.

 [ Process/window information ]
    * Creates service "Win32Sr (Win32Sr)" as ""C:\WINDOWS\win32ssr.exe"".

 [ Signature Scanning ]
    * C:\WINDOWS\win32ssr.exe (61440 bytes) : W32/SDBot.YRY.
    * C:\U.exe (4096 bytes) : no signature detection.

File downloaded from http://http.down.love.witlog.com/tds.exe - recognized as type PE_I386

nepenthes-12fe829615cd1dffd114f5514c69dc44-eraseme_47461.exe_Download.tmp : W32/Rootkit.AI.dropper (Signature: NO_VIRUS)
 [ General information ]
    * **IMPORTANT: PLEASE SEND THE SCANNED FILE TO: ANALYSIS@NORMAN.NO - REMEMBER TO ENCRYPT IT (E.G. ZIP WITH PASSWORD)**.
    * File length:        26624 bytes.
    * MD5 hash: 952e07ec0077f25ea55c844c38bb43ef.

 [ Changes to filesystem ]
    * Creates file C:\WINDOWS\SYSTEM32\DRIVERS\netpt.sys.

 [ Changes to registry ]
    * Creates key "HKLM\System\CurrentControlSet\Services\NetPT".
    * Sets value "ImagePath"="system32\DRIVERS\netpt.sys" in key "HKLM\System\CurrentControlSet\Services\NetPT".
    * Sets value "DisplayName"="NetBIOS Protection" in key "HKLM\System\CurrentControlSet\Services\NetPT".

 [ Process/window information ]
    * Creates service "NetPT (NetBIOS Protection)" as "system32\DRIVERS\netpt.sys".

 [ Signature Scanning ]
    * C:\WINDOWS\SYSTEM32\DRIVERS\netpt.sys (3712 bytes) : W32/Rootkit.AI.


(C) 2004-2006 Norman ASA. All Rights Reserved.

The material presented is distributed by Norman ASA as an information source only.

Sent by removed@email.com to sandbox.


Received 24.Feb 2006 at 01.18 - processed 24.Feb 2006 at 01.22.