WORM_PKOOBF.SMC

WORM_PKOOBF.SMC (Trend Micro)

File size 86,016 bytes

MD5: CD077228E8AA41E740F2B924B443B2D6

SHA-1: 78FB24E29E94AADF6DA2A7F88A309AB15514D060

=================================================

Antivirus	Version	Last Update	Result
a-squared	4.5.0.48	2010.01.08	Trojan.Win32.Bredolab!IK
AhnLab-V3	5.0.0.2	2010.01.08	-
AntiVir	7.9.1.130	2010.01.08	-
Antiy-AVL	2.0.3.7	2010.01.08	-
Authentium	5.2.0.5	2010.01.08	-
Avast	4.8.1351.0	2010.01.08	-
AVG	8.5.0.430	2010.01.04	-
BitDefender	7.2	2010.01.09	-
CAT-QuickHeal	10.00	2010.01.08	-
ClamAV	0.94.1	2010.01.08	-
Comodo	3514	2010.01.08	-
DrWeb	5.0.1.12222	2010.01.08	-
eSafe	7.0.17.0	2010.01.07	-
eTrust-Vet	35.2.7226	2010.01.08	Win32/Koobface.B!generic
F-Prot	4.5.1.85	2010.01.08	-
F-Secure	9.0.15370.0	2010.01.08	-
Fortinet	4.0.14.0	2010.01.08	-
GData	19	2010.01.09	-
Ikarus	T3.1.1.80.0	2010.01.08	Trojan.Win32.Bredolab
Jiangmin	13.0.900	2010.01.08	-
K7AntiVirus	7.10.942	2010.01.08	-
Kaspersky	7.0.0.125	2010.01.09	-
McAfee	5855	2010.01.08	-
McAfee+Artemis	5855	2010.01.08	Artemis!CD077228E8AA
McAfee-GW-Edition	6.8.5	2010.01.08	-
Microsoft	1.5302	2010.01.08	-
NOD32	4755	2010.01.08	-
Norman	6.04.03	2010.01.08	-
nProtect	2009.1.8.0	2010.01.08	-
Panda	10.0.2.2	2010.01.08	-
PCTools	7.0.3.5	2010.01.09	-
Prevx	3.0	2010.01.09	-
Rising	22.29.04.04	2010.01.08	-
Sophos	4.49.0	2010.01.09	-
Sunbelt	3.2.1858.2	2010.01.08	-
Symantec	20091.2.0.41	2010.01.09	-
TheHacker	6.5.0.3.142	2010.01.08	-
TrendMicro	9.120.0.1004	2010.01.08	WORM_PKOOBF.SMC
VBA32	3.12.12.1	2010.01.06	-
ViRobot	2010.1.8.2128	2010.01.08	-
VirusBuster	5.0.21.0	2010.01.08	-

-------------------------------------------------------------------------------

File created

C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\alg.exe

C:\Documents and Settings\All Users\Application Data\Macromedia\SwUpdate\swupdate.dll

C:\Documents and Settings\All Users\Application Data\Macromedia\SwUpdate\UTemp.dtd

C:\Documents and Settings\All Users\Application Data\Macromedia\SwUpdate\Ui.dtd

C:\Documents and Settings\All Users\Application Data\Macromedia\SwUpdate\Local.dtd

C:\Documents and Settings\All Users\Application Data\Macromedia\SwUpdate\Flags.dtd

C:\Documents and Settings\All Users\Application Data\Macromedia\SwUpdate\B64.dtd

C:\Documents and Settings\All Users\Application Data\Macromedia\SwUpdate\B32.dtd

Keys added

HKLM\SOFTWARE\Classes\CLSID\

{009541A0-3B00-1F1C-00F3-040224001C01}

HKLM\SOFTWARE\Classes\CLSID\

{009541A0-3B00-1F1C-00F3-040224001C01}\InProcServer32

Values added

HKLM\SOFTWARE\Classes\CLSID\{009541A0-3B00-1F1C-00F3-040224001C01}\InProcServer32\: 43 3A 5C 44 6F 63 75 6D 65 6E 74 73 20 61 6E 64 20 53 65 74 74 69 6E 67 73 5C 41 6C 6C 20 55 73 65 72 73 5C 41 70 70 6C 69 63 61 74 69 6F 6E 20 44 61 74 61 5C 4D 61 63 72 6F 6D 65 64 69 61 5C 53 77 55 70 64 61 74 65 5C 73 77 75 70 64 61 74 65 2E 64 6C 6C

HKLM\SOFTWARE\Classes\CLSID\

{009541A0-3B00-1F1C-00F3-040224001C01}\InProcServer32\ThreadingModel: 41 70 61 72 74 6D 65 6E 74

HKLM\SOFTWARE\Classes\CLSID\

{009541A0-3B00-1F1C-00F3-040224001C01}\: 53 77 55 70 64 61 74 65

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\SwUpdate: 7B 30 30 39 35 34 31 41 30 2D 33 42 30 30 2D 31 46 31 43 2D 30 30 46 33 2D 30 34 30 32 32 34 30 30 31 43 30 31 7D

HKLM\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\

DomainProfile\AuthorizedApplications\List\C:\Documents and Settings\Administrator\Local Settings\Temp\alg.exe: "C:\Documents and Settings\Administrator\Local Settings\Temp\alg.exe:*:Enabled:Application Layer Gateway Service"

HKLM\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\

DomainProfile\AuthorizedApplications\List\C:\WINDOWS\system32\lsass.exe: "C:\WINDOWS\system32\lsass.exe:*:Enabled:LSA Shell"

HKLM\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\

StandardProfile\AuthorizedApplications\List\C:\Documents and Settings\Administrator\Local Settings\Temp\alg.exe: "C:\Documents and Settings\Administrator\Local Settings\Temp\alg.exe:*:Enabled:Application Layer Gateway Service"

HKLM\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\

StandardProfile\AuthorizedApplications\List\C:\WINDOWS\system32\lsass.exe: "C:\WINDOWS\system32\lsass.exe:*:Enabled:LSA Shell"

HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\

DomainProfile\AuthorizedApplications\List\C:\Documents and Settings\Administrator\Local Settings\Temp\alg.exe: "C:\Documents and Settings\Administrator\Local Settings\Temp\alg.exe:*:Enabled:Application Layer Gateway Service"

HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\

DomainProfile\AuthorizedApplications\List\C:\WINDOWS\system32\lsass.exe: "C:\WINDOWS\system32\lsass.exe:*:Enabled:LSA Shell"

HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\

StandardProfile\AuthorizedApplications\List\C:\Documents and Settings\Administrator\Local Settings\Temp\alg.exe: "C:\Documents and Settings\Administrator\Local Settings\Temp\alg.exe:*:Enabled:Application Layer Gateway Service"

HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\

StandardProfile\AuthorizedApplications\List\C:\WINDOWS\system32\lsass.exe: "C:\WINDOWS\system32\lsass.exe:*:Enabled:LSA Shell"

HKU\.DEFAULT\Software\Microsoft\Internet Explorer\BrowserEmulation\AllSitesCompatibilityMode: 0x00000001

HKU\S-1-5-21-796845957-1644491937-839522115-500\Software\Microsoft\Internet Explorer\BrowserEmulation\AllSitesCompatibilityMode: 0x00000001

HKU\S-1-5-18\Software\Microsoft\Internet Explorer\BrowserEmulation\AllSitesCompatibilityMode: 0x00000001

Values modified

HKLM\SYSTEM\ControlSet001\Services\SharedAccess\Epoch\Epoch: 0x000003A8

HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Epoch\Epoch: 0x000003A8