YOHOHO-INSTALL[1].EXE

Currently being reviewed

The most common objects with the name of YOHOHO-INSTALL[1].EXE have yet to be classified as safe by our research department.

If you are concerned that your PC might be infected why not try our Free Webroot Cloud AntiVirus Beta. It will thoroughly check your PC for millions of active Spyware and malware infections and takes less than 2 minutes. Don't put your confidential data, or your identity at risk, check your PC now with Webroot Cloud AntiVirus Beta.

Download Now »

File Behavior

YOHOHO-INSTALL[1].EXE has been seen to perform the following behavior:

Adds products to the system registry
This process creates other processes on disk
Executes a Process
This Process Deletes Other Processes From Disk
Writes to another Process's Virtual Memory (Process Hijacking)
Can communicate with other computer systems using HTTP protocols
Creates new folders on the system
Injects code into other processes
Performs DNS look ups to resolve URL IP addresses
Creates system tray popups, messages, errors and security warnings
Uses DNS to retrieve the IP address for web sites

YOHOHO-INSTALL[1].EXE has been the subject of the following behavior:

Deleted as a process from disk
Created as a process on disk
Executed as a Process
Executed by Internet Explorer
Has code inserted into its Virtual Memory space by other programs

Country Of Origin

The filename YOHOHO-INSTALL[1].EXE was first seen on Jun 20 2008 in the following geographical regions of the Webroot community:

The United States on Jun 20 2008
on Jun 21 2008
Spain on Aug 14 2008
The United Kingdom on Nov 7 2010

Filesizes

The following file size has been seen:

597,939 bytes
450,221 bytes
600,928 bytes
597,938 bytes

File Type

The filename YOHOHO-INSTALL[1].EXE refers to many versions of an executable program.

File Activity

One or more files with the name YOHOHO-INSTALL[1].EXE creates, deletes, copies or moves the following files and folders:

create folder C:\Program Files\Three Rings Design
create folder C:\Program Files\Three Rings Design\Puzzle Pirates
Deletes c:\docume~1\user\locals~1\temp\nsb7.tmp
Deletes c:\docume~1\user\locals~1\temp\nsr9.tmp
Creates c:\docume~1\user\locals~1\temp\nsr9.tmp\UserInfo.dll
Creates c:\docume~1\user\locals~1\temp\nsr9.tmp\NSISdl.dll
Creates c:\docume~1\user\locals~1\temp\java.zip

Network Activity

One or more files with the name YOHOHO-INSTALL[1].EXE performs the following network events:

DNS Lookup93.188.128.23 download.threerings.net

Website Activity

One or more files with the name YOHOHO-INSTALL[1].EXE interacts with the following web sites and pages. Web addresses have been deliberately modified to prevent unintentional use.

Port 80 IP:93.188.128.23

Help the Webroot Community to fight cyber crime

We are always looking for ways to improve the quality and speed of research to help us protect you from malicious software and cyber crime.

Virus, Spyware & Malware Center »