Prevx Research Division
.EXE
Malicious SoftwareFree PC Cleanup from Webroot
Use Webroot SecureAnywhere to remove .EXE.
"Just when you thought it couldn't get any better or faster. The Webroot scanning engine is 'high octane' with a hidden nitrous oxide system. Bravo!!!" W. Lodzinski, SecureAnywhere User
File Behavior
.EXE has been seen to perform the following behavior:
- Executes a Process
- The Process is packed and/or encrypted using a software packing process
- This process creates other processes on disk
- Automatically changes your firewall settings to allow itself or other programs to communicate over the internet
- Writes to another Process's Virtual Memory (Process Hijacking)
- This Process Deletes Other Processes From Disk
- Executes Processes stored in Temporary Folders
- Terminates Processes
- Disables the Notification Balloon for the Windows Security Center
- Disables Access to the Task Manager built into Windows
- Disables Access to the Windows Registry Editior
- Modifies Windows Security Policies to restrict/expand User Privileges on the machine
- Adds products to the system registry
- Adds a Registry Key (RUN) to auto start Programs on system start up
- Adds a Link in the Start Menu
- Deletes Links in the Start Menu
- Creates a TCP port which listens and is available for communication initiated by other computers
- Can make outbound communication to other computers, IM chat rooms and other services using IRC protocols
- Can communicate with other computer systems using HTTP protocols
- Registers a Dynamic Link Library File
- Downloads program file(s) and other content from the web
- Injects code into other processes
- Copies files
- Uses Instant Messaging to communicate without the user's knowledge
- Uses embeded Instant Message Channel Settings
- Found on infected systems and resists interrogation by security products
- Uses low level functions to hide itself from the user and from system/security processes
- Ability to execute files automatically on your PC
- Disables the Windows Built in Firewall enabling rogue processes to access the internet without your knowledge or permission
- Disables Windows Automatic Updates including Security Updates and Patches
- Disables the Windows Security Center Service
- Creates system tray popups, messages, errors and security warnings
- Uses DNS to retrieve the IP address for web sites
- Uses your PC to connect to Chat rooms
.EXE has been the subject of the following behavior:
- Created as a process on disk
- Deleted as a process from disk
- Executed as a Process
- Has code inserted into its Virtual Memory space by other programs
- Added as a Registry auto start to load Program on Boot up
- Added as a Link in the Start Menu
- Deleted as a Link in the Start Menu
- Terminated as a Process
- Copied to multiple locations on the system
- Registered as a Dynamic Link Library File
Country Of Origin
The filename .EXE was first seen on May 20 2007 in the following geographical regions of the Webroot community:
- Germany on May 20 2007
- The United States on May 20 2007
- Spain on Sep 27 2007
- Uzbekistan on Jun 6 2008
- Thailand on Aug 23 2008
- on Sep 11 2008
- Namibia on Feb 10 2009
- Estonia on Feb 15 2010
- Canada on Feb 15 2010
File Name Aliases
.EXE can also use the following file names:
- PROGRAMS.EXE
- STARTUP.EXE
- START MENU.EXE
- DESKTOP.EXE
- ACROBAT 5.0.EXE
- ANNEKE.EXE
- ANNEKE ENGL. 2ND LANG. GRADE 5.EXE
- APPS.EXE
- BMS.EXE
- BMS INSTALLATION PROGRAM.EXE
- CAD11.EXE
- CAD90.EXE
- CADDIE 9.0.EXE
- CITY OF WINDHOEK.EXE
- CMDCONS.EXE
- CONFIG.MSI.EXE
- DIVTOOLS.EXE
- DOCUMENTS AND SETTINGS.EXE
- DRIVERS.EXE
- DYLAN SKOOL KONSERT 2008.EXE
- ENGLISH 1ST LANG. PRESENT PERFECT.EXE
- EOI 2008.EXE
- ERINDI.EXE
- GARMIN.EXE
- HASPEMULPE.XP.EXE
- HUAB PROPERTIES.EXE
- JAG NAWEEK.EXE
- KLEINMOND.EXE
- LOISE ANDREAS.EXE
- MSOCACHE.EXE
- PAYMENTS.EXE
- PNP.EXE
- PROGRAM FILES.EXE
- RECYCLER.EXE
- RHINO PARK.EXE
- RMS.EXE
- SAMPLE DRAWINGS.EXE
- TEMPEI4.EXE
- UNZIPPED.EXE
- VIDEOS.EXE
- VIEWER.EXE
- WINDOWS.EXE
- COBUS FOTO'S.EXE
- DECEMBER 2006.EXE
- DYLAN.EXE
- FOTO'S.EXE
- FOUND.000.EXE
- HEYMAN AUSSIES.EXE
- KARIN & TINUS.EXE
- KARIN + THINUS.EXE
- MARIETTE NAM.EXE
- MONIKA.EXE
- MY DOCUMENTS.EXE
- MY SKYPE PICTURES.EXE
- OLIVER.EXE
- OLIVER DOOP.EXE
- ONDANGWA OFFICE.EXE
- ONGWEDIVA EXT 11.EXE
- WCE.EXE
- PACKARD BELL.EXE
- DRIVER.EXE
- MY DVDS.EXE
- MY SCANS.EXE
- DXGDIALOG.EXE
- ĀļŠĀļąĀļĄĀļĄĀļĀļēĀđĀļĻĀļĢĀļĐĀļĀļĀļīĀļĀļĀļĀđĀļĀļĩĀļĒĀļ.EXE
- ĀđĀļŠĀļ§ĀļĀļēĀļĀļĀđĀļĀļĩĀļĒĀļĀļĀļĩĀđĀļŦĀļēĀļĀđĀļŦĀļĀđ.EXE
- ĀđĀļĀļĢĀļĀļĀļēĀļĢĀļĀļĢĀļ°ĀļĀļļĀļĄĀļŠĀļąĀļĄĀļĄĀļĀļēĀđĀļĀļĢĀļ·ĀļĀļĀđĀļēĀļĒĀļĻĀļķĀļĀļĐĀļēĀļĀļīĀđĀļĀļĻĀļĀđ(ĀļĀļēĀļĀļĀļĩĀđĀļĀļ).EXE
- ĀđĀļĀļĢĀļĀļĀļēĀļĢĀļĀļĢĀļ°ĀļĀļļĀļĄĀļŠĀļąĀļĄĀļĄĀļĀļēĀļŊĀļ§ĀļīĀļĀļĒĀļēĀļĀļĢ ĀļĻĀļĀļ.51 ĀļŦĀļĀļĀļĀļĀļēĀļĒ.EXE
- ĀđĀļĀļĢĀļĀļĀļēĀļĢĀļĀļĢĀļ°ĀļĀļļĀļĄĀļŠĀļąĀļĄĀļĄĀļĀļēĀļŊĀļŠĀļĀļēĀļĀļĻĀļķĀļĀļĐĀļēĀļĀļĀđĀļĀļĩĀļĒĀļ Āļ§ĀļąĀļĀļĀļĩĀđ 7-9.EXE
- ĀļĀļģĀđĀļĀļĩĀļĒĀļĀļĀļĢĀđĀļē.EXE
- ĀļĀļēĀļĀļēĀļŠĀļēĀļĢĀļ°.EXE
- ĀđĀļĀļŦĀļĨĀļ§Āļ.EXE
- ĀļĀļĢĀļ°ĀļĀļļĀļĄĀļŠĀļąĀļĄĀļĄĀļĀļēĀđĀļĀļīĀļĀļĀļĀļīĀļĀļąĀļĀļīĀļĀļēĀļĢ ÂĀđĀļĀļĢĀļ·ĀļĀļĀđĀļēĀļĒĀļĻĀļķĀļĀļĐĀļēĀļĀļīĀđĀļĀļĻĀļĀđĀđĀļĻĀļĢĀļĐĀļĀļĀļīĀļĀļĀļĀđĀļĀļĩĀļĒĀļĀļŠĀļđĀđĀļŠĀļĀļēĀļĀļĻĀļķĀļĀļĐĀļēÂ.EXE
- ĀđĀļĄĀļ·ĀļĀļĀđĀļĻĀļĢĀļĐĀļĀļĀļīĀļĀļĀļĀđĀļĀļĩĀļĒĀļ.EXE
- ĀļĢĀļēĀļĒĀļĀļēĀļĀđĀļĀļīĀļĀļĀļēĀļ.EXE
- ĀļĨĀļēĀļĒĀđĀļĀđĀļĀļĀđ.EXE
- ĀļĀļąĀļĀļĀļąĀđĀļĀļĀļąĀļŠĀļĀļļ.EXE
- WEB ĀļĀļąĀļ.EXE
- AHDV_VIRUS.EXE
- RECYCLERS-1-6-21-6875689567-0328346474-238463292-3211.EXE
- DCIM.EXE
- ENGLISH SONG.EXE
- MY PICTURE.EXE
- SILLY FOOLS - KING SIZE.EXE
- SILLY FOOLS ĀļĀļąĀļĨĀļĀļąĀđĀļĄ THE ONE.EXE
- SWEET MULET AND RESTROSPECT.EXE
- ĀđĀļĀļĨĀļĀđĀļĀļĨĀļ.EXE
- āđāļāļĨāļ.EXE
- ĀļĢĀļđĀļ.EXE
- CLIPART.EXE
- Āļ§ĀļīĀļĀļĒĀļēĀļĀļīĀļĀļĀļĀđ(APPLE).EXE
- POWERPOINT.EXE
- POWERPOINT[n].EXE
- TITIRAT LAOHAPAKDEE.EXE
- TITIRAT LAOHAPAKDEE[n].EXE
- ĀļĀļēĀļĀđĀļĀļ.EXE
- ĀļĀļēĀļĀđĀļĀļ[n].EXE
- ĀļĀļēĀļĀļ.ĀđĀļ.EXE
- ĀļĀļēĀļĀļ.ĀđĀļ[n].EXE
- ĀļĀļēĀļĀđĀļĢĀļĀđĀļĢĀļĩĀļĒĀļ.EXE
- ĀļĀļēĀļĀđĀļĢĀļĀđĀļĢĀļĩĀļĒĀļ[n].EXE
- ĀļĢĀļđĀļ[n].EXE
- Āļ§ĀļīĀļĀļĒĀļēĀļĀļīĀļĀļĀļĀđĀļĨĀđĀļēĀļŠĀļļĀļ(JANG).EXE
- Āļ§ĀļīĀļĀļĒĀļēĀļĀļīĀļĀļĀļĀđĀļĨĀđĀļēĀļŠĀļļĀļ(JANG)[n].EXE
- Āļ§ĀļīĀļĀļĒĀļēĀļĀļīĀļĀļĀļĀđ(ĀļĀļĩĀđJUNE).EXE
- Āļ§ĀļīĀļĀļĒĀļēĀļĀļīĀļĀļĀļĀđ(ĀļĀļĩĀđJUNE)[n].EXE
- ĀļĀļĩĀđĀļĀļīĀļĀļĄ.EXE
- ĀļĀļĩĀđĀļĀļīĀļĀļĄ[n].EXE
- Āļ§ĀļīĀļĀļĒĀļēĀļĀļīĀļĀļĀļĀđ(APPLE)[n].EXE
- āđāļāļĢāđāļāļĢāļĄ.EXE
- FLOOD.EXE
- GUNTER.EXE
- SEAL.EXE
- MY MUSIC.EXE
- MY PICTURES.EXE
- MY VIDEOS.EXE
- MY DUCUMENTS.EXE
- SCHEDL.EXE
- NETBEANS-6.1-ML-WINDOWS(2).EXE
- NETBEANS-6.1-ML-WINDOWS[1].EXE
- NETBEANS-6.1-ML-WINDOWS.EXE
- NETBEANS.6_1.EXE
- CUVELAI ANGOLAN TOPO MAPS.EXE
- āđāļāļĩāđāļĒāđāļĨāļĩāđāļĒāļ āļ.āđāļāđ.EXE
- NEW FOLDER.EXE
- ĀļĀļĢĀļ°ĀļĀļđĀļĨ_ĀđĀļĀļĩĀļĒĀļĢĀļĀļīĀļĀļīĀļĀļĀļīĀļĀļĀļĐĀđ.EXE
- ZUMA.EXE
- ĀļĀļđĀđĀđĀļĀļīĀļ Āļ.Āļ.ĀļŠ.EXE
- SYSTEM.EXE
- NVIWISH.EXE
- MEEX.EXE
- āļĢāļēāļĒāļāļēāļāļŠāđāļ āļāļāļ .EXE
- P[1].GIF
- E.EXE
- C.EXE
- D.EXE
- ĀļĀļĻ3.EXE
- ĀÎ
- !ITW#1.VXE
- L29B#2.EXE
Filesizes
The following file size has been seen:
- 228,444,572 bytes
- 207,655 bytes
- 339,968 bytes
- 516,096 bytes
- 110,592 bytes
- 43,869 bytes
- 249,856 bytes
- 7,846 bytes
File Type
The filename .EXE is used by multiple object types including objects,executable programs.
File Activity
One or more files with the name .EXE creates, deletes, copies or moves the following files and folders:
- Deletes c:\program files\common files\system\.exe
- Deletes c:\program files\common files\microsoft shared\.exe
- Moves c:\program files\common files\system\.exe to c:\program files\common files\system\ygdgss
- Moves c:\program files\common files\microsoft shared\.exe to c:\program files\common files\microsoft shared\ygdgss
- Moves c:\windows\svchost.exe to c:\windows\lfewvn
- Moves c:\windows\system32\niu.exe to c:\windows\system32\lfewvn9
- Moves c:\windows\system32\sbl.dll to c:\windows\system32\lfewvn20
- Moves c:\windows\system32\wniapsvr.exe to c:\windows\system32\lfewvn
- Moves c:\windows\system32\Shell.exe to c:\windows\system32\lfewvn3
- Moves c:\windows\system32\Shell.pci to c:\windows\system32\lfewvn4
- Moves c:\windows\system32\crsss.exe to c:\windows\system32\lfewvn6
- Moves c:\windows\system32\chost.exe to c:\windows\system32\lfewvn19
- Moves c:\windows\ctfm0n.exe to c:\windows\lfewvn23
- Moves c:\windows\system32\NATIVE.EXE to c:\windows\system32\lfewvn24
- Moves c:\windows\system32\directx.exe to c:\windows\system32\lfewvn5
- Moves c:\windows\system32\progmon.exe to c:\windows\system32\lfewvn1
- Moves c:\windows\system32\internt.exe to c:\windows\system32\lfewvn2
- Moves c:\windows\system32\SoftDLL.dll to c:\windows\system32\lfewvn7
- Moves c:\windows\system32\MySetup.exe to c:\windows\system32\lfewvn8
- Moves c:\windows\system32\SocksA.exe to c:\windows\system32\lfewvn12
- Moves c:\windows\system32\algssl.exe to c:\windows\system32\lfewvn16
- Moves c:\windows\system32\chostbl.exe to c:\windows\system32\lfewvn25
- Moves c:\windows\system32\lovesbl.dll to c:\windows\system32\lfewvn26
- Moves c:\windows\system32\netdde .exe to c:\windows\system32\lfewvn27
- Moves c:\windows\system32\svrhost.dll to c:\windows\system32\lfewvn22
- Moves c:\windows\system32\wnipsvr.exe to c:\windows\system32\lfewvn21
- Moves c:\windows\Session.exe to c:\windows\lfewvn11
- Moves c:\windows\system32\algsrvs.exe to c:\windows\system32\lfewvn13
- Moves c:\windows\system32\msfun80.exe to c:\windows\system32\lfewvn14
- Moves c:\windows\system32\msime82.exe to c:\windows\system32\lfewvn15
- Moves c:\windows\system32\msime80.exe to c:\windows\system32\lfewvn17
- Moves c:\windows\system32\msfir80.exe to c:\windows\system32\lfewvn18
- Moves c:\windows\system32\fixfile.exe to c:\windows\system32\lfewvn11
- Moves c:\windows\system32\WMDSINFO.dll to c:\windows\system32\lfewvn12
- Moves c:\windows\system32\Mcshie1d.exe to c:\windows\system32\lfewvn13
- Moves c:\windows\system32\Exp1orer.exe to c:\windows\lfewvn21
- Moves c:\windows\system32\compobj32.dll to c:\windows\system32\lfewvn10
- Moves c:\windows\system32\snownClean.exe to c:\windows\system32\lfewvn28
- Moves c:\windows\web\css.css to c:\windows\web\lfewvn
- Moves c:\windows\system32\com\lsass.exe to c:\windows\system32\com\lfewvn
- Deletes c:\program files\1.hi
- Deletes c:\program files\2.hi
- Moves c:\windows\system32\ime\svchost.exe to c:\windows\system32\ime\lfewvn
- Moves c:\windows\system32\com\smss.exe to c:\windows\system32\com\lfewvn1
- Moves c:\windows\debug\debug.exe to c:\windows\debug\lfewvn
- Moves c:\windows\tools\explorer.exe to c:\windows\tools\lfewvn
- Moves c:\windows\system32\drivers\csrss.exe to c:\windows\system32\drivers\lfewvn
- Moves c:\program files\common files\microsoft shared\msinfo\system.2dt to c:\program files\common files\microsoft shared\msinfo\lfewvn3
- Moves c:\program files\common files\microsoft shared\msinfo\newtemp.dll to c:\program files\common files\microsoft shared\msinfo\lfewvn4
- Moves c:\program files\common files\microsoft shared\msinfo\NewInfo.bmt to c:\program files\common files\microsoft shared\msinfo\lfewvn5
Help the Webroot Community to fight cyber crime
We are always looking for ways to improve the quality and speed of research to help us protect you from malicious software and cyber crime.
PCMag.com Editors' Choice Award Logo is a trademark of Ziff Davis Publishing Holdings Inc. Used under license.