Prevx Research Division
DATE.EXE
Cloaked MalwareFree PC Cleanup from Webroot
Use Webroot SecureAnywhere to remove DATE.EXE.
"Just when you thought it couldn't get any better or faster. The Webroot scanning engine is 'high octane' with a hidden nitrous oxide system. Bravo!!!" W. Lodzinski, SecureAnywhere User
Associated Malware Groups
The unsafe files using this name are associated with the malware groups:
- Cloaked Malware
- Malicious Software
File Behavior
DATE.EXE has been seen to perform the following behavior:
- The Process is packed and/or encrypted using a software packing process
- Executes a Process
- Ability to execute files automatically on your PC
- Modifies Windows Security Policies to restrict/expand User Privileges on the machine
- Disables Windows Automatic Updates including Security Updates and Patches
- Disables the Notification Balloon for the Windows Security Center
- Disables the Windows Built in Firewall enabling rogue processes to access the internet without your knowledge or permission
- Disables the Windows Security Center Service
- This process creates other processes on disk
- Adds a Link in the Start Menu
- This Process Deletes Other Processes From Disk
- Registers a Dynamic Link Library File
- This Process is a file infector which modifies program files to include a copy of the infection
- Drops known malicious software during execution
- Includes file creation code which could be used to test for interception by security products
DATE.EXE has been the subject of the following behavior:
- Created as a process on disk
- Executed as a Process
- Added as a Link in the Start Menu
- Deleted as a process from disk
- Copied to multiple locations on the system
Country Of Origin
The filename DATE.EXE was first seen on Sep 15 2007 in the following geographical regions of the Webroot community:
- The United States on Sep 15 2007
- Australia on Sep 15 2007
- on Oct 19 2007
- Spain on May 29 2009
- Brazil on May 21 2012
- Ireland on May 21 2012
File Name Aliases
DATE.EXE can also use the following file names:
- DATE_001.EXE
- LAPORAN.EXE
- MALANG STUDY TOUR.EXE
- WINWORD.EXE
- SERVICES.EXE
- ADOBE GAMMA LOADER.COM
- EXERCISE QUESTION JESSICA II UJP-32.EXE
- KANTOR POLISI KABUPATEN.EXE
- LASKAR PELANGI.EXE
- SURAT PERJANJIAN.EXE
- COVER CD CE ADELLA (GRE SUB).EXE
- ID CARD ZOE.NET (DEPAN).EXE
- ID CARD ZOE.NET (BELAKANG).EXE
- COVER CD KECIL.EXE
- COVER CAMPUR SARI.EXE
- LABEL CD PAS.EXE
- PROPOSAL.EXE
- SURAT PENAWARAN SDI AL-FALAH.EXE
- SUB STUDY TOUR.EXE
- SURAT KUASA.EXE
- SURAT PENAWARA SMPK ETIKA DHARMA.EXE
- FS SJ.EXE
- COVER UPN BERWARNA.EXE
- LOGO UPN HITAM PUTIH.EXE
- LOGO UNAIR FAK HUKUM.EXE
- COVER UPN BERWARNA F.EXE
- INTERNATIONAL KEANO.EXE
- CARA BOOKING CAPELLO.EXE
- CARA INTER TOTTI.EXE
- HISTORY Y TITIN.EXE
- ENTRY CODE CRS DOM.EXE
- ENTRY RESERVASI DOM.EXE
- ENTRY_RESERVASI.EXE
- ISSUED GA DOM.EXE
- ENTRY RESERVASI.EXE
- FS GA.EXE
- ENTRY CODE CRS GALILEO.EXE
- ISTILAH IN'T.EXE
- WEB. FLIGHT.EXE
- SURAT PENAWARAN DINAS.EXE
- BATU AND BROMO FANTASTIC TOUR.EXE
- BATU AND BROMO FUNTASIC.EXE
- RICO.EXE
- UJIAN PRAKTEK.EXE
- JURNAL KEG UYAB.EXE
- BAB IV PENUTUP + LAMP.EXE
- COVER LAPORAN UYAB.EXE
- BAYU PRPOSL INFORM.EXE
- BAYU POPSL COMETY.EXE
- RESTO UBUD BAYU.EXE
- UYAB PILE1.EXE
- STRUKTUR ORGANISASI.EXE
- UYAB PILE.EXE
- UYAB PENDAHULUAN.EXE
- LEMBAR PENGESAHAN BAYU.EXE
- DAFTAR RIWAYAT HIDUP BAYU.EXE
- DAFTAR RIWAYAT HIDUP BAYUANYAR.EXE
- BABI GUIDING.EXE
- BABI TIKETING.EXE
- BAYU BUKTI BLAJAR TIKETING.EXE
- BABI TPLLANING.EXE
- PROJECTWORRK BRO!!!!.EXE
- COVER DEPAN GUIDING.EXE
- BAYU TOUR PLANNING.EXE
- BAYU TIKETING.EXE
- LMBAR PNGSHN GUIDING.EXE
- LMBAR PNGSHN TPLANING.EXE
- PERHITUNGAN TOTTI.EXE
- COVER DEPAN PROJECT.EXE
- COVER DEPAN TPLANNING.EXE
- LMBAR PNGSHN TKTING.EXE
- PROPOSAL GUIDING BAYU.EXE
- COVER PROJECT WORK.EXE
- ASSALAMUALAIKUM.EXE
- LAMARAN[n].EXE
- REF KERJA.EXE
- FARIQO TOTTI.EXE
- SURAT KE MASTER SALAH TULIS TICKET.EXE
- FORM PENGAJUAN GROUP.EXE
- SURAT PENGAJUAN GROUP FOR MZ.EXE
- PERHITUNGAN.EXE
- SKP.EXE
- SURAT BUAT BG JUNCTION.EXE
- LICENSE.EXE
- TIKET.EXE
- PROPOSAL NASKAH.EXE
- DESAIN SITUS E-COMMERCE DENGAN JOOMLA.EXE
- CARA BOOKING.EXE
- 72950966.DAT
- 28189938.EXE
- 92813349.DAT
Filesizes
The following file size has been seen:
- 4,211,176 bytes
- 738,304 bytes
- 590,865 bytes
- 28,672 bytes
- 1,811,281 bytes
- 47,616 bytes
File Type
The filename DATE.EXE is used by multiple object types including executable programs,objects.
File Activity
One or more files with the name DATE.EXE creates, deletes, copies or moves the following files and folders:
- Creates c:\docume~1\jim\locals~1\temp\grpconv.exe
- create folder C:\Program Files\WinRAR\Formats
- create folder C:\Program Files\microsoft frontpage\version3.0\bin
- Creates c:\docume~1\jim\locals~1\temp\e_n4\krnln.fnr
- Creates c:\docume~1\jim\locals~1\temp\e_n4\shell.fne
- Creates c:\docume~1\jim\locals~1\temp\e_n4\eAPI.fne
- Creates c:\killvv.sys
- Creates c:\program files\winrar\formats\nnc.exe
- Creates c:\program files\winrar\formats\msdtc.pif
- Creates c:\docume~1\jim\locals~1\temp\inetsvr.in
- Creates c:\program files\winrar\formats\sysinfo.ini
- Creates c:\windows\sysinfo.ini
- Creates c:\windows\system32\sysinfo.ini
- Creates c:\docume~1\jim\locals~1\temp\sysinfo.ini
- Copies filec:\8933888.exe to c:\program files\microsoft frontpage\version3.0\bin\date.exe
- Creates c:\program files\microsoft frontpage\version3.0\bin\update.exe
- Creates c:\docume~1\jim\locals~1\temp\1.exe
Help the Webroot Community to fight cyber crime
We are always looking for ways to improve the quality and speed of research to help us protect you from malicious software and cyber crime.
PCMag.com Editors' Choice Award Logo is a trademark of Ziff Davis Publishing Holdings Inc. Used under license.