FACEBACK.EXE, Prevx

Associated Malware Groups

The filename is associated with the malware groups:

System Back Door
Cloaked Malware
Malicious Software

File Behavior

FACEBACK.EXE has been seen to perform the following behavior:

The Process is packed and/or encrypted using a software packing process
Adds a Registry Key (RUN) to auto start Programs on system start up
This Process Deletes Other Processes From Disk
Can communicate with other computer systems using HTTP protocols
Writes to another Process's Virtual Memory (Process Hijacking)
This process creates other processes on disk
Executes a Process
Registers a Dynamic Link Library File
Copies files
Creates new folders in the file system
Looks at the contents of the autoexec.bat file
Reads email address and phone book details
Visits web sites on your PC without you knowing

FACEBACK.EXE has been the subject of the following behavior:

Added as a Registry auto start to load Program on Boot up
Created as a process on disk
Has code inserted into its Virtual Memory space by other programs
Terminated as a Process
Executed as a Process
Registered as a Dynamic Link Library File
Created by processes which appear to be checking for interception by security products
Executed from Temporary Folders
Downloaded from covert web sites without the user knowing
Deleted as a process from disk

Country Of Origin

The filename FACEBACK.EXE was first seen on Aug 19 2008 in the following geographical regions of the Webroot community:

Canada on Aug 19 2008
The United States on Aug 26 2008
Spain on Sep 11 2008
Germany on Sep 11 2008
Europe on Sep 18 2008
on Oct 2 2008
The United Kingdom on Nov 12 2010

File Name Aliases

FACEBACK.EXE can also use the following file names:

PRTB.EXE
STFMEANE572.EXE
STFMEANE72.EXE
SABIS.EXE
STFMEANE1974.EXE
STFMEANE27.EXE
STFMEANE1074.EXE
STFMEANE1688.EXE
FACEBACK_6.EXE
STFMEANE27_1.EXE
STF16.TMP
MEANE.EXE
FACEBACK11.EXE.TMP
FACEBACK272.EXE.TMP
FACEBACK1974.EXE.TMP
STFMEANE.EXE
STFMEANE2000352.EXE
STFMEANE1000106.EXE
TSITRA.EXE
GTNSNTL.TMP
STFMEANE450.EXE
17PHOLMES1001186.EXE

Filesizes

The following file size has been seen:

116,736 bytes
104,960 bytes
104,448 bytes
103,936 bytes
99,328 bytes
147,456 bytes

File Type

The filename FACEBACK.EXE refers to many versions of an executable program.

File Activity

One or more files with the name FACEBACK.EXE creates, deletes, copies or moves the following files and folders:

Deletes c:\windows\faceback.exe
Moves c:\windows\faceback.exe to c:\windows\faceback.exe
Opens/modifes c:\autoexec.bat
Moves c:\windows\b152.exe to c:\windows\b152.exe
Copies filec:\windows\b152.exe to c:\windows\b152.exe
Creates c:\windows\b152.exe
Deletes c:\windows\b152.exe
create folder C:\Program Files\Mjcore\
Moves c:\program files\mjcore\Mjcore.dll to c:\program files\mjcore\Mjcore.dll
Deletes c:\program files\mjcore\Mjcore.dll
Deletes c:\docume~1\user\locals~1\temp\tmpC.tmp

Process Interaction

One or more files with the name FACEBACK.EXE exerts control over the following processes:

Kills C:\WINDOWS\cscript.exe

Website Activity

One or more files with the name FACEBACK.EXE interacts with the following web sites and pages. Web addresses have been deliberately modified to prevent unintentional use.

wr .kastora .com / wasari_newmax .php?&version=91&GUID=39FC6290C783541B3786385E04FF0CE3C6832B0F32933A546FF916E3C5832113379B385673B4&cmd=&p=&i=&x=80515
dl2 .bundlext .com:8080 / z / a537119c47192bc08952189ae8782f08 .zip
wr .kastora .com / wasari_newmax .php?&version=91&GUID=39FC6290C783541B3786385E04FF0CE3C6832B0F32933A546FF916E3C5832113379B385673B4&cmd=&p=1&i=,152:3R0&x=92609
wr .kastora .com / wasari_newmax .php?&version=91&GUID=39FC6290C783541B3786385E04FF0CE3C6832B0F32933A546FF916E3C5832113379B385673B4&cmd=&p=1&i=,152:3R0&x=92906
wr .kastora .com / wasari_newmax .php?&version=91&GUID=39FC6290C783541B3786385E04FF0CE3C6832B0F32933A546FF916E3C5832113379B385673B4&cmd=&p=1&i=,152:3R0&x=93187
wr .kastora .com / wasari_newmax .php?&version=91&GUID=39FC6290C783541B3786385E04FF0CE3C6832B0F32933A546FF916E3C5832113379B385673B4&cmd=&p=1&i=,152:3R0&x=93453
wr .kastora .com / wasari_newmax .php?&version=91&GUID=39FC6290C783541B3786385E04FF0CE3C6832B0F32933A546FF916E3C5832113379B385673B4&cmd=&p=1&i=,152:3R0&x=93734
wr .kastora .com / wasari_newmax .php?&version=91&GUID=39FC6290C783541B3786385E04FF0CE3C6832B0F32933A546FF916E3C5832113379B385673B4&cmd=&p=1&i=,152:3R0&x=94031
wr .kastora .com / wasari_newmax .php?&version=91&GUID=39FC6290C783541B3786385E04FF0CE3C6832B0F32933A546FF916E3C5832113379B385673B4&cmd=&p=1&i=,152:3R0&x=94312
wr .kastora .com / wasari_newmax .php?&version=91&GUID=39FC6290C783541B3786385E04FF0CE3C6832B0F32933A546FF916E3C5832113379B385673B4&cmd=&p=1&i=,152:3R0&x=94656
wr .kastora .com / wasari_newmax .php?&version=91&GUID=39FC6290C783541B3786385E04FF0CE3C6832B0F32933A546FF916E3C5832113379B385673B4&cmd=&p=1&i=,152:3R0&x=94937
wr .kastora .com / wasari_newmax .php?&version=91&GUID=39FC6290C783541B3786385E04FF0CE3C6832B0F32933A546FF916E3C5832113379B385673B4&cmd=&p=1&i=,152:3R0&x=95203
wr .kastora .com / wasari_newmax .php?&version=91&GUID=39FC6290C783541B3786385E04FF0CE3C6832B0F32933A546FF916E3C5832113379B385673B4&cmd=&p=1&i=,152:3R0&x=95484
wr .kastora .com / wasari_newmax .php?&version=91&GUID=39FC6290C783541B3786385E04FF0CE3C6832B0F32933A546FF916E3C5832113379B385673B4&cmd=&p=1&i=,152:3R0&x=95750
wr .kastora .com / wasari_newmax .php?&version=91&GUID=39FC6290C783541B3786385E04FF0CE3C6832B0F32933A546FF916E3C5832113379B385673B4&cmd=&p=1&i=,152:3R0&x=96015
wr .kastora .com / wasari_newmax .php?&version=91&GUID=39FC6290C783541B3786385E04FF0CE3C6832B0F32933A546FF916E3C5832113379B385673B4&cmd=&p=1&i=,152:3R0&x=96515
wr .kastora .com / wasari_newmax .php?&version=91&GUID=39FC6290C783541B3786385E04FF0CE3C6832B0F32933A546FF916E3C5832113379B385673B4&cmd=&p=1&i=,152:3R0&x=96796
wr .kastora .com / wasari_newmax .php?&version=91&GUID=39FC6290C783541B3786385E04FF0CE3C6832B0F32933A546FF916E3C5832113379B385673B4&cmd=&p=1&i=,152:3R0&x=97062
wr .kastora .com / wasari_newmax .php?&version=91&GUID=39FC6290C783541B3786385E04FF0CE3C6832B0F32933A546FF916E3C5832113379B385673B4&cmd=&p=1&i=,152:3R0&x=97328
wr .kastora .com / wasari_newmax .php?&version=91&GUID=39FC6290C783541B3786385E04FF0CE3C6832B0F32933A546FF916E3C5832113379B385673B4&cmd=&p=1&i=,152:3R0&x=97593
wr .kastora .com / wasari_newmax .php?&version=91&GUID=39FC6290C783541B3786385E04FF0CE3C6832B0F32933A546FF916E3C5832113379B385673B4&cmd=&p=1&i=,152:3R0&x=97875
wr .kastora .com / wasari_newmax .php?&version=91&GUID=39FC6290C783541B3786385E04FF0CE3C6832B0F32933A546FF916E3C5832113379B385673B4&cmd=&p=1&i=,152:3R0&x=98140
wr .kastora .com / wasari_newmax .php?&version=91&GUID=39FC6290C783541B3786385E04FF0CE3C6832B0F32933A546FF916E3C5832113379B385673B4&cmd=&p=1&i=,152:3R0&x=98406
wr .kastora .com / wasari_newmax .php?&version=91&GUID=39FC6290C783541B3786385E04FF0CE3C6832B0F32933A546FF916E3C5832113379B385673B4&cmd=&p=1&i=,152:3R0&x=98687
wr .kastora .com / wasari_newmax .php?&version=91&GUID=39FC6290C783541B3786385E04FF0CE3C6832B0F32933A546FF916E3C5832113379B385673B4&cmd=&p=1&i=,152:3R0&x=98968
wr .kastora .com / wasari_newmax .php?&version=91&GUID=39FC6290C783541B3786385E04FF0CE3C6832B0F32933A546FF916E3C5832113379B385673B4&cmd=&p=1&i=,152:3R0&x=99234
wr .kastora .com / wasari_newmax .php?&version=91&GUID=39FC6290C783541B3786385E04FF0CE3C6832B0F32933A546FF916E3C5832113379B385673B4&cmd=&p=1&i=,152:3R0&x=99500
wr .kastora .com / wasari_newmax .php?&version=91&GUID=39FC6290C783541B3786385E04FF0CE3C6832B0F32933A546FF916E3C5832113379B385673B4&cmd=&p=1&i=,152:3R0&x=99781
wr .kastora .com / wasari_newmax .php?&version=91&GUID=39FC6290C783541B3786385E04FF0CE3C6832B0F32933A546FF916E3C5832113379B385673B4&cmd=&p=1&i=,152:3R0&x=94
wr .kastora .com / wasari_newmax .php?&version=91&GUID=39FC6290C783541B3786385E04FF0CE3C6832B0F32933A546FF916E3C5832113379B385673B4&cmd=&p=1&i=,152:3R0&x=360
wr .kastora .com / wasari_newmax .php?&version=91&GUID=39FC6290C783541B3786385E04FF0CE3C6832B0F32933A546FF916E3C5832113379B385673B4&cmd=&p=1&i=,152:3R0&x=626
wr .kastora .com / wasari_newmax .php?&version=91&GUID=39FC6290C783541B3786385E04FF0CE3C6832B0F32933A546FF916E3C5832113379B385673B4&cmd=&p=1&i=,152:3R0&x=907
wr .kastora .com / wasari_newmax .php?&version=91&GUID=39FC6290C783541B3786385E04FF0CE3C6832B0F32933A546FF916E3C5832113379B385673B4&cmd=&p=1&i=,152:3R0&x=1172
wr .kastora .com / wasari_newmax .php?&version=91&GUID=39FC6290C783541B3786385E04FF0CE3C6832B0F32933A546FF916E3C5832113379B385673B4&cmd=&p=1&i=,152:3R0&x=1454
wr .kastora .com / wasari_newmax .php?&version=91&GUID=39FC6290C783541B3786385E04FF0CE3C6832B0F32933A546FF916E3C5832113379B385673B4&cmd=&p=1&i=,152:3R0&x=1735
wr .kastora .com / wasari_newmax .php?&version=91&GUID=39FC6290C783541B3786385E04FF0CE3C6832B0F32933A546FF916E3C5832113379B385673B4&cmd=&p=1&i=,152:3R0&x=2001
wr .kastora .com / wasari_newmax .php?&version=91&GUID=39FC6290C783541B3786385E04FF0CE3C6832B0F32933A546FF916E3C5832113379B385673B4&cmd=&p=1&i=,152:3R0&x=2266
wr .kastora .com / wasari_newmax .php?&version=91&GUID=39FC6290C783541B3786385E04FF0CE3C6832B0F32933A546FF916E3C5832113379B385673B4&cmd=&p=1&i=,152:3R0&x=2532
wr .kastora .com / wasari_newmax .php?&version=91&GUID=39FC6290C783541B3786385E04FF0CE3C6832B0F32933A546FF916E3C5832113379B385673B4&cmd=&p=1&i=,152:3R0&x=5688
wr .kastora .com / wasari_newmax .php?&version=91&GUID=39FC6290C783541B3786385E04FF0CE3C6832B0F32933A546FF916E3C5832113379B385673B4&cmd=&p=1&i=,152:3R0&x=5954
wr .kastora .com / wasari_newmax .php?&version=91&GUID=39FC6290C783541B3786385E04FF0CE3C6832B0F32933A546FF916E3C5832113379B385673B4&cmd=&p=1&i=,152:3R0&x=6235
wr .kastora .com / wasari_newmax .php?&version=91&GUID=39FC6290C783541B3786385E04FF0CE3C6832B0F32933A546FF916E3C5832113379B385673B4&cmd=&p=1&i=,152:3R0&x=6501
wr .kastora .com / wasari_newmax .php?&version=91&GUID=39FC6290C783541B3786385E04FF0CE3C6832B0F32933A546FF916E3C5832113379B385673B4&cmd=&p=1&i=,152:3R0&x=6766
wr .kastora .com / wasari_newmax .php?&version=91&GUID=39FC6290C783541B3786385E04FF0CE3C6832B0F32933A546FF916E3C5832113379B385673B4&cmd=&p=1&i=,152:3R0&x=7047
wr .kastora .com / wasari_newmax .php?&version=91&GUID=39FC6290C783541B3786385E04FF0CE3C6832B0F32933A546FF916E3C5832113379B385673B4&cmd=&p=1&i=,152:3R0&x=7313
wr .kastora .com / wasari_newmax .php?&version=91&GUID=39FC6290C783541B3786385E04FF0CE3C6832B0F32933A546FF916E3C5832113379B385673B4&cmd=&p=1&i=,152:3R0&x=7594
wr .kastora .com / wasari_newmax .php?&version=91&GUID=39FC6290C783541B3786385E04FF0CE3C6832B0F32933A546FF916E3C5832113379B385673B4&cmd=&p=1&i=,152:3R0&x=7876
wr .kastora .com / wasari_newmax .php?&version=91&GUID=39FC6290C783541B3786385E04FF0CE3C6832B0F32933A546FF916E3C5832113379B385673B4&cmd=&p=1&i=,152:3R0&x=8141
wr .kastora .com / wasari_newmax .php?&version=91&GUID=39FC6290C783541B3786385E04FF0CE3C6832B0F32933A546FF916E3C5832113379B385673B4&cmd=&p=1&i=,152:3R0&x=8407
wr .kastora .com / wasari_newmax .php?&version=91&GUID=39FC6290C783541B3786385E04FF0CE3C6832B0F32933A546FF916E3C5832113379B385673B4&cmd=&p=1&i=,152:3R0&x=8704

Help the Webroot Community to fight cyber crime

We are always looking for ways to improve the quality and speed of research to help us protect you from malicious software and cyber crime.

The filename referred to in this report is often associated with PC infections. If you have a program of this name on your PC and would like to help our research please tell us what you know in the form below:

I have this file on my PC and believe it is an infection
I have this file on my PC and think it has made my PC slower
My firewall asked if I wanted to let this file have access to the Internet
My PC will not work since I noticed this file on it
My antivirus detected this file but won't remove it
I know what this file is and believe it is a Safe program
I am the author of this file and would like to discuss how to have it reclassified as safe

Further Comments or information you'd like to share: (optional)

Your email address if you would like us to contact you about this file and any concerns you may have: (optional)

PCMag.com Editors' Choice Award Logo is a trademark of Ziff Davis Publishing Holdings Inc. Used under license.

FACEBACK.EXE

Free PC Cleanup from Webroot