File Investigation Report
SETUP_VER1.113.0.EXEMalware Dropper
Your PC is infected. The file called SETUP_VER1.113.0.EXE is considered unsafe and there may be other infections on your PC.
You should urgently check your PC and remove any malicious software including SETUP_VER1.113.0.EXE as soon as possible. The free version of Prevx CSI will scan your PC for millions of spyware and malware infections in less than 2 minutes. Don't put your confidential data, or your identity at risk, check your PC now with Prevx CSI.
Associated Malware Groups
The filename is associated with the malware group:
- Malware Dropper
File Behavior
SETUP_VER1.113.0.EXE has been seen to perform the following behavior:
- The Process is polymorphic and can change its structure
- Can communicate with other computer systems using HTTP protocols
- This Process Creates Other Processes On Disk
- Executes a Process
- Writes to another Process's Virtual Memory (Process Hijacking)
- This Process Deletes Other Processes From Disk
- Copies files
- Registers a Dynamic Link Library File
- Enables an In Process Object/Server - Common with DLL Injections
- Looks at the contents of the autoexec.bat file
- Reads email address and phone book details
- Visits web sites on your PC without you knowing
- Terminates Processes
- Downloads hidden code from covert web sites
- This Process is a file infector which modifies program files to include a host a copy of the infection
SETUP_VER1.113.0.EXE has been the subject of the following behavior:
- Created as a process on disk
- Executed as a Process
- Has code inserted into its Virtual Memory space by other programs
- Terminated as a Process
- Deleted as a process from disk
- Executed by Internet Explorer
- Executed from Temporary Folders
Country Of Origin
The filename SETUP_VER1.113.0.EXE was first seen on Jul 28 2008 in the following geographical regions of the Prevx community:
- SPAIN on Jul 28 2008
- The UNITED STATES on Jul 28 2008
File Name Aliases
SETUP_VER1.113.0.EXE can also use the following file names:
- 64082442.EXE
- 84495044.EXE
- 79567175.DAT
- FTJO7Z7E.EXE
- MEDIATUBECODEC_VER1.1187.0.EXE
- 31608685.EXE
- 69007198.EXE
- 95099303.EXE
- MEDIATUBECODEC_VER1.668.1[1].EXE
- MEDIATUBECODEC_VER1.1233.1[1].EXE
- MEDIATUBECODEC_VER1.1294.0[1].EXE
- E9QSLXC8.EXE
- JJQX68OP.EXE
- 010X3780.EXE
- 3DGDJV8S.EXE
- 5VC2F75Y.EXE
- 70LNXXRQ.EXE
- WZRENUR3.EXE
- SETUP_VER1.422.0.EXE
- CRACK_VER1.454.0.EXE
- MEDIATUBECODEC_VER1.1233.1.EXE
- 49987188.SVD
Filesizes
The following file size has been seen:
- 69,632 bytes
- 77,824 bytes
- 65,536 bytes
- 20,955 bytes
Vendor, Product and Version Information
These files have no vendor, product or version information specified in the file header.
File Type
The filename SETUP_VER1.113.0.EXE refers to many versions of an executable program.
File Activity
One or more files with the name SETUP_VER1.113.0.EXE creates, deletes, copies or moves the following files and folders:
- Opens/modifes c:\autoexec.bat
- Creates c:\docume~1\user\locals~1\temp\lwpwer.exe
- Creates c:\docume~1\user\locals~1\temp\08.ph
- Creates c:\documents and settings\all users\application data\secure solutions\antispyware 2008 xp\as2008xp.exe
- Creates c:\docume~1\user\locals~1\temp\ac8zt2\08.php
- Deletes c:\docume~1\user\locals~1\temp\nsf18.tmp
- Creates c:\docume~1\user\locals~1\temp\nsu1A.tmp
- Deletes c:\docume~1\user\locals~1\temp\nsu1C.tmp
- Creates c:\docume~1\user\locals~1\temp\nsu1c.tmp\blowfish_d.dll
- Creates c:\docume~1\user\locals~1\temp\ac8zt2\vtqnxfko.dll
- Creates c:\docume~1\user\locals~1\temp\ac8zt2\emgl.exe
- Creates c:\docume~1\user\locals~1\temp\ac8zt2\tqwolser.exe
- Creates c:\docume~1\user\locals~1\temp\ac8zt2\rafbsvnx.dll
- Creates c:\docume~1\user\locals~1\temp\ac8zt2\install.bat
- Creates c:\docume~1\user\locals~1\temp\ac8zt2\twmxbsqrnvd.dll
- Creates c:\docume~1\user\locals~1\temp\ac8zt2\tsxngabr.dll
- Deletes c:\docume~1\user\locals~1\temp\nsw21.tmp
- Creates c:\docume~1\user\locals~1\temp\nsw23.tmp
- Deletes c:\docume~1\user\locals~1\temp\nsl25.tmp
- Creates c:\docume~1\user\locals~1\temp\nsl25.tmp\blowfish_d.dll
- Deletes c:\docume~1\user\locals~1\temp\ac8zt2\emgl.ex
- Deletes c:\docume~1\user\locals~1\temp\ac8zt2\install.bat
- Deletes c:\docume~1\user\locals~1\temp\ac8zt2\rafbsvnx.dll
- Deletes c:\docume~1\user\locals~1\temp\ac8zt2\tqwolser.exe
- Deletes c:\docume~1\user\locals~1\temp\ac8zt2\tsxngabr.dll
- Deletes c:\docume~1\user\locals~1\temp\ac8zt2\twmxbsqrnvd.dll
- Deletes c:\docume~1\user\locals~1\temp\ac8zt2\vtqnxfko.dll
- Deletes c:\docume~1\user\locals~1\temp\nsr30.tmp
- Creates c:\docume~1\user\locals~1\temp\nsh32.tmp
- Deletes c:\docume~1\user\locals~1\temp\nsw34.tmp
- Creates c:\docume~1\user\locals~1\temp\nsw34.tmp\blowfish_d.dll
- Deletes c:\docume~1\user\locals~1\temp\ac8zt2\emgl.exe
- Deletes c:\docume~1\user\locals~1\temp\nsx39.tmp
- Creates c:\docume~1\user\locals~1\temp\nsn3B.tmp
- Deletes c:\docume~1\user\locals~1\temp\nsc3D.tmp
- Creates c:\docume~1\user\locals~1\temp\nsc3d.tmp\blowfish_d.dll
- Creates c:\windows\08.php
- Copies filec:\docume~1\user\locals~1\temp\ac8zt2\tsxngabr.dll to c:\windows\tsxngabr.dll
- Copies filec:\docume~1\user\locals~1\temp\ac8zt2\rafbsvnx.dll to c:\windows\rafbsvnx.dll
- Copies filec:\docume~1\user\locals~1\temp\ac8zt2\vtqnxfko.dll to c:\windows\vtqnxfko.dll
- Copies filec:\docume~1\user\locals~1\temp\ac8zt2\emgl.exe to c:\windows\emgl.exe
- Copies filec:\docume~1\user\locals~1\temp\ac8zt2\twmxbsqrnvd.dll to c:\windows\twmxbsqrnvd.dll
- Copies filec:\docume~1\user\locals~1\temp\ac8zt2\tqwolser.exe to c:\windows\tqwolser.exe
- Creates c:\docume~1\user\locals~1\temp\nspa2.tmp.bat "c:\docume~1\user\locals~1\temp\08.php
- Deletes c:\docume~1\user\locals~1\temp\nsk4D.tmp
- Creates c:\docume~1\user\locals~1\temp\nsk4F.tmp
- Deletes c:\docume~1\user\locals~1\temp\nsa51.tmp
- Creates c:\docume~1\user\locals~1\temp\nsa51.tmp\blowfish_d.dll
- Creates c:\docume~1\user\locals~1\temp\nsa51.tmp\System.dll
- Deletes c:\docume~1\user\locals~1\temp\nspA2.tmp
Registry Activity
One or more files with the name SETUP_VER1.113.0.EXE creates or modifies the following registry keys and values:
- HKEY_CURRENT_USER\Software\Secure Solutions\Installer InstallDate [REG_BINARY, size: 8 bytes]
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Drivers\Video\Options 4E8D9EBF-122C-42BD-A8CB-7E59C9CC08BA
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run InstallProgram C:\DOCUME~1\user\LOCALS~1\Temp\lwpwer.exe
- HKEY_CURRENT_USER\Software\Secure Solutions\Antispyware 2008 XP lid -1
- HKEY_CURRENT_USER\Software\Secure Solutions\Antispyware 2008 XP pid 100526
- HKEY_CURRENT_USER\Software\Secure Solutions\Installer IsLoaded value:
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad vtqnxfko {15AF902D-A0E6-4F35-83A2-885790791B19}
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad vtqnxfko {ECD98CE8-D253-4FC9-B9B7-9FFA5275DB42}
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad vtqnxfko {C050B052-F2F4-4709-BD97-F6B173304652}
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad vtqnxfko {5A8D4530-F8BA-4593-A4D0-2343455A85BC}
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad vtqnxfko {FD763FB1-B67D-4233-BB72-69B42FB02786}
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad tsxngabr {E0E57D89-7549-41B2-BB4E-DCB94DB8FCC3}
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad tsxngabr {44472AD8-C41E-4338-90F5-22EB4B545976}
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad tsxngabr {6FB856A1-1322-4E04-B243-596D4EBF6579}
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad tsxngabr {7F0CA60E-2F83-4B52-8238-47F61E275D00}
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad tsxngabr {7B9C59AD-3C34-4847-8317-A1C740287883}
Website Activity
One or more files with the name SETUP_VER1.113.0.EXE interacts with the following web sites and pages. Web addresses have been deliberately modified to prevent unintentional use.
- 64 .247 .39 .247 / confirm .php?aid=0&said=0
- dwl .as2008dl .com / uexe / d100526 .exe
- viacodecright2 .com / 08 .php
- viacodecright1 .com / 08 .php
- Port 80 IP:64.247.39.247
- Port 80 IP:85.255.118.69
- Port 80 IP:77.91.227.179
- Port 80 IP:77.91.228.187
- Port 80 IP:85.255.118.228
- Port 80 IP:85.255.118.83