LYLOADER.EXE - Dangerous

What you should do about LYLOADER.EXE:

Check Your PC Now
Your PC is infected. The file called LYLOADER.EXE is considered unsafe and there may be other infections on your PC.


You should urgently check your PC and remove any malicious software including LYLOADER.EXE as soon as possible. The free version of Prevx CSI will scan your PC for millions of spyware and malware infections in less than 2 minutes. Don't take the risk, check your PC now by clicking the green button.

Download Prevx CSI Now

Who Uses Prevx CSI?

Prevx has been detecting the threats that others miss since 2004.

More than 2,050,712 people have scanned with Prevx CSI and between them have checked 29.1 billion files. 65% of the PCs scanned had malware present.

What we know about LYLOADER.EXE:

The filename LYLOADER.EXE was first seen on Jun 20 2007 in MOROCCO. It has also been seen in the following geographical regions of the Prevx community:

  • SPAIN on Aug 12 2007
  • CHINA on Dec 7 2007
  • CANADA on Sep 25 2007
  • ISRAEL on Oct 4 2007
  • TAIWAN on Oct 4 2007
  • LATVIA on Aug 28 2007
The filename LYLOADER.EXE is used by multiple object types including executable programs,objects.

The most common file size is 12,028 bytes. But the following file sizes have also been seen:

  • 10,936 bytes
  • 11,892 bytes
  • 12,212 bytes
  • 11,916 bytes
  • 106,720 bytes
  • 11,872 bytes

The filename is associated with the malware group TROJAN.PWDSTEALER.GEN.Some files using the name LYLOADER.EXE are also associated with the malware groups:
  • PSW.OnlineGames.AENP
  • Trojan.PwdStealer
 These files have no vendor, product or version information specified in the file header.

LYLOADER.EXE has been seen to perform the following behavior(s):

  • This Process Creates Other Processes On Disk
  • This Process Deletes Other Processes From Disk
  • Writes to another Process's Virtual Memory (Process Hijacking)
  • Registers a Dynamic Link Library File
  • The process hooks code into all running processes which could allow it to take control of the system or record keyboard input, mouse activity and screen contents
  • Modifies Windows Initialization And System Settings Used On Start up
  • Terminates Processes

LYLOADER.EXE has been the subject of the following behavior(s):

  • Executed as a Process
  • Deleted as a process from disk
  • Created as a process on disk
  • Executed from Temporary Folders
  • Has code inserted into its Virtual Memory space by other programs
  • Terminated as a Process

LYLOADER.EXE can also use the following file names:

  • PRIVILEGE.DAT
  • 61407164.DAT
  • CSI69.TMP
  • 04862653.DAT
  • 52411231.EXE
  • 62490984.EXE
  • 61701252.EXE
  • 54566145.EXE
  • 30354804.EXE
  • 54910066.EXE
  • 28070875.DAT
  • 82196909.EXE
  • 79143704.DAT
  • 28582399.DAT
  • 04584424.DAT
  • 68430559.DAT
  • 40280096.DAT
  • LYLOADER.EX
  • DOCUMENTS AND SETTIN
  • LYL