35327886.DAT - Dangerous

What you should do about 35327886.DAT:

Your PC may be infected. The presence of a file called 35327886.DAT is a possible sign of infection.

You should urgently check your PC to make sure it is not infected. The free version of Prevx CSI will scan your PC in less than two minutes and check for millions of spyware and malware infections including 35327886.DAT. Don't take the risk, check your PC now.

Download Prevx CSI Now

What we know about 35327886.DAT:

The filename 35327886.DAT was first seen on Jun 30 2007 in SPAIN. It has also been seen in the following geographical regions of the Prevx community:

  • The UNITED KINGDOM on May 2 2008
  • The EUROPEAN UNION on Aug 23 2008
  • CANADA on Aug 7 2008
  • LITHUANIA on Jan 1 2008
  • FRANCE on Jun 30 2007
  • POLAND on Dec 29 2007
The filename 35327886.DAT refers to many versions of an executable program.

The most common file size is 153,088 bytes. But the following file sizes have also been seen:

  • 93,316 bytes
  • 68,778 bytes
  • 80,336 bytes
  • 143,360 bytes
  • 69,120 bytes
  • 435,200 bytes
  • 421,376 bytes

The unsafe files using this name are associated with the malware group SystemPoser:Trojan-All Variants.Some files using the name 35327886.DAT are also associated with the malware groups:
  • TROJAN.AGENT.GEN
  • Worm.Rbot

These files may have the following Vendor, Product, Version Information in the file header

  • ; ; 1.00

35327886.DAT has been seen to perform the following behavior(s):

  • The Process is packed and/or encrypted using a software packing process
  • Injects code into other processes
  • Looks at the contents of the autoexec.bat file
  • Reads email address and phone book details
  • Uses DNS to retrieve the IP address for web sites
  • Uses your PC to connect to Chat rooms
  • The Process is polymorphic and can change its structure
  • Adds a Registry Key (RUN) to auto start Programs on system start up
  • This Process Creates Other Processes On Disk
  • Executes a Process
  • Writes to another Process's Virtual Memory (Process Hijacking)
  • This Process Deletes Other Processes From Disk
  • Opens browser pop ups
  • Registers a Dynamic Link Library File
  • Can make outbound communication to other computers, IM chat rooms and other services using IRC protocols
  • Creates a TCP port which listens and is available for communication initiated by other computers
  • Sends email using SMTP protocols
  • Can examine and Send Email using POP3 protocols
  • Can communicate with other computer systems using HTTP protocols
  • Makes outbound connections to other computers using NETBIOSOUT protocols

35327886.DAT has been the subject of the following behavior(s):

  • Created as a process on disk
  • Executed as a Process
  • Added as a Registry auto start to load Program on Boot up
  • Has code inserted into its Virtual Memory space by other programs
  • Deleted as a process from disk
  • Copied to multiple locations on the system
  • Terminated as a Process

35327886.DAT can also use the following file names:

  • ALGS.EXE
  • 72539224.SVD
  • 61478677.DAT
  • SPOOISV.EXE
  • 83948583.SVD
  • PHGAUCC.TMP
  • CSRS.EXE
  • 17539507.DAT
  • 41687811.DAT
  • 71864331.TMP
  • 36855612.SVD
  • 86525191.DAT
  • 33473524.DAT
  • 34925801.DAT
  • 08300554.DAT
  • LOGON.EXE
  • ZJKGO.EXE
  • AMTPP.EXE
  • QMBSWV.EXE
  • LSSAS.EXE
  • RLTQTNK.EXE
  • CQWBM.EXE
  • PKCF.EXE
  • YCGCXO.EXE
  • VTVWID.EXE
  • SPOOLSVC.EXE

Virus, Spyware & Malware Center