File Investigation Report
WINLIB .DLLWorm
Your PC may be infected. The presence of a file called WINLIB .DLL is a possible sign of infection.
You should urgently check your PC to make sure it is not infected. The free version of Prevx CSI will scan your PC in less than two minutes and check for millions of spyware and malware infections including WINLIB .DLL. Don't put your confidential data, or your identity at risk, check your PC now with Prevx CSI.
Associated Malware Groups
The unsafe files using this name are associated with the malware group:
- Worm
File Behavior
WINLIB .DLL has been seen to perform the following behavior:
- Creation and Registration of a Browser Helper Object in Internet Explorer
- This Process Creates Other Processes On Disk
- Looks at the contents of the autoexec.bat file
- Reads email address and phone book details
- Visits web sites on your PC without you knowing
WINLIB .DLL has been the subject of the following behavior:
- Registered as a Dynamic Link Library File
- Deleted as a process from disk
- Executed as a Process
Country Of Origin
The filename WINLIB .DLL was first seen on Jun 4 2007 in the following geographical regions of the Prevx community:
- SINGAPORE on Jun 4 2007
- POLAND on Jun 4 2007
- SPAIN on Apr 21 2008
File Name Aliases
WINLIB .DLL can also use the following file names:
- ~MY3.TMP
- ~MY2.TMP
- ~MY1.TMP
- 19331189.DAT
- ~MY4.TMP
- 20660077.DLL
- ~MY7.TMP
Filesizes
The following file size has been seen:
- 155,648 bytes
- 159,744 bytes
- 167,936 bytes
Vendor, Product and Version Information
These files have no vendor, product or version information specified in the file header.
File Type
The filename WINLIB .DLL refers to many versions of a dynamic link library.
File Activity
One or more files with the name WINLIB .DLL creates, deletes, copies or moves the following files and folders:
- Deletes c:\docume~1\user\locals~1\temp\~my7.tmp
- Opens/modifes c:\autoexec.bat
- Creates c:\windows\system32\mprmsgse.axz
Website Activity
One or more files with the name WINLIB .DLL interacts with the following web sites and pages. Web addresses have been deliberately modified to prevent unintentional use.
- Remote server connection to gs .chnsystem .co
- Remote server connection to msl .chnsystem .co
- Port 80 IP:211.160.17.195