SETUP(1).EXE, Prevx

Associated Malware Groups

The unsafe files using this name are associated with the malware groups:

Malicious Software
Worm

File Behavior

SETUP(1).EXE has been seen to perform the following behavior:

The Process is packed and/or encrypted using a software packing process
Can communicate with other computer systems using HTTP protocols
Executes a Process
This process creates other processes on disk
Looks at the contents of the autoexec.bat file
Reads email address and phone book details
Visits web sites on your PC without you knowing
This Process Deletes Other Processes From Disk
Writes to another Process's Virtual Memory (Process Hijacking)
Changes the Internet Explorer Home Page Settings
Adds products to the system registry
Executes Processes stored in Temporary Folders
Hooks the WININET.DLL function allowing it to read or copy Http and Https web page content and session information
Registers a Dynamic Link Library File
Creates new folders on the system
Creates or uses a background service to access the Internet using HTTP protocols
Injects code into other processes
Performs DNS look ups to resolve URL IP addresses
Adds a Registry Key (RUN) to auto start Programs on system start up
Copies files

SETUP(1).EXE has been the subject of the following behavior:

Executed from Temporary Folders
Created as a process on disk
Executed as a Process
Deleted as a process from disk
Has code inserted into its Virtual Memory space by other programs
Added as a Registry auto start to load Program on Boot up
Terminated as a Process

Country Of Origin

The filename SETUP(1).EXE was first seen on Jun 4 2007 in the following geographical regions of the Webroot community:

on Jun 4 2007
Finland on Jan 18 2008
Spain on Aug 11 2008
The United Kingdom on Apr 7 2010
The United States on May 25 2012

Filesizes

The following file size has been seen:

9,302 bytes
756,816 bytes
278,029 bytes
55,296 bytes
9,728 bytes
650,336 bytes

File Type

The filename SETUP(1).EXE refers to many versions of an executable program.

File Activity

One or more files with the name SETUP(1).EXE creates, deletes, copies or moves the following files and folders:

Creates c:\docume~1\user\locals~1\temp\wgve0.exe
Opens/modifes c:\autoexec.bat
Creates c:\docume~1\user\locals~1\temp\wgve1.ex
Creates c:\docume~1\user\locals~1\temp\wgve2.ex
Creates c:\docume~1\user\locals~1\temp\hdyj0.bat
create folder C:\Program Files\Applications
Deletes c:\program files\applications\wcs.ex
Creates c:\program files\applications\wcs.exe
Creates c:\program files\applications\wcu.exe
Creates c:\program files\applications\wcm.exe
Deletes c:\docume~1\user\locals~1\temp\wgve1.exe
Deletes c:\docume~1\user\locals~1\temp\hdyj0.bat
Deletes c:\program files\applications\iebtm.ex
Creates c:\program files\applications\iebtm.exe
Creates c:\program files\applications\iebtu.exe
Creates c:\program files\applications\iebt.dll
Creates c:\program files\applications\iebtmm.exe
Deletes c:\docume~1\user\locals~1\temp\wgve2.exe
Creates c:\program files\applications\iebr.dll
Creates c:\documents and settings\user\application data\mozilla\firefox\searchplugins\search.xml
Creates c:\program files\applications\ts.ico
Creates c:\program files\applications\ot.ico
Creates c:\program files\applications\myd.ico
Creates c:\program files\applications\mym.ico
Creates c:\program files\applications\myp.ico
Creates c:\program files\applications\myv.ico
Deletes c:\documents and settings\user\favorites\Antivirus Scan.url
Deletes c:\documents and settings\all users\start menu\Online Spyware Test.url
Deletes c:\documents and settings\all users\desktop\Antivirus Scan.url
Deletes c:\documents and settings\all users\desktop\Online Spyware Test.url
Deletes c:\documents and settings\all users\start menu\Antivirus Scan.url
Deletes c:\documents and settings\user\my documents\my videos\My Video.url
Deletes c:\documents and settings\user\my documents\my music\My Music.url
Deletes c:\documents and settings\user\my documents\my pictures\My Pictures.url
Deletes c:\documents and settings\user\my documents\My Documents.url
Creates c:\program files\applications\iebu.exe
Creates c:\windows\system32\604262.dll
Creates c:\windows\system32\zgyhw.dll
Deletes c:\docume~1\user\locals~1\temp\br47.tmp
Creates c:\docume~1\user\locals~1\temp\br47.exe
create folder C:\WINDOWS\system32\604262
Copies filec:\docume~1\user\locals~1\temp\wgve1.exe to c:\windows\system32\ubpr01.exe
Creates c:\windows\system32\604262\604262.dll
Deletes c:\tmp2.re
Creates c:\tmp2.re
Creates c:\program files\mozilla firefox\searchplugins\search.xml
Creates c:\12455654.bat

Website Activity

One or more files with the name SETUP(1).EXE interacts with the following web sites and pages. Web addresses have been deliberately modified to prevent unintentional use.

Remote server connection to 69 .50 .164 .5
Port 80 IP:69.50.164.50
Port 80 IP:85.255.117.204
Port 80 IP:69.31.131.84

Help the Webroot Community to fight cyber crime

We are always looking for ways to improve the quality and speed of research to help us protect you from malicious software and cyber crime.

The filename referred to in this report is often associated with PC infections. If you have a program of this name on your PC and would like to help our research please tell us what you know in the form below:

I have this file on my PC and believe it is an infection
I have this file on my PC and think it has made my PC slower
My firewall asked if I wanted to let this file have access to the Internet
My PC will not work since I noticed this file on it
My antivirus detected this file but won't remove it
I know what this file is and believe it is a Safe program
I am the author of this file and would like to discuss how to have it reclassified as safe

Further Comments or information you'd like to share: (optional)

Your email address if you would like us to contact you about this file and any concerns you may have: (optional)

PCMag.com Editors' Choice Award Logo is a trademark of Ziff Davis Publishing Holdings Inc. Used under license.

SETUP(1).EXE

Free PC Cleanup from Webroot