AUTO.EXE, Prevx

Associated Malware Groups

The unsafe files using this name are associated with the malware groups:

Cloaked Malware
Malicious Software
Worm

File Behavior

AUTO.EXE has been seen to perform the following behavior:

The Process is packed and/or encrypted using a software packing process
Modifies Windows Security Policies to restrict/expand User Privileges on the machine
This Process Deletes Other Processes From Disk
Can communicate with other computer systems using HTTP protocols
Writes to another Process's Virtual Memory (Process Hijacking)
Executes a Process
This process creates other processes on disk
Adds products to the system registry
Looks at the contents of the autoexec.bat file
Reads email address and phone book details
Visits web sites on your PC without you knowing
Adds a Registry Key (RUN) to auto start Programs on system start up
Ability to execute files automatically on your PC
Creates a new Background Service on the machine
Registers a Dynamic Link Library File
Changes the PC's date or time settings
Downloads program file(s) and other content from the web
Injects code into other processes
Copies files

AUTO.EXE has been the subject of the following behavior:

Created as a process on disk
Executed as a Process
Has code inserted into its Virtual Memory space by other programs
Deleted as a process from disk
Copied to multiple locations on the system
Created by processes which appear to be checking for interception by security products
Added as a Registry auto start to load Program on Boot up
Created as a new Background Service on the machine
Terminated as a Process

Country Of Origin

The filename AUTO.EXE was first seen on May 18 2007 in the following geographical regions of the Webroot community:

Europe on May 18 2007
The United States on May 18 2007
Morocco on Jun 25 2007
China on Jun 25 2007
Spain on Jul 5 2007
Malaysia on Jul 5 2007
Kazakhstan on Oct 21 2008

File Name Aliases

AUTO.EXE can also use the following file names:

DOWN[n].EXE
SYS67.EXE
MOON[1].EXE
D55FBCC5.EXE
SYS56.EXE
A3A412B4.EXE
SYS144.EXE
F2B4657B5568D072[1].EXE
BF6BC482.EXE
SYS81.EXE
D0A73C0.EXE
�½��ļ޼� (2)/23/MOON.EXE
FEDB254C.EXE
CA83F650.EXE
E8F5C80.EXE
C92F32C3.EXE
SYS40.EXE
A2FB7502.EXE
BA8F4FC.EXE
FA0CB8E0.EXE
JSXDXKV.EXE
FAD04E23.EXE
B5A6F2BD.EXE
C6E8096E.EXE
D54DA338.EXE
CFF4767E.EXE
DC243EC.EXE
40.EXE
67.EXE
81.EXE
56.EXE
460BA347.EXE
7FC0ED00.EXE
4388D102.EXE
90F870B8.EXE
5B4DAA6E.EXE
63A59EC8.EXE
N1191141655K.EXE
N1191142019K.EXE
N1191144140K.EXE
N1191147108K.EXE
N1191222991K.EXE
10D51D4B.EXE
N1191167527K.EXE
9704BDEB.EXE
36DD6B85.EXE
N1191211236K.EXE
3FC0D10C.EXE
N1191206396K.EXE
9117A164.EXE
N1191253139K.EXE
N1191256690K.EXE
N1191264762K.EXE
33E2BF9C.EXE
979F0B7A.EXE
94C19DA4.EXE
N1183657356K.EXE
N1183650316K.EXE
9532897E.EXE
N1183650380K.EXE
N1120578758K.EXE
N1183654980K.EXE
N1120599055K.EXE
N1183697076K.EXE
DC252.EXE
N1182855117K.EXE
784CF9D5.EXE
6C413022.EXE
833B5490.EXE
7F00E1A2.EXE
9300A24C.EXE
9800E928.EXE
D7632A96.EXE
N1182762421K.EXE
N1119703266K.EXE
N1119707893K.EXE
83941F8E.EXE
N1119709301K.EXE
7431C8F6.EXE
629A41CD.EXE
7CB8AD5B.EXE
81D33E02.EXE
1886D134.EXE
9E65AAEF.EXE
530240F6.EXE
6D0B024F.EXE
5CC013B0.EXE
DC23.EXE
8FC96556.EXE
939AF4A2.EXE
3117736E.EXE
31D2761.EXE
3FDF7922.EXE

Filesizes

The following file size has been seen:

36,312 bytes
13,028 bytes
16,943 bytes
16,959 bytes
10,325,575 bytes
334,344 bytes
18,282 bytes

File Type

The filename AUTO.EXE refers to many versions of an executable program.

File Activity

One or more files with the name AUTO.EXE creates, deletes, copies or moves the following files and folders:

Creates c:\windows\system32\delme.bat
Copies filec:\windows\system32\939AF4A2.EXE to c:\windows\system32\939AF4A2.EXE
Creates c:\windows\system32\79C3714A.DLL
Deletes c:\windows\system32\delme.bat
Copies filec:\windows\system32\939AF4A2.EXE to c:\auto.exe
Copies filec:\windows\system32\939AF4A2.EXE to d:\auto.exe
Copies filec:\windows\system32\939AF4A2.EXE to e:\auto.ex
Copies filec:\windows\system32\939AF4A2.EXE to f:\auto.ex
Copies filec:\windows\system32\939AF4A2.EXE to g:\auto.ex
Copies filec:\windows\system32\939AF4A2.EXE to h:\auto.ex
Copies filec:\windows\system32\939AF4A2.EXE to i:\auto.ex
Copies filec:\windows\system32\5ECEBAC9.EXE to e:\auto.ex
Copies filec:\windows\system32\5ECEBAC9.EXE to f:\auto.ex
Copies filec:\windows\system32\5ECEBAC9.EXE to g:\auto.ex
Copies filec:\windows\system32\5ECEBAC9.EXE to h:\auto.ex
Copies filec:\windows\system32\5ECEBAC9.EXE to i:\auto.ex
Deletes c:\windows\system32\n1115304089k.exe
Deletes c:\windows\system32\llk1115304087.h
Deletes c:\windows\system32\llk1115304093.h
Deletes c:\windows\system32\K155BC~1.EXE
Creates c:\windows\system32\del.bat
Creates c:\windows\system32\9BC8D0FD.DLL
Creates c:\docume~1\user\locals~1\temp\tmp48.tmp
Deletes c:\docume~1\user\locals~1\temp\tmp48.tmp
Creates c:\docume~1\user\locals~1\temp\tmp54.tmp
Deletes c:\windows\system32\msosmhfp00.dll
Copies filec:\docume~1\user\locals~1\temp\tmp54.tmp to c:\windows\system32\msosmhfp00.dll
Deletes c:\windows\system32\msosmhfp01.dll
Deletes c:\windows\system32\msosmhfp02.dll
Deletes c:\windows\system32\msosmhfp03.dll
Deletes c:\windows\system32\msosmhfp04.dll
Deletes c:\windows\system32\msosmhfp05.dll
Deletes c:\windows\system32\msosmhfp06.dll
Deletes c:\windows\system32\msosmhfp07.dll
Deletes c:\windows\system32\msosmhfp08.dll
Deletes c:\windows\system32\msosmhfp09.dll
Deletes c:\windows\system32\msosmhfp10.dll
Deletes c:\windows\system32\msosmhfp11.dll
Deletes c:\windows\system32\msosmhfp12.dll
Deletes c:\windows\system32\msosmhfp13.dll
Deletes c:\windows\system32\msosmhfp14.dll
Deletes c:\windows\system32\msosmhfp15.dll
Copies filec:\windows\system32\K11153~3.EXE to c:\windows\WINSvr32.exE
Deletes c:\windows\system32\WINSvr32.dll
Creates c:\windows\system32\WINSvr32.dll
Copies filec:\windows\system32\K14BED~1.EXE to c:\windows\WSockDrv32.exe
Deletes c:\windows\system32\WSockDrv32.dll
Creates c:\windows\system32\WSockDrv32.dll
Copies filec:\windows\system32\K11153~2.EXE to c:\windows\Kvsc3.exE
Deletes c:\windows\system32\Kvsc3.dll

Website Activity

One or more files with the name AUTO.EXE interacts with the following web sites and pages. Web addresses have been deliberately modified to prevent unintentional use.

TCP:127.0.0.1:1051 Port:28
Port 80 IP:222.73.247.201
Port 80 IP:222.73.247.202
Port 80 IP:222.73.254.67
Port 80 IP:61.129.45.132
Port 80 IP:220.189.255.29

Help the Webroot Community to fight cyber crime

We are always looking for ways to improve the quality and speed of research to help us protect you from malicious software and cyber crime.

The filename referred to in this report is often associated with PC infections. If you have a program of this name on your PC and would like to help our research please tell us what you know in the form below:

I have this file on my PC and believe it is an infection
I have this file on my PC and think it has made my PC slower
My firewall asked if I wanted to let this file have access to the Internet
My PC will not work since I noticed this file on it
My antivirus detected this file but won't remove it
I know what this file is and believe it is a Safe program
I am the author of this file and would like to discuss how to have it reclassified as safe

Further Comments or information you'd like to share: (optional)

Your email address if you would like us to contact you about this file and any concerns you may have: (optional)

PCMag.com Editors' Choice Award Logo is a trademark of Ziff Davis Publishing Holdings Inc. Used under license.

AUTO.EXE

Free PC Cleanup from Webroot