R.EXE, Prevx

Associated Malware Groups

The unsafe files using this name are associated with the malware groups:

System Back Door
Cloaked Malware

File Behavior

R.EXE has been seen to perform the following behavior:

Uses hidden browser windows to connect to web sites without telling you
Runs Javascript code
Visits web sites on your PC without you knowing
Opens browser pop ups
Adds products to the system registry
Writes to another Process's Virtual Memory (Process Hijacking)
Adds a Registry Key (RUN) to auto start Programs on system start up
Executes a Process
Can communicate with other computer systems using HTTP protocols
This process creates other processes on disk
Creates or uses a background service to access the Internet using HTTP protocols
Injects code into other processes
Registers a Dynamic Link Library File
Executes Processes stored in Temporary Folders
This Process Deletes Other Processes From Disk
The Process is polymorphic and can change its structure
Creates new folders in the file system
Includes file creation code which could be used to test for interception by security products
This Process is a file infector which modifies program files to include a copy of the infection
Creates new folders on the system
Disables the DCOM Ability within Windows
Disables Anonymous Access to the Windows Network Shares
Can make outbound communication to other computers, IM chat rooms and other services using IRC protocols
The Process is packed and/or encrypted using a software packing process
This Process Contains User Mode Rootkit Functionality and can hide itself from the running process list

R.EXE has been the subject of the following behavior:

Created as a process on disk
Executed as a Process
Added as a Registry auto start to load Program on Boot up
Copied to multiple locations on the system
Has code inserted into its Virtual Memory space by other programs
Executed from Temporary Folders
Deleted as a process from disk
Registered as a Dynamic Link Library File

Country Of Origin

The filename R.EXE was first seen on May 16 2007 in the following geographical regions of the Webroot community:

The United States on May 16 2007
Iran, Islamic Republic of on May 16 2007
Spain on Jun 11 2007
The United Arab Emirates on Oct 17 2007
Europe on Oct 26 2007
Romania on Dec 17 2009
The United Kingdom on Dec 17 2009
Turkey on May 23 2012

File Name Aliases

R.EXE can also use the following file names:

DECC3C23.EXE
REALTEKR.EXE
SETUPR.EXE
WINAPPSR.EXE
SCVVHOSTR.EXE
SCVHOSTSR.EXE
PRINCESS7333R.EXE
UPGRDE CENTRER.EXE
NET. FRAMEWORKR.EXE
WIN1OGONR.EXE
ECHOSSR.EXE
INISYSR.EXE
FRX KEYR.EXE
PERR.EXE
BKAVR.EXE
SVCHOSTSR.EXE
ATI12EUXXR.EXE
SVCHOSTR.EXE
SCVR.EXE
BPKMR.EXE
CSSRSR.EXE
FEMR.EXE
WINDOWSEXR.EXE
SETHCTR.EXE
IMONSYSR.EXE
SYSTEMR.EXE
EXPLORERR.EXE
DLLLR.EXE
BPKR.EXE
RINST.EXE
BOOMR.EXE
LUIZR.EXE
MSVCHOST.EXE
MIKIR.EXE
KEYLOGGERR.EXE
FIFIAONLINE2R.EXE
GAMER.EXE
LOLAWDA.EXE
REMOVE.EXE
B.EXE
A.EXE
E.EXE
D.EXE
H.EXE
KR.EXE
21.TMP.EXE
1E9.TMP.EXE
7F5.TMP
7F5.TMP.EXE
123.EXE
DC3608.EXE
3.TMP.EXE

Filesizes

The following file size has been seen:

20,480 bytes
144,384 bytes
213,504 bytes
7,680 bytes
224,396 bytes
385,536 bytes
24,416 bytes

File Type

The filename R.EXE refers to many versions of an executable program.

File Activity

One or more files with the name R.EXE creates, deletes, copies or moves the following files and folders:

Creates c:\windows\tasks\{BB65B0FB-5712-401b-B616-E69AC55E2757}.job

Website Activity

One or more files with the name R.EXE interacts with the following web sites and pages. Web addresses have been deliberately modified to prevent unintentional use.

Remote server connection to imagesrepository .co
Remote server connection to delphiner .co
Remote server connection to philipining .co
Remote server connection to 68 .169 .64 .2
Remote server connection to 206 .161 .121 .11
Remote server connection to www .asklots .co
Remote server connection to www .top100search .co
Remote server connection to www .avsmile .co
Remote server connection to 66 .230 .188 .6
Remote server connection to www .trannysmile .co
Remote server connection to avsmile .co
Remote server connection to chamitron .co
Remote server connection to www .hardbabetube .co
Remote server connection to abyssmilf .co
Remote server connection to images-base .co
Remote server connection to 64 .111 .196 .11
Remote server connection to st .xhamster .co
Remote server connection to st3 .xhamster .co
Remote server connection to st4 .xhamster .co
Remote server connection to st2 .xhamster .co
Remote server connection to www .teeniesmile .co
Remote server connection to www .teeniepornotube .co
Remote server connection to www .livetosearch .co .u
Remote server connection to findreviews24 .co .u
Remote server connection to abyssteens .co
Remote server connection to admedia .xmlsearch .findwhat .co
TCP:127.0.0.1:1118 Port:22
Port 80 IP:216.240.157.91
Port 80 IP:94.75.207.219
Port 80 IP:64.69.32.220
Port 80 IP:68.169.64.29
Port 80 IP:206.161.121.115
Port 80 IP:67.29.139.153
Port 80 IP:213.174.149.70
Port 80 IP:78.108.178.65
Port 80 IP:66.230.188.67
Port 80 IP:207.154.16.34
Port 80 IP:64.111.208.43
Port 80 IP:67.201.36.16
Port 80 IP:195.224.176.7
Port 80 IP:68.169.70.241
Port 80 IP:78.108.180.77
Port 80 IP:64.27.1.205
Port 80 IP:88.85.73.157
Port 80 IP:204.137.28.195
Port 80 IP:88.85.68.230
Port 80 IP:64.111.196.117
Port 80 IP:76.9.16.146
Port 80 IP:88.208.24.41
Port 80 IP:216.240.143.20

Help the Webroot Community to fight cyber crime

We are always looking for ways to improve the quality and speed of research to help us protect you from malicious software and cyber crime.

The filename referred to in this report is often associated with PC infections. If you have a program of this name on your PC and would like to help our research please tell us what you know in the form below:

I have this file on my PC and believe it is an infection
I have this file on my PC and think it has made my PC slower
My firewall asked if I wanted to let this file have access to the Internet
My PC will not work since I noticed this file on it
My antivirus detected this file but won't remove it
I know what this file is and believe it is a Safe program
I am the author of this file and would like to discuss how to have it reclassified as safe

Further Comments or information you'd like to share: (optional)

Your email address if you would like us to contact you about this file and any concerns you may have: (optional)

PCMag.com Editors' Choice Award Logo is a trademark of Ziff Davis Publishing Holdings Inc. Used under license.

R.EXE

Free PC Cleanup from Webroot