Prevx Research Division
WAR3.EXE
System Back DoorFree PC Cleanup from Webroot
Use Webroot SecureAnywhere to remove WAR3.EXE.
"Just when you thought it couldn't get any better or faster. The Webroot scanning engine is 'high octane' with a hidden nitrous oxide system. Bravo!!!" W. Lodzinski, SecureAnywhere User
Associated Malware Groups
The unsafe files using this name are associated with the malware groups:
- System Back Door
- Malicious Software
File Behavior
WAR3.EXE has been seen to perform the following behavior:
- Enables an In Process Object/Server - Common with DLL Injections
- Adds products to the system registry
- Creates a TCP port which listens and is available for communication initiated by other computers
- Can communicate with other computer systems using HTTP protocols
- Registers a Dynamic Link Library File
- The Process is packed and/or encrypted using a software packing process
- Can communicate with other computers using TCP protocols
- Makes outbound connections to other computers using NETBIOSOUT protocols
- This Process Deletes Other Processes From Disk
- Writes to another Process's Virtual Memory (Process Hijacking)
- This process creates other processes on disk
- Executes a Process
WAR3.EXE has been the subject of the following behavior:
- Created as a new Background Service on the machine
- Loaded and Executed as a System Driver File
- Created as a process on disk
- Executed as a Process
- Terminated as a Process
- Deleted as a process from disk
- Has code inserted into its Virtual Memory space by other programs
Country Of Origin
The filename WAR3.EXE was first seen on Jun 4 2007 in the following geographical regions of the Webroot community:
- France on Jun 4 2007
- Argentina on Jun 4 2007
- Germany on Jun 4 2007
- Ecuador on Jun 4 2007
- Finland on Oct 19 2007
- Cuba on Dec 5 2007
- Spain on May 28 2008
- China on May 28 2008
- Malaysia on Jul 28 2008
- Singapore on Jul 28 2008
- The United Kingdom on Jun 10 2010
- Myanmar on Jun 10 2010
- Vietnam on May 25 2012
File Name Aliases
WAR3.EXE can also use the following file names:
- YPU37.TMP
- LGK46F.TMP
- COV2DF2.TMP
- WAR3搜索.EXE
- 局域网搜索.EXE
- WAR3搜索器.EXE
- 山大软件学院战网W3C快速搜索.EXE
- GS.EXE
- .EXE
- 29220527.TMP
Filesizes
The following file size has been seen:
- 25,616 bytes
- 1,568,768 bytes
- 1,568,211 bytes
- 471,040 bytes
- 417,792 bytes
- 1,494,483 bytes
- 540,672 bytes
- 421,888 bytes
File Type
The filename WAR3.EXE is used by multiple object types including objects,executable programs.
Help the Webroot Community to fight cyber crime
We are always looking for ways to improve the quality and speed of research to help us protect you from malicious software and cyber crime.
PCMag.com Editors' Choice Award Logo is a trademark of Ziff Davis Publishing Holdings Inc. Used under license.