Prevx Research Division
CCCINSTALL.EXE
WormThe most common objects with the name of CCCINSTALL.EXE are considered safe.
You can use our Webroot Secure Anywhere to thoroughly check your PC for spyware and other infections. It is free and takes less than 2 minutes to run. To start the scan just click the blue button.
Associated Malware Groups
The unsafe files using this name are associated with the malware group:
- Worm
File Behavior
CCCINSTALL.EXE has been seen to perform the following behavior:
- Executes a Process
- This Process Deletes Other Processes From Disk
- The process is run as an MSI installer package
- This process creates other processes on disk
- Registers a Dynamic Link Library File
- Checks for the use of debuggers
- This Process is a file infector which modifies program files to include a copy of the infection
- Includes file creation code which could be used to test for interception by security products
- This Process uses Anti Dissasembly Tricks to avoid analysis by security products
CCCINSTALL.EXE has been the subject of the following behavior:
- Created as a process on disk
- Executed as a Process
- Has code inserted into its Virtual Memory space by other programs
- Registered as a Dynamic Link Library File
- Deleted as a process from disk
- Terminated as a Process
- Created by processes which appear to be checking for interception by security products
Country Of Origin
The filename CCCINSTALL.EXE was first seen on May 7 2008 in the following geographical regions of the Webroot community:
- on May 7 2008
- Myanmar on May 7 2008
- The United States on May 22 2008
- Spain on Jul 2 2008
- The United Kingdom on Dec 23 2010
Filesizes
The following file size has been seen:
- 53,248 bytes
- 126,976 bytes
- 87,689 bytes
- 131,072 bytes
File Type
The filename CCCINSTALL.EXE is used by multiple object types including objects,executable programs.
File Activity
One or more files with the name CCCINSTALL.EXE creates, deletes, copies or moves the following files and folders:
- Creates c:\windows\rundl132.exe
- Creates c:\windows\Logo1_.exe
- Deletes c:\docume~1\user\locals~1\temp\$$a9.bat
- Creates c:\docume~1\user\locals~1\temp\$$a9.bat
- Creates c:\windows\Dll.dll
- Creates d:\_desktop.ini
- Creates c:\_desktop.ini
- Creates c:\config.msi\_desktop.ini
- Creates c:\malwarefiles\_desktop.ini
- Creates c:\mbr\_desktop.ini
- Creates c:\program files\_desktop.ini
- Creates c:\program files\adobe\_desktop.ini
- Creates c:\program files\adobe\reader 8.0\_desktop.ini
- Creates c:\program files\adobe\reader 8.0\reader\_desktop.ini
- Creates c:\program files\adobe\reader 8.0\reader\plug_ins3d\_desktop.ini
- Creates c:\program files\adobe\reader 8.0\reader\plug_ins3d\prc\_desktop.ini
- Creates c:\program files\adobe\reader 8.0\resource\_desktop.ini
- Creates c:\program files\adobe\reader 8.0\resource\cmap\_desktop.ini
- Creates c:\program files\adobe\reader 8.0\resource\font\_desktop.ini
- Creates c:\program files\compaq\_desktop.ini
- Creates c:\program files\compaq\setrefresh\_desktop.ini
- Creates c:\program files\hewlett-packard\_desktop.ini
- Creates c:\program files\hewlett-packard\sdp\_desktop.ini
- Creates c:\program files\hpq\_desktop.ini
- Creates c:\program files\hpq\hp help and support\_desktop.ini
- Creates c:\program files\hpq\my product name\_desktop.ini
- Creates c:\program files\intel\_desktop.ini
- Creates c:\program files\intel\ans\_desktop.ini
- Creates c:\program files\intel\dmix\_desktop.ini
- Creates c:\program files\intel\dmix\hlp\_desktop.ini
- Creates c:\program files\intel\dmix\resource\_desktop.ini
- Creates c:\program files\intel\dmix\uninst\_desktop.ini
- Creates c:\program files\intel\ncs2\_desktop.ini
- Creates c:\program files\intel\ncs2\agent\_desktop.ini
- Creates c:\program files\intel\ncs2\wmiprov\_desktop.ini
- Creates c:\program files\intel\ncs2\wmiprov\mof\_desktop.ini
- Creates c:\program files\java\_desktop.ini
- Creates c:\program files\java\jre1.6.0_02\_desktop.ini
- Creates c:\program files\java\jre1.6.0_02\bin\_desktop.ini
- Creates c:\program files\java\jre1.6.0_02\bin\client\_desktop.ini
- Creates c:\program files\java\jre1.6.0_02\lib\_desktop.ini
- Creates c:\program files\java\jre1.6.0_02\lib\applet\_desktop.ini
- Creates c:\program files\java\jre1.6.0_02\lib\audio\_desktop.ini
- Creates c:\program files\java\jre1.6.0_02\lib\cmm\_desktop.ini
- Creates c:\program files\java\jre1.6.0_02\lib\deploy\_desktop.ini
- Creates c:\program files\java\jre1.6.0_02\lib\ext\_desktop.ini
- Creates c:\program files\java\jre1.6.0_02\lib\fonts\_desktop.ini
- Creates c:\program files\java\jre1.6.0_02\lib\i386\_desktop.ini
- Creates c:\program files\java\jre1.6.0_02\lib\im\_desktop.ini
- Creates c:\program files\java\jre1.6.0_02\lib\images\_desktop.ini
Network Activity
One or more files with the name CCCINSTALL.EXE performs the following network events:
- Pings: 1.1.35.2
- Pings: 1.1.35.3
- Pings: 1.1.35.4
- Pings: 1.1.35.5
- Pings: 1.1.35.6
- Pings: 1.1.35.7
- Pings: 1.1.35.8
- Pings: 1.1.35.9
- Pings: 1.1.35.10
- Pings: 1.1.35.11
- Pings: 1.1.35.12
- Pings: 1.1.35.13
- Pings: 1.1.35.14
- Pings: 1.1.35.15
- Pings: 1.1.35.16
- Pings: 1.1.35.17
- Pings: 1.1.35.18
- Pings: 1.1.35.19
- Pings: 1.1.35.20
- Pings: 1.1.35.21
- Pings: 1.1.35.22
- Pings: 1.1.35.23
- Pings: 1.1.35.24
- Pings: 1.1.35.25
- Pings: 1.1.35.26
- Pings: 1.1.35.27
- DNS Lookup1.1.35.1 DC35KHOA84RH
Help the Webroot Community to fight cyber crime
We are always looking for ways to improve the quality and speed of research to help us protect you from malicious software and cyber crime.
PCMag.com Editors' Choice Award Logo is a trademark of Ziff Davis Publishing Holdings Inc. Used under license.