Prevx Research Division
WINLIB0.DLL
Cloaked MalwareFree PC Cleanup from Webroot
Use Webroot SecureAnywhere to remove WINLIB0.DLL.
"Just when you thought it couldn't get any better or faster. The Webroot scanning engine is 'high octane' with a hidden nitrous oxide system. Bravo!!!" W. Lodzinski, SecureAnywhere User
Associated Malware Groups
The unsafe files using this name are associated with the malware groups:
- Cloaked Malware
- Malware Downloader
File Behavior
WINLIB0.DLL has been seen to perform the following behavior:
- Creation and Registers a Browser Helper Object in Internet Explorer
- This process creates other processes on disk
- Looks at the contents of the autoexec.bat file
- Reads email address and phone book details
- Visits web sites on your PC without you knowing
WINLIB0.DLL has been the subject of the following behavior:
- Deleted as a process from disk
- Executed as a Process
Country Of Origin
The filename WINLIB0.DLL was first seen on Dec 30 2007 in the following geographical regions of the Webroot community:
- Europe on Dec 30 2007
- Spain on Dec 18 2008
- China on Nov 12 2009
- Philippines on Jun 13 2010
File Name Aliases
WINLIB0.DLL can also use the following file names:
- WINLIB .DLL
- WINLIB1.DLL
- WINLIB3.DLL
- WINLIB4.DLL
- WINLIB2.DLL
- WINLIB5.DLL
- WINLIB7.DLL
- WINLIB8.DLL
- ~MY1.TMP
- ~MY1.RTF
- _PZ_~MY30.TMP
- ~MY59.TMP
- ~MY7.TMP
- 61371684.DLL
- 43269939.SVD
Filesizes
The following file size has been seen:
- 122,880 bytes
- 110,592 bytes
- 139,264 bytes
- 200,704 bytes
- 176,128 bytes
- 118,784 bytes
File Type
The filename WINLIB0.DLL refers to many versions of a dynamic link library.
File Activity
One or more files with the name WINLIB0.DLL creates, deletes, copies or moves the following files and folders:
- Deletes c:\docume~1\user\locals~1\temp\~my7.tmp
- Opens/modifes c:\autoexec.bat
- Creates c:\windows\system32\gprmsgse.axz
- Creates c:\strategy.txt
Website Activity
One or more files with the name WINLIB0.DLL interacts with the following web sites and pages. Web addresses have been deliberately modified to prevent unintentional use.
- Remote server connection to gs .chnsystem .co
- Remote server connection to msl .chnsystem .co
- Port 80 IP:60.28.214.40
Help the Webroot Community to fight cyber crime
We are always looking for ways to improve the quality and speed of research to help us protect you from malicious software and cyber crime.
PCMag.com Editors' Choice Award Logo is a trademark of Ziff Davis Publishing Holdings Inc. Used under license.