NEW FOLDER.EXE, Prevx

Associated Malware Groups

The filename is associated with the malware groups:

System Back Door
Cloaked Malware
Malicious Software
Worm

File Behavior

NEW FOLDER.EXE has been seen to perform the following behavior:

The Process is packed and/or encrypted using a software packing process
Changes the Internet Explorer Home Page Settings
Can communicate with other computer systems using HTTP protocols
Executes a Process
This process creates other processes on disk
Modifies Windows Security Policies to restrict/expand User Privileges on the machine
This Process Deletes Other Processes From Disk
Registers a Dynamic Link Library File
Looks at the contents of the autoexec.bat file
Reads email address and phone book details
Found on infected systems and resists interrogation by security products
Uses low level functions to hide itself from the user and from system/security processes
Disables Access to the Task Manager built into Windows
Disables Access to the Windows Registry Editior
Disables the Notification Balloon for the Windows Security Center
Changes of IE options including home page, security tab, colour, font, advanced, menu
Adds products to the system registry
Disables the built in Windows File Protection System
Disables the Built in Windows System Restore Feature
Automatically changes your firewall settings to allow itself or other programs to communicate over the internet
Writes to another Process's Virtual Memory (Process Hijacking)
The process hooks code into all running processes which could allow it to take control of the system or record keyboard input, mouse activity and screen contents
Adds a Link in the Start Menu
Terminates Processes
Loads and Executes a System Driver File
Hooks the WININET.DLL function allowing it to read or copy Http and Https web page content and session information
Copies files
Downloads program file(s) and other content from the web
Disables safe mode on your PC
Changes the Windows Security Center to stop Antivirus status alerts from being displayed
Changes the Windows Security Center to stop Firewall status alerts from being displayed
Changes the Windows Security Center to stop Firewall override alerts from being displayed
Changes the Windows Security Center to stop warnings from being displayed if automatic Windows Updates are not enabled
Sets processes to start during user logon
Injects code into other processes
Performs DNS look ups to resolve URL IP addresses
Creates a new Background Service on the machine
Modifies the Windows Host File which could be used to stop you visiting specific web sites by redirecting you to alternative addresses without you knowing
Can communicate with other computers using TCP protocols
Makes outbound connections to other computers using NETBIOSOUT protocols
Enables the system to use a Communications Proxy Server

NEW FOLDER.EXE has been the subject of the following behavior:

Executed as a Process
Created as a process on disk
Added as a Registry auto start to load Program on Boot up
Deleted as a process from disk
Executed from Temporary Folders
Has code inserted into its Virtual Memory space by other programs
Executed by Internet Explorer
Registered as a Dynamic Link Library File
Added as a Link in the Start Menu
Terminated as a Process
Deleted as a Link in the Start Menu

Country Of Origin

The filename NEW FOLDER.EXE was first seen on May 8 2007 in the following geographical regions of the Webroot community:

on May 8 2007
Saudi Arabia on May 8 2007
The United States on May 9 2007
Italy on May 9 2007
Kuwait on May 23 2007
Trinidad and Tobago on Jun 11 2007
Romania on Aug 7 2007
India on Sep 13 2009
The United Kingdom on Aug 15 2010
Turkey on Feb 13 2012

File Name Aliases

NEW FOLDER.EXE can also use the following file names:

LSASS.EXE
SVCHOST.EXE
ZUN[n].EXE
MISC.EXE
BOOT.EXE
MSCONFIG.EXE
SVHOST32.EXE
FOUND.000.EXE
FOUND.001.EXE
SYSTEM VOLUME INFORMATION.EXE
ATHADEVARU.EXE
TAGORE.EXE
TAJ MAHAL.EXE
TAKADHIMITHA.EXE
TAKKARI.EXE
TAKKARIDONGA.EXE
KONDAPALLI RAJA.EXE
KONDAVEETI_DONGA.EXE
KONDAVVETI SHIMAHAM.EXE
KONTE KURRALLU.EXE
KOOLI NO.1.EXE
KOPY KATS.EXE
KOTHA KATHA.EXE
KOTTA BANGARU LOKAM.EXE
KOUSALYA SUPRAJA RAMA.EXE
KRISHNA.EXE
KRISHNAARJUNA.EXE
KRRISH(TELUGU).EXE
KUBHUSAM.EXE
KUMKUMA.EXE
KUSHI.EXE
LAAHIRI_LAAHIRI_LAAHIRI.EXE
LADY BICHUAA.EXE
LAILA COLLEGE.EXE
LAILA MAJNU.EXE
LAKSHMI.EXE
LAKSHMI KALYANAM.EXE
LAKSHYAM.EXE
LALITHA SAHASRA NAMAM.EXE
LARRY DRIVER.EXE
YAGNAM.EXE
LAXMI PUTRUDU.EXE
LAXMINARSHIMHA.EXE
LEELA MAHAL CENTER.EXE
LETHAMANASULU.EXE
LUCKY.EXE
M M KAMARAJU.EXE
MA.ANNAYA.EXE
MAA IDDARI MADHYA.EXE
MAAVI CHIGURU.EXE
MADHUMASAM.EXE
MAHA.EXE
MAHA NANDI.EXE
MAHANAGARAM LO.EXE
MAHARADHI.EXE
MAHARSHI.EXE
MAISAMMO..MAISAMMA.EXE
MAJAA.EXE
MAJNU.EXE
MAJOR CHANDRAKANTH.EXE
MALLEPUVVU(NEW)(ILA).EXE
MALLISWARI.EXE
MANASANT.EXE
MANASANTHA NUVVE.EXE
MANASU MAATA VINADU.EXE
WELL PEAPERS.EXE
HAI.EXE
VENGA_BOYS.EXE
VENKI.EXE
VENNALA.EXE
VESAVI.EXE
VICTORY.EXE
VIDHYARDI.EXE
VIJAYA DASAMI.EXE
VIJETHA.EXE
VIKRAMAARKUDU.EXE
VISHAKA EXPRESS.EXE
VIVHA.EXE
VIYYALA VARI KAYYALU.EXE
YAMA_LEELA.EXE
YAMAGOLA ( NEW).EXE
YAMAJAATHAKUDU.EXE
YOOGI.EXE
MITHRUDU -- BALU.EXE
NEW FOLDER111.EXE
PAANDU.EXE
PAATA.EXE
PADAHARELLA VAYASU.EXE
PAGALEVENNALA.EXE
PALAKILO.PENLLIKUTURU.EXE
PALLE NIKU VANDANULU.EXE
PANDEM.EXE
PANDEM KODI.EXE
PANDURANGADU.EXE
PARADESI.EXE
PARDHU.EXE
PARTY.EXE
AUTORUN.INF.EXE
FOUND.002.EXE
FOUND.003.EXE
RECYCLED.EXE
CHROME.EXE
RVHOST.EXE
BOYS TRIP 29 APRIL 2007.EXE
فلاش.EXE
BIN.EXE
CONF.EXE
DRACULAVIRUSTEMIZLEYICIV3.0.EXE
şARKıLAR.EXE
GTA-YENI.EXE
ISMAIL YK.EXE
MüZIK.EXE
MOBIMB MOBILE MEDIA BROWSER USE'S MANUAL.EXE
JJJJJ.EXE
SVCHOST32.EXE
ZUN[1].EXE
SVHOST.EXE
ARCHIVE.EXE
CURRENT DRAWING'S.EXE
DOCUMENTS.EXE
DETAILS.EXE
ZG. MARTAIN.EXE
PICTURES.EXE
RECEIVED DRAWING'S.EXE
WORKING DRAWING'S.EXE
D1B5319B-0683-498D-B0D6-E2463D.ASQ
D3A33BAB-E4AE-4729-8D36-A1B975.ASQ
DEB1DDA8-E5D5-4EF4-B393-C5E349.ASQ
F0161CC4-13AD-4E19-BFDC-1BD7DA.ASQ
A561269D-2D98-4B25-801C-B1B1D1.ASQ
E9ABE27B-2FE0-4A3F-AC2E-D7E74D.ASQ
B72C4F47-7397-41CE-A620-8ED361.ASQ
BBE0CFE2-57B2-4776-8529-AF54BB.ASQ
D9C8D177-F3EB-4F0D-9DE1-689F41.ASQ
A71BD29D-2FE8-4B54-A963-CEE41F.ASQ
D9262FEB-1E24-4128-8092-C520E3.ASQ
A69686AA-9448-43F8-A43A-08B8B8.ASQ
A1ABF69D-D39E-4EAA-B2E8-9C298C.ASQ
A9BA2A34-368E-4204-96B3-11F8BB.ASQ
D51FDE90-4AF9-4CAD-BA93-723F61.ASQ
E626C99E-E1EE-4E13-8598-52C587.ASQ
EBB690A8-2F19-4034-8B2A-84CE12.ASQ
BF14156C-8B0C-45A2-B41F-E31026.ASQ
D31A25A7-7587-49BC-96FF-0553C7.ASQ
BD301C8B-2885-4AA3-A634-B4437F.ASQ
WORM2007[n].EXE
CAG1AF0X.EXE
DF5.EXE
DD4.EXE
DE3.EXE
DD3.EXE
DF4.EXE
DF3.EXE
DE2.EXE
DD2.EXE
DF1.EXE
DD1.EXE
DF2.EXE
DE1.EXE
74C8A8C7-BCD3-4A32-BA11-10DCA0.ASQ
67DBEFF8-BF4D-4830-B928-25A32D.ASQ
3894336E-0B22-417B-B03F-64BB5C.ASQ
55626A22-7EED-4D72-8BB1-64D241.ASQ
DC124.EXE
0CAD7293-A664-45F9-9B12-FF595B.ASQ
936915C6-5B88-42F4-AE7A-1FC632.ASQ
7DDF14EA-E234-454B-9E4B-396553.ASQ
76A54001-8FF8-4718-82BE-7E0750.ASQ
25B167F2-2F75-4318-9EB9-408BE6.ASQ
98DAAE8E-1EA6-422D-BF75-E21592.ASQ
4B2F11EE-562D-4425-AA78-433AE8.ASQ
575506BA-CCE1-4E3F-9120-828340.ASQ
6CEC6FF8-6CC6-44EB-80DD-55D463.ASQ
6D5E9AF9-316D-4702-B9D7-3A89CB.ASQ
8C4B5774-58A0-4871-8283-F2FF95.ASQ
55A570ED-BE1E-48EF-B87F-553407.ASQ
87824CDF-F9B1-4233-8794-A24CE6.ASQ
3B964A36-570E-4B17-AC62-40C00B.ASQ
6F980B82-D8C0-42AF-90AD-A58596.ASQ
566835F5-DDAC-40EF-BF73-92104F.ASQ
579C9144-92C5-499D-A198-798517.ASQ
3CCE254F-D61F-4B2F-8A66-331983.ASQ
3B0B2224-BB19-4690-BE5B-4372F4.ASQ
22638F3F-D035-4102-911F-080B92.ASQ
3F8906DD-AE97-406A-AB86-F3544E.ASQ
3755CCCA-3602-42E6-9258-410504.ASQ
11BB5A15-12E1-4729-88DD-85EAD3.ASQ
2767F0F6-985F-465F-9D55-819D87.ASQ
89D23908-C946-4D94-B274-55F64D.ASQ
7E034DA9-47F7-49CB-AB32-508782.ASQ
006912BD-65AB-4D74-8795-5BF9D9.ASQ
2F0B1A8A-8BB1-473A-AB4C-AD076D.ASQ
2A2CC559-2BC5-42B4-A592-37D6BB.ASQ
2D9EF4B3-E873-4905-9831-84435D.ASQ
715D69F5-427E-44C0-BEC4-61C5F1.ASQ
94F6ECA5-62F9-4DF4-91AE-C8B9E4.ASQ
7C2C39D9-0AD8-41E4-BC6F-F8C405.ASQ
93805051-DFEE-412C-91C3-292939.ASQ
7C06FF65-EAC6-4D03-A09C-F9BA6F.ASQ
0A6A378A-EE6D-4A66-889F-E9BA3D.ASQ
216BB92F-85B2-40B6-A959-112843.ASQ
7466FDC8-16F4-4AD9-8872-CCFC43.ASQ
3AE4F6E1-F5D0-4820-ADF1-6E63DC.ASQ
0B7DED0C-CE5A-40AB-A9B8-DCF292.ASQ
50925EF0-9EFB-4096-B3D4-D6A6D8.ASQ
61EDF5A2-4267-494B-B03F-09EFCD.ASQ
6A0ADA32-34E3-42E4-81F7-5F5380.ASQ
339A3393-FB20-4A97-A3F5-048164.ASQ
57B56007-4F21-460F-AD8D-FEF3C9.ASQ
26E02665-FD56-41B8-AAAF-E6D075.ASQ
2A873B2D-8E76-46A8-AEEB-8E8FD1.ASQ
56784BF3-292F-4BDE-ADDC-72AEAF.ASQ
28E0F91C-D4D6-4445-BAF5-B7AC2E.ASQ
918187AA-BA59-42B8-9F79-740560.ASQ
16B4093B-1825-4F1C-A8C2-C56AAA.ASQ
DC59.EXE

Filesizes

The following file size has been seen:

107,520 bytes
414,541 bytes
250,368 bytes
268,288 bytes
686,080 bytes
107,008 bytes

File Type

The filename NEW FOLDER.EXE refers to many versions of an executable program.

File Activity

One or more files with the name NEW FOLDER.EXE creates, deletes, copies or moves the following files and folders:

Deletes c:\windows\pchealth\helpctr\binaries\msconfig.exe
Deletes c:\windows\system32\restore\rstrui.exe
Opens/modifes c:\autoexec.bat
Creates c:\windows\lsass.exe
Creates c:\windows\system\lsass.exe
Creates c:\documents and settings\all users\start menu\programs\startup\MSconfig.exe
Creates c:\New Folder.exe
Creates d:\New Folder.exe

Website Activity

One or more files with the name NEW FOLDER.EXE interacts with the following web sites and pages. Web addresses have been deliberately modified to prevent unintentional use.

TCP:127.0.0.1:1094 Port:17
Port 80 IP:64.26.25.75
TCP:127.0.0.1:1096 Port:15
Port 80 IP:77.232.68.245

Help the Webroot Community to fight cyber crime

We are always looking for ways to improve the quality and speed of research to help us protect you from malicious software and cyber crime.

The filename referred to in this report is often associated with PC infections. If you have a program of this name on your PC and would like to help our research please tell us what you know in the form below:

I have this file on my PC and believe it is an infection
I have this file on my PC and think it has made my PC slower
My firewall asked if I wanted to let this file have access to the Internet
My PC will not work since I noticed this file on it
My antivirus detected this file but won't remove it
I know what this file is and believe it is a Safe program
I am the author of this file and would like to discuss how to have it reclassified as safe

Further Comments or information you'd like to share: (optional)

Your email address if you would like us to contact you about this file and any concerns you may have: (optional)

PCMag.com Editors' Choice Award Logo is a trademark of Ziff Davis Publishing Holdings Inc. Used under license.

NEW FOLDER.EXE

Free PC Cleanup from Webroot