Prevx Research Division
DXBLBM.EXE
WormFree PC Cleanup from Webroot
Use Webroot SecureAnywhere to remove DXBLBM.EXE.
"Just when you thought it couldn't get any better or faster. The Webroot scanning engine is 'high octane' with a hidden nitrous oxide system. Bravo!!!" W. Lodzinski, SecureAnywhere User
Associated Malware Groups
The unsafe files using this name are associated with the malware group:
- Worm
File Behavior
DXBLBM.EXE has been seen to perform the following behavior:
- The Process is packed and/or encrypted using a software packing process
- Disables Access to the Windows Registry Editior
- Modifies Windows Security Policies to restrict/expand User Privileges on the machine
- Adds a Registry Key (RUN) to auto start Programs on system start up
- Disables the built in Windows File Protection System
- Writes to another Process's Virtual Memory (Process Hijacking)
- This process creates other processes on disk
- Executes a Process
- Hooks the WININET.DLL function allowing it to read or copy Http and Https web page content and session information
- Registers a Dynamic Link Library File
- This Process Deletes Other Processes From Disk
- Creates new folders on the system
- Sets processes to start during user logon
- Creates, modifies or schedules batch jobs
- Uses rootkit techniques to conceal its presence, interrogation or removal
- This Process tampers with Vulnerable System Files and Settings
- Adds a Link in the Start Menu
- Modifies the Logon Screen Saver Settings
- Found on infected systems and resists interrogation by security products
DXBLBM.EXE has been the subject of the following behavior:
- Created as a process on disk
- Executed as a Process
- Has code inserted into its Virtual Memory space by other programs
- Added as a Registry auto start to load Program on Boot up
- Registered as a Dynamic Link Library File
- Added as a Link in the Start Menu
- Deleted as a process from disk
Country Of Origin
The filename DXBLBM.EXE was first seen on May 25 2007 in the following geographical regions of the Webroot community:
- South Africa on May 25 2007
- The United Kingdom on Jul 19 2010
File Name Aliases
DXBLBM.EXE can also use the following file names:
- BR4743ON.EXE
- WINLOGON.EXE
- LSASS.EXE
- SERVICES.EXE
- SMSS.EXE
- INETINFO.EXE
- CSRSS.EXE
- SVCHOST.EXE
- SYSTEM'S SETTING.SCR
- BBM-XPMLRHLC.EXE
- BR3555ON.EXE
- SEMBAKO-CLZJLRH.EXE
- CMD-BRO-RLX.EXE
- EMPTY.PIF
- USER'S SETTING.SCR
- MOTORSPORT.EXE
- MUSIC.EXE
- ADMINISTRATOR'S SETTING.SCR
- MY ALBUMS.EXE
- ITUNES.EXE
- BARNETTS Q & B.EXE
- DMD.EXE
- ONE LOVE.EXE
- MADELEINE.EXE
- UNKNOWN ALBUM (2010-04-01 02-19-55 PM).EXE
- DX-BALL.EXE
- DRIFTING.EXE
- SOL.EXE
- MY SCANS.EXE
- DATA.EXE
- IMAGES.EXE
- SOUNDS.EXE
- NEROVISION.EXE
- NO FEAR.EXE
- DOWNLOADS.EXE
- ADDRESS BOOK.EXE
- ONENOTE 2007 GUIDE.EXE
- PERSONAL NOTEBOOK.EXE
- EXCEL.EXE
- SYNC MANAGER.EXE
- WORK NOTEBOOK.EXE
- ONENOTE NOTEBOOKS.EXE
- REGISTRYFIX V6.2`.EXE
- CU TECHNOLOGIES GROUP-ANDRE BOTHA.EXE
- FINCA NO 18.EXE
- VALUERS.EXE
- CURRICULUM VITAES.EXE
- NANETTE - FINCA 18.EXE
- STEVEN BOOYENS CV.EXE
- DUMMY EMP201 & PAYSLIP.EXE
- CLIENTS FINANCIAL STATEMENTS.EXE
- GESTETNER FOTOSTAAT VERSEKERING - FINTECH.EXE
- HARDY ANYA.EXE
- HUURKONTRAK - BOSHOFF BREYTENBACH.EXE
- HUURKONTRAK - DONAVAN DERMAN.EXE
- HUURKONTRAK - JOE-ANGELIQUE HERMANN.EXE
- HUURKONTRAK - KRISTLE TURNER.EXE
- IRP-6 2006 01.EXE
- JS JACOBS TAX INVOICES 3001-4000.EXE
- ARTIKEL KLERKE KONTRAKTE.EXE
- HUURKONTRAK - MEESTER.EXE
- DESIREE KITCHEN TEA 12 MARCH 2011.EXE
- TROUE DESIREE EN STEVEN-MARK.EXE
- BLOMME.EXE
- HUURKONTRAK HENNOPS PRIDE 16.EXE
- DEHAVEN OOST BRIDAL SUITE.EXE
- GALAGOS VENUE.EXE
- IQ ELITE.EXE
- GALAGOS TROUE.EXE
- GASTELYS.EXE
- KITCHEN TEA DIRECTIONS TO ARBEZ.EXE
- MYNE.EXE
- AANSTELLINGSBRIEWE.EXE
- IRBA BOARD OF AUDITORS - KAA GHANNAM.EXE
- LIEDJIES VIR KAPELPROGRAM.EXE
- JS JACOBS TYDSTATE K TOT Z.EXE
- KALTWASSER CM - MARIETJIE SE OUMA.EXE
- KATHLEHO WATERS - JOHAN VENTER.EXE
- KEI TYPING TRANSCRIBING - DU PLESSIS.EXE
- KLEYNHANS DW.EXE
- KOK PJ.EXE
- KOTZE EW (BOEDEL AJ).EXE
- KOTZE JAN GROEP.EXE
- KRUGER BERNIE GROEP.EXE
- KRUGER DRIES.EXE
- LACANTE GROUP.EXE
- LAERSKOOL SWARTKOP.EXE
- LAVIN ANNELIE.EXE
- LE ROUX SHAUN.EXE
- LEKALA MADIKE.EXE
- LOUW MC.EXE
- LYONS VINCENT GROUP.EXE
- MAC MAC CONSTRUCTION CC.EXE
- MARITZ G.EXE
- MARITZ TIAAN.EXE
- MARTIN BOTHA GROEP.EXE
- MCKAY JOHN GROUP.EXE
- MCMASTER GROUP.EXE
- MICRO PRO DE BEERS.EXE
- MIRRORS & FRAMES.EXE
- MOOLMAN GROEP - BLACK BROKERS & TRADE FACTOR.EXE
- MOROLO XP.EXE
- MORRISON GROUP.EXE
- MUG & BEAN GROUP.EXE
- MATRIEKAFSKEID VAN ZAK IN 2003.EXE
- BOTHA MARLé.EXE
- CONRADIE SUZELLE.EXE
- DE WET ROLANDA.EXE
- MULDER DENIESE.EXE
- MYBURGH GROUP.EXE
- NEL RM.EXE
- DIDI VAN NIEKERK.EXE
- FAASEN NICO.EXE
- FERREIRA BENNIE.EXE
- HALFJAAR EVALUASIE VORMS.EXE
- JACOBS NANETTE.EXE
- KLAVER JENNY.EXE
- KORTTYD EN STUDIEVERLOF.EXE
- NEPGEN GROEP.EXE
- KROUCAMP WILLEM GERT JOHANNES.EXE
- KURSUSSE - PROBETA.EXE
- AANHANGSELS.EXE
- SEMBAKO-CJZJMIH.EXE
- KINOKI.EXE
- MIS IMáGENES.EXE
- MIS ARCHIVOS RECIBIDOS.EXE
- MI MúSICA.EXE
- MIS DOCUMENTOS.EXE
- BBM-SSPLLGHC.EXE
- CMD-BRO-LLX.EXE
- SEMBAKO-CHZJLLG.EXE
- BR5997ON.EXE
- AORNELAS'S SETTING.SCR
- SEMBAKO-DGZJMLG.EXE
- BR4941ON.EXE
- BBM-XPMMLGGD.EXE
- RECEIVED.EXE
- SEMBAKO-CHZJLPH.EXE
- MY MUSIC.EXE
- AUDIO.EXE
- PHOTOS.EXE
- RINGTONE.EXE
- SYMANTEC.EXE
- UMAPS TRADING.EXE
- MADS.EXE
- IPOD PHOTO CACHE.EXE
- MESSAGES.EXE
- DATA KHALIFA.EXE
- HEBREW.EXE
- FINNISH.EXE
- FRENCH.EXE
- GERMAN.EXE
- ITALIAN.EXE
- JAPANESE.EXE
- KOREAN.EXE
- NORWEG.EXE
- POLISH.EXE
- RUSSIAN.EXE
- SIMPCHIN.EXE
- SPANISH.EXE
- SWEDISH.EXE
- THAI.EXE
- TRADCHIN.EXE
- SYS.EXE
- ARABIC.EXE
- KHALIFA'S SETTING.SCR
- BRAZIL.EXE
- DANISH.EXE
- DUTCH.EXE
- ENGLISH.EXE
- BDCACT.EXE
- ROMS.EXE
- TEKKEN_ADVANCE.EXE
- BBM-QPRLPHHC.EXE
- CMD-BRO-PLX.EXE
- JASON.EXE
- NOEL CARS.EXE
- DATA USER.EXE
- SEMBAKO-CNZJLRH.EXE
- SUNE'S SETTING.SCR
- DESIREE 21ST.EXE
- DYNAMIC TECHNOLOGIES.EXE
- J & E LEMMER.EXE
- F25.EXE
- F26.EXE
- IB12 & 14 2004 & 2005.EXE
- F03.EXE
- F27.EXE
- F04.EXE
- F05.EXE
- F00.EXE
- F01.EXE
- F02.EXE
- F50.EXE
- F47.EXE
- F48.EXE
- F23.EXE
- F24.EXE
- F49.EXE
- F35.EXE
- F44.EXE
- F45.EXE
- F46.EXE
- F21.EXE
- F22.EXE
- S-1-5-21-1482476501-1644491937-682003330-1013.EXE
- F43.EXE
- F39.EXE
- F41.EXE
- F20.EXE
- F42.EXE
- F40.EXE
- F18.EXE
- F19.EXE
- F17.EXE
- F37.EXE
- F38.EXE
- F36.EXE
- F16.EXE
- F15.EXE
- F14.EXE
- F12.EXE
- F13.EXE
- F11.EXE
- F10.EXE
- F31.EXE
- F32.EXE
- F33.EXE
- F34.EXE
- F06.EXE
- F07.EXE
- F08.EXE
- F09.EXE
- F30.EXE
Filesizes
The following file size has been seen:
- 65,024 bytes
- 45,493 bytes
File Type
The filename DXBLBM.EXE refers to many versions of an executable program.
Help the Webroot Community to fight cyber crime
We are always looking for ways to improve the quality and speed of research to help us protect you from malicious software and cyber crime.
PCMag.com Editors' Choice Award Logo is a trademark of Ziff Davis Publishing Holdings Inc. Used under license.