Prevx Research Division
FORMAT.EXE
Malicious SoftwareIt is possible that your PC could be infected. The file name FORMAT.EXE is used by both safe and unsafe programs.
You should urgently check your PC to make sure it is not infected. The free version of Webroot Cloud AntiVirus Beta will scan your PC in less than two minutes and check for millions of spyware and malware infections including FORMAT.EXE. Don't put your confidential data, or your identity at risk, check your PC now with Webroot Cloud AntiVirus Beta.
Associated Malware Groups
The unsafe files using this name are associated with the malware group:
- Malicious Software
File Behavior
FORMAT.EXE has been seen to perform the following behavior:
- The Process is packed and/or encrypted using a software packing process
- This Process Deletes Other Processes From Disk
- Executes a Process
- This process creates other processes on disk
- Creates system tray popups, messages, errors and security warnings
- Found on infected systems and resists interrogation by security products
- Uses low level functions to hide itself from the user and from system/security processes
- Uses rootkit techniques to conceal its presence, interrogation or removal
- Registers a Dynamic Link Library File
FORMAT.EXE has been the subject of the following behavior:
- Added as a Registry auto start to load Program on Boot up
- Executed as a Process
- Created as a process on disk
- Copied to multiple locations on the system
- Has code inserted into its Virtual Memory space by other programs
- Executed from Temporary Folders
- Deleted as a process from disk
- Terminated as a Process
Country Of Origin
The filename FORMAT.EXE was first seen on May 25 2007 in the following geographical regions of the Webroot community:
- Russian Federation on May 25 2007
- Australia on Oct 21 2007
- France on Oct 21 2007
- on Nov 30 2007
- Germany on Sep 24 2008
- Ukraine on May 14 2010
- The United States on Oct 16 2010
- Turkey on May 17 2012
File Name Aliases
FORMAT.EXE can also use the following file names:
- USB-STICK-SOFTWARE.EXE
- VIR (nn).EXE
- IMATION DRIVE MANAGER V 3.0.2.EXE
- DENEME.EXE
- IMATIONDRIVEMANAGERV3.0.2.EXE
- IMATIONDRIVEMANAGERV3.0.2[n].EXE
- IMATIONDRIVEMANAGERV3[1].0.2.EXE
- IMATION%20DRIVE%20MANAGER%20V%203.0.2[1].EXE
- FORMAT V3080A.EXE
- NOT-VIRUS:BADJOKE.WIN32.FAKEFORMAT.E
- 15362891.SVD
- 68852783.EXE
Filesizes
The following file size has been seen:
- 1,925,632 bytes
- 814,592 bytes
- 99,328 bytes
- 554,496 bytes
- 1,313,792 bytes
- 221,184 bytes
- 696,320 bytes
File Type
The filename FORMAT.EXE refers to many versions of an executable program.
File Activity
One or more files with the name FORMAT.EXE creates, deletes, copies or moves the following files and folders:
- Copies fileufddll.dll to c:\windows\temp\ufddll.dll
- Creates c:\windows\temp\LOCK.EXE
- Copies filec:\windows\temp\LOCK.EXE to c:\windows\temp\LOCK.EXE
- Creates c:\windows\temp\ufddll.dll
- Copies filec:\windows\temp\ufddll.dll to c:\windows\temp\ufddll.dll
- Creates c:\windows\temp\udll.dll
- Copies filec:\windows\temp\udll.dll to c:\windows\temp\udll.dll
Help the Webroot Community to fight cyber crime
We are always looking for ways to improve the quality and speed of research to help us protect you from malicious software and cyber crime.
PCMag.com Editors' Choice Award Logo is a trademark of Ziff Davis Publishing Holdings Inc. Used under license.