Prevx Research Division
SYSTEM'S SETTING.SCR
Cloaked MalwareFree PC Cleanup from Webroot
Use Webroot SecureAnywhere to remove SYSTEM'S SETTING.SCR.
"Just when you thought it couldn't get any better or faster. The Webroot scanning engine is 'high octane' with a hidden nitrous oxide system. Bravo!!!" W. Lodzinski, SecureAnywhere User
Associated Malware Groups
The unsafe files using this name are associated with the malware groups:
- Cloaked Malware
- Worm
File Behavior
SYSTEM'S SETTING.SCR has been seen to perform the following behavior:
- The Process is packed and/or encrypted using a software packing process
- Disables Access to the Windows Registry Editior
- Modifies Windows Security Policies to restrict/expand User Privileges on the machine
- Adds a Registry Key (RUN) to auto start Programs on system start up
- Disables the built in Windows File Protection System
- Writes to another Process's Virtual Memory (Process Hijacking)
- This process creates other processes on disk
- Executes a Process
- Hooks the WININET.DLL function allowing it to read or copy Http and Https web page content and session information
- Registers a Dynamic Link Library File
- This Process Deletes Other Processes From Disk
- Creates new folders on the system
- Sets processes to start during user logon
- Creates, modifies or schedules batch jobs
- Modifies the Logon Screen Saver Settings
- This Process tampers with Vulnerable System Files and Settings
- Can communicate with other computer systems using HTTP protocols
- This Process is a file infector which modifies program files to include a copy of the infection
- Creates new folders in the file system
- Uses rootkit techniques to conceal its presence, interrogation or removal
- Uses low level functions to hide itself from the user and from system/security processes
SYSTEM'S SETTING.SCR has been the subject of the following behavior:
- Created as a process on disk
- Executed as a Process
- Has code inserted into its Virtual Memory space by other programs
- Added as a Registry auto start to load Program on Boot up
- Registered as a Dynamic Link Library File
- Deleted as a process from disk
- Copied to multiple locations on the system
- Created by processes which appear to be checking for interception by security products
Country Of Origin
The filename SYSTEM'S SETTING.SCR was first seen on May 8 2007 in the following geographical regions of the Webroot community:
- on May 8 2007
- Spain on May 8 2007
- Kuwait on May 22 2007
- Poland on May 26 2007
- Dominican Republic on Dec 30 2007
- India on Mar 12 2008
- South Africa on Jul 19 2010
- The United Kingdom on Jul 19 2010
- Malaysia on Sep 6 2010
- Vietnam on Apr 7 2012
File Name Aliases
SYSTEM'S SETTING.SCR can also use the following file names:
- BR4743ON.EXE
- WINLOGON.EXE
- LSASS.EXE
- SERVICES.EXE
- DXBLBM.EXE
- SMSS.EXE
- INETINFO.EXE
- CSRSS.EXE
- SVCHOST.EXE
- BBM-XPMLRHLC.EXE
- BR3555ON.EXE
- SEMBAKO-CLZJLRH.EXE
- CMD-BRO-RLX.EXE
- EMPTY.PIF
- USER'S SETTING.SCR
- MOTORSPORT.EXE
- MUSIC.EXE
- ADMINISTRATOR'S SETTING.SCR
- MY ALBUMS.EXE
- ITUNES.EXE
- BARNETTS Q & B.EXE
- DMD.EXE
- ONE LOVE.EXE
- MADELEINE.EXE
- UNKNOWN ALBUM (2010-04-01 02-19-55 PM).EXE
- DX-BALL.EXE
- DRIFTING.EXE
- SOL.EXE
- MY SCANS.EXE
- DATA.EXE
- IMAGES.EXE
- SOUNDS.EXE
- NEROVISION.EXE
- NO FEAR.EXE
- DOWNLOADS.EXE
- ADDRESS BOOK.EXE
- ONENOTE 2007 GUIDE.EXE
- PERSONAL NOTEBOOK.EXE
- EXCEL.EXE
- SYNC MANAGER.EXE
- WORK NOTEBOOK.EXE
- ONENOTE NOTEBOOKS.EXE
- REGISTRYFIX V6.2`.EXE
- HOSTS-DENIED BY-JOSE.COM
- BR3489ON.EXE
- HOSTS-DENIED BY-ANGELA.COM
- CMD-BRONTOK.EXE
- RAKYATKELAPARAN.EXE
- KESENJANGANSOSIAL.EXE
- SUB - CONTRACT - SUTTON.EXE
- VARIATIONS.EXE
- SITE PHOTOS(BST).EXE
- VARIATIONS NIHAL.EXE
- SUB - CONTRACT - NAFFCO.EXE
- VALUATION.EXE
- ADLM.EXE
- TRANSFER5'S SETTING.SCR
- BR7911ON.EXE
- POPCINEMA.EXE
- COREL SAMPLE MUSIC.EXE
- CROOK BROS - THE LEVEL.EXE
- IMESH.EXE
- JOE VIDIKEY - 0.EXE
- PHOTO DVD MAKER.EXE
- PHOTOSCACHE.EXE
- BR6063ON.EXE
- PRUEBA'S SETTING.SCR
- NIEVE'S SETTING.SCR
- BR4281ON.EXE
- MUZICA.EXE
- PHOTOS.EXE
- DATA POPA.EXE
- DATA SYSTEM.EXE
- SHAREDDOCS.EXE
- MY MUSIC.EXE
- SAMPLE MUSIC.EXE
- MY PICTURES.EXE
- POPA'S SETTING.SCR
- MY VIDEOS.EXE
- FAM.EXE
- NEW FOLDER (n).EXE
- KS'S SETTING.SCR
- SAMPLE PICTURES.EXE
- SONGS.EXE
- WINDOWS.EXE
- DRIVERS.EXE
- SYSTEM32.EXE
- DATA KS.EXE
- DATA ADMINISTRATOR.EXE
- DIVX MOVIES.EXE
- WEDNESDAY.EXE
- VIN.EXE
- SOFTWARES.EXE
- NEW TR HSE PARTY 2009.EXE
- NEW FOLDER.EXE
- HINDI SONGS.EXE
- BBM-XQRLPIJC.EXE
- SEMBAKO-CJZJLPI.EXE
- BR5601ON.EXE
- CMD-BRO-PLX.EXE
- BAITI'S SETTING.SCR
- DXBLAT.EXE
- PICTURE.EXE
- SEMBAKO-CNZJKOG.EXE
- CMD-BRO-OKX.EXE
- BBM-QPNKOGNC.EXE
- MR KAUSHAL UNIT 2.EXE
- HEROES.OF.MIGHT.AND.MAGIC.V WITH NODVD CRACK`.EXE
- WWW.TORRENT-GALAXY.TO...MEIN.FUEHRER.GERMAN.2006.DVDSCR.XVID-RCX`.EXE
- STARCRAFT 2 TRAILERS.EXE
- ESSAY PREP!.EXE
- MISS LLOYD.EXE
- DATA MARKO.XY-F408BE7F708F.EXE
- Мои документы.EXE
- AUTOMATION SAMPLES.EXE
- BIN.EXE
- PHOTOSHOP_CS3_RUS.EXE
- CONFIG.EXE
- SAVEFILES.EXE
- RISE OF THE ARGONAUTS.EXE
- COOKEDWINDOWS.EXE
- LOGS.EXE
- SAVEDATA.EXE
- SCRAMP.EXE
- Мои видеозаписи.EXE
- Мои рисунки.EXE
- Моя музыка.EXE
- SEMPALONG.EXE
- EKSPLORASI.EXE
- BRENGKOLANG.COM
- ADMIN'S SETTING.SCR
- DATA ELA.EXE
- DATA MARCHEW.EXE
- DATA OSA.EXE
- INNE.EXE
- VOICE.EXE
- MACIUSZEK.....!!! MAłA MYSZA`.EXE
- POLSKIE.EXE
- NOWY FOLDER.EXE
- AçãO SOCIAL'S SETTING.SCR
- OWNER'S SETTING.SCR
- WEAPDATA.EXE
- VIDEOS.EXE
- MY RECEIVED FILES.EXE
- HISTORY.EXE
- MIKE'S SETTING.SCR
- ADMIN.EXE
- COWHAND.EXE
- BANNERS.EXE
- WWW.EXE
- GDIPLUS.EXE
- ICELANDIC.EXE
- ADS.EXE
- DOCUMENTS.EXE
- DEFAULT.EXE
- WEBSITES.EXE
- DRW.EXE
- PINBALL.EXE
- LANG.EXE
- HTDOCS.EXE
- ITALIAN.EXE
- DOLLARSENSE.EXE
- MPTB.EXE
- FORUM.EXE
- IMG.EXE
- ARABIC.EXE
- ENGLISH.EXE
- CHINESE_TRADITIONAL.EXE
- SWEDISH.EXE
- CROATIAN.EXE
- SALES.EXE
- RUSSIAN.EXE
- DOCS.EXE
- COPYNET'S SETTING.SCR
- HISTóRICO.EXE
- SCREENSHOT.EXE
- SKIN.EXE
- BASIC_INTERFACE.EXE
- SCRIBBLING KID.EXE
- UNINSTALL.EXE
- MEUS DOCUMENTOS.EXE
- BLOCOS DE ANOTAçõES DO ONENOTE.EXE
- BLOCO DE ANOTAçõES PESSOAL.EXE
- BLOCO DE ANOTAçõES TRABALHO.EXE
- GUIA DO ONENOTE 2007.EXE
- MINHAS IMAGENS.EXE
- MINHAS MúSICAS.EXE
- ABRIL 2009.EXE
- SYMANTEC.EXE
- UMAPS TRADING.EXE
- MADS.EXE
- IPOD PHOTO CACHE.EXE
- BGM.EXE
- TOOLS.EXE
- CITRIX.EXE
- FONTS.EXE
- CIMV2R5.EXE
- IAS.EXE
- MSTSC_HPC.EXE
- PBA.EXE
- WBEMODBC.EXE
- NETBEUI.EXE
- ANSI.EXE
- USMT.EXE
- VALUEADD.EXE
- DXBLBA.EXE
- SEMBAKO-CKZJLOG.EXE
- BBM-RTTLOGKC.EXE
- CMD-BRO-OLX.EXE
- BBM-SPRLKGFD.EXE
- CMD-BRO-KLX.EXE
- SEMBAKO-DFZJLKG.EXE
- DATA ADMIN.EXE
- SEMBAKO-CIZJMLH.EXE
- BBM-XPMMLHIC.EXE
- CMD-BRO-LMX.EXE
- ZAPISANE GRY.EXE
- BO|ENA.EXE
- ZDJCIA.EXE
- SZKOBA.EXE
- IBAWA.EXE
- GRA{YNA.EXE
- SOUND.EXE
- TOMTOM_APPLICATION_FOR__GO_CLASSIC_GO300_GO500.EXE
- MODULE.EXE
- SLOT_222.EXE
- SLOT_223.EXE
- SLOT_224.EXE
- SLOT_225.EXE
- TALKTABLES.EXE
- DAO_PRC_PROMO_2.EXE
- PBGRADE_B00817540428050.EXE
- PBGRADE_B01217540428050.EXE
- MOJE OBRAZY.EXE
- POPRAWINY.EXE
- WORLD IN CONFLICT.EXE
- DEBUG.EXE
- SAVEGAMES.EXE
- SLOT_88.EXE
- SLOT_89.EXE
- OBRAZ.EXE
- ITUNES MUSIC.EXE
- SLOT_435.EXE
- SLOT_436.EXE
- PBGRADE_B01617540428050.EXE
- PBGRADE_B02117540428050.EXE
- MEDJUGORJE.EXE
- MOBILE APPLICATIONS.EXE
- PREVIOUS ITUNES LIBRARIES.EXE
- OTHER.EXE
- CAR.EXE
- FACIALANIMATIONS.EXE
- ITN.EXE
- LICENCES.EXE
- PHONE_DATABASE.EXE
- POI.EXE
- CAREER_01.EXE
- SLOT_9.EXE
- SLOT_90.EXE
- SLOT_91.EXE
- SLOT_92.EXE
- SLOT_437.EXE
- SLOT_438.EXE
- MOJE WIDEO.EXE
- MOJE LISTY ODTWARZANIA.EXE
- TOMTOM_APPLICATION_FOR__ONE_XL-8.EXE
- TOMTOM_GO_720__TOMTOM_GO_920__TOMTOM_GO_520.EXE
- PBGRADE_B04617540428050.EXE
- NOKIA_UNPROCESSED_IMAGES_.EXE
- VIDEO CLIP.EXE
- BAO GIA.EXE
- MY DOCUMENT.EXE
- ORIGINALS.EXE
- BACKGROUND.EXE
- PROGRAMS.EXE
- OUTPUT.EXE
- JASON.EXE
- NOEL CARS.EXE
- J & E LEMMER.EXE
- FR.EXE
- GR.EXE
- JP.EXE
- RO.EXE
- AI.EXE
- BP.EXE
- F43.EXE
- F39.EXE
- F41.EXE
- F20.EXE
- F42.EXE
- F40.EXE
- F18.EXE
- F19.EXE
- F17.EXE
- F37.EXE
- F38.EXE
- F36.EXE
- F16.EXE
- F15.EXE
- F14.EXE
- F12.EXE
- F13.EXE
- F11.EXE
- F10.EXE
- F31.EXE
- F32.EXE
- F33.EXE
- F34.EXE
- F06.EXE
- F07.EXE
- F08.EXE
- F09.EXE
- F30.EXE
- F00.EXE
- F01.EXE
- F02.EXE
- F50.EXE
- F47.EXE
- F48.EXE
- F23.EXE
- F24.EXE
- F49.EXE
- F35.EXE
- F44.EXE
- F45.EXE
- F46.EXE
- F21.EXE
- F22.EXE
- F25.EXE
- F26.EXE
- F03.EXE
- F27.EXE
- F04.EXE
- F05.EXE
Filesizes
The following file size has been seen:
- 65,024 bytes
- 146,944 bytes
- 45,456 bytes
- 260,096 bytes
- 42,713 bytes
- 45,302 bytes
- 223,490 bytes
- 638,976 bytes
File Type
The filename SYSTEM'S SETTING.SCR refers to many versions of an executable program.
Help the Webroot Community to fight cyber crime
We are always looking for ways to improve the quality and speed of research to help us protect you from malicious software and cyber crime.
PCMag.com Editors' Choice Award Logo is a trademark of Ziff Davis Publishing Holdings Inc. Used under license.