Prevx Research Division
DESKTOP.EXE
Cloaked MalwareFree PC Cleanup from Webroot
Use Webroot SecureAnywhere to remove DESKTOP.EXE.
"Just when you thought it couldn't get any better or faster. The Webroot scanning engine is 'high octane' with a hidden nitrous oxide system. Bravo!!!" W. Lodzinski, SecureAnywhere User
Associated Malware Groups
The unsafe files using this name are associated with the malware groups:
- Cloaked Malware
- Malicious Software
- Worm
File Behavior
DESKTOP.EXE has been seen to perform the following behavior:
- The Process is packed and/or encrypted using a software packing process
- This process creates other processes on disk
- This Process Contains User Mode Rootkit Functionality and can hide itself from the running process list
- Found on infected systems and resists interrogation by security products
- Writes to another Process's Virtual Memory (Process Hijacking)
- This Process Deletes Other Processes From Disk
- Executes a Process
- Registers a Dynamic Link Library File
- Copies files
- Adds a Registry Key (RUN) to auto start Programs on system start up
- Injects code into other processes
- Performs DNS look ups to resolve URL IP addresses
DESKTOP.EXE has been the subject of the following behavior:
- Added as a Registry auto start to load Program on Boot up
- Created as a process on disk
- Deleted as a process from disk
- Executed as a Process
- Has code inserted into its Virtual Memory space by other programs
- Terminated as a Process
- Registered as a Dynamic Link Library File
- Copied to multiple locations on the system
Country Of Origin
The filename DESKTOP.EXE was first seen on May 8 2007 in the following geographical regions of the Webroot community:
- on May 8 2007
- Spain on May 8 2007
- Egypt on Mar 26 2010
- Saudi Arabia on Mar 26 2010
- Brazil on Apr 14 2010
- The United Kingdom on Apr 14 2010
- Italy on May 29 2010
- South Africa on May 25 2012
File Name Aliases
DESKTOP.EXE can also use the following file names:
- YESBRON.COM
- TMMU884E.SCR
- TMMU884D.SCR
- JULY-DEC ASIA AUTHORIZATION (n).EXE
- FEE BREAKUP.EXE
- SECURITY CERTIFICATES.EXE
- PAYMENT HEATERS.EXE
- PICTURE.EXE
- EAMONN F10.EXE
- BLANK INVOICE.EXE
- SALARY SLIP 3.EXE
- RAMITA CV.EXE
- IQRA.EXE
- MVC-018F.EXE
- ADNAN SICK.EXE
- INVOICE.EXE
- OVERTIME CLAIM FORM.EXE
- CDI_IMAG.EXE
- RAMITA PICTURE.EXE
- RATE FOR TRANSLATOR.EXE
- TMKP5FF0.SCR
- WINZIP_TMP.EXE
- SCANREGW.EXE
- WINZIP QUICK PICK.EXE
- EVENT2.EXE
- RADIOSBIS.EXE
- BOOT (n).EXE
- RUNDLL16.EXE
- UPDATE.EXE
- WINZIP.EXE
- KUSUMGAR/ASR.EXE
- KUSUMGAR/MOONSHINE.EXE
- KUSUMGAR/NEW_SPARE_PARTS_PRICE__LIST_ON_2009.EXE
- KUSUMGAR/SETUPXLG.EXE
- LIBROS (n).EXE
- LOGOGRC.EXE
- INSTRUCTIVO OBSERVACIONES.EXE
- ALEJANDRA (n).EXE
- ANIMALES VERTEBRADOS E INVERTEBRADOS.EXE
- PRIMERA COMUNIÓN DE DIANA.EXE
- BOOK1.EXE
- SCRAP.EXE
- ACUMULADO ABRIL.EXE
- COMPONENTE 10 Y 11.EXE
- DOCUMENTO RECUPERADO.EXE
- LOGO2.EXE
- RP505ESP.EXE
- FORMATO FACTURAS.EXE
- ALEXANDR PUSHKIN - EL FABRICANTE DE ATAúDES.EXE
- DISCO EXTRAíBLE (F) (n).EXE
- SíMBOLOS PATRIOS.EXE
- ARRENDADOS.EXE
- TEMP.EXE
- DENUNCIA_CTROL_ALMACENES.EXE
- DIAS.EXE
- SANDYS.EXE
- JUSTDRIVE2.EXE
- MUYSENSUAL (n).EXE
- INCIDENCIAS NUEVA (n).EXE
- HALLAZGOS 3A.EXE
- COPIA DE AVANCE DE TRABAJOS AUDITORIA (n).EXE
- MIS IMáGENES (n).EXE
- INCIDENCIAS NUEVA.EXE
- TAREA SONIA.EXE
- COPIA DE AVANCE DE TRABAJOS AUDITORIA.EXE
- MARISSA MILLER.EXE
- SUEÑOSHUM[n].EXE
- SYSTEM.EXE
- PALAFOX1.EXE
- NORMAS GENERALES DEL AUDITOR.EXE
- OFICIO_SOLICIT_CERTIF.EXE
- TSVCHOST.EXE
- PROGRAM FILES.EXE
- HINHEM.SCR
- SCVHOSTS.EXE
- BLASTCLNNN.EXE
- RECYCLER.EXE
- SYSTEM32.EXE
- WBEM.EXE
- CONTENT.IE5.EXE
- DRIVERS.EXE
- APPLICATION DATA.EXE
- CHE7KLUV.EXE
- W1MB4T2N.EXE
- ZX9PEEUL.EXE
- ADMINISTRATOR.EXE
- TEMPORARY INTERNET FILES.EXE
- WINDOWS.EXE
- COMMON FILES.EXE
- RAGNAROKONLINE.EXE
- NEW FOLDER.EXE
- SUPER DANCER.EXE
- RETROSPECT CCE9.EXE
- CABAL ONLINE.EXE
- SPECIAL FORCE.EXE
- GAMEGUARD.EXE
- AFRICA.EXE
- AMERICA.EXE
- ARGENTINA.EXE
- INDIANA.EXE
- BACKGROUNDS.EXE
- SHARING FOLDERS.EXE
- WINKS3.EXE
- FLVPLAYER.EXE
- DYNAMICBACKGROUNDS.EXE
- SHADOW.EXE
- WWW.LIVEVIDEO.COM.EXE
- USERTILE.EXE
- REAL.EXE
- OBJECTSTORE.EXE
- SHARINGMETADATA.EXE
- CAMFROG.EXE
- YAHOO! COMPANION.EXE
- DATA.EXE
- DEFAULT.EXE
- DOWNLOAD.EXE
- ICONS.EXE
- MEDIA.EXE
- MODULES.EXE
- UPDATEPATCH.EXE
- INSTALLS.EXE
- MSHIST012009030720090308.EXE
- MINIDUMP.EXE
- CDN.WIDGETSERVER.COM.EXE
- PUB.WIDGETBOX.COM.EXE
- DATABASE_5CAC_2122_AC20_F7E2.EXE
- QUARTZ.EXE
- CONFIG.EXE
- LISTENERS.EXE
- GRAILS-APP.EXE
- VIEWS.EXE
- LAYOUTS.EXE
- PRAMOOL.EXE
- LIB.EXE
- PLUGINS.EXE
- QUARTZ-0.4.1-SNAPSHOT.EXE
- JOBMANAGER.EXE
- SPRING.EXE
- TEMPLATES.EXE
- SCAFFOLDING.EXE
- TLD.EXE
- JETTY_0_0_0_0_8080_MINER.CLIENT.WAR__MINER.CLIENT__CBZMXT_3081718569147724030.EXE
- ANIMATIONS.EXE
- COOKIES.EXE
- FOLDERS.EXE
- MENU.EXE
- IMAGES.EXE
- WINDOWS LIVE ONECARE SAFETY SCANNER.EXE
- SQM.EXE
- MOF.EXE
- CUSTOM.EXE
- SKIN.EXE
- LADS.MYSPACE.COM.EXE
- VIDEOS.EXE
- CACHE.EXE
- THUMBNAILS.EXE
- MAIN.SWF.EXE
- MUSIC.EXE
- STARTUP.EXE
- A07 ACTA.EXE
- ACTA HAND HELD.EXE
- BABYBODYUSEFORDRUGTRAFFIKINGSOOOSAD!1.EXE
- CERTIFICACION.EXE
- CLASIFICADOR POR OBJETO DEL GASTO 2007 (n).EXE
- JETTY_0_0_0_0_8080_MINER.CLIENT.WAR__MINER.CLIENT__CBZMXT.EXE
- HOST.EXE
- PCSX2-FORM ON COM30.EXE
- ZH59550884Y.EXE
- SUN.EXE
- THE KMPLAYER.EXE
- FLVPLAYER.SWF.EXE
- J.EXE
- A.EXE
- I18N.EXE
- O462227.EXE
- _DEFAULT6222.PIF
- #WWW.LIVEVIDEO.COM.EXE
- DM 220.EXE
- J662222.EXE
- C_6222K.COM
- DC3.EXE
- #LADS.MYSPACE.COM.EXE
- 50431771.EXE
Filesizes
The following file size has been seen:
- 3,292,672 bytes
- 47,104 bytes
- 95,690 bytes
- 106,496 bytes
- 12,424,192 bytes
- 466,432 bytes
- 349,097 bytes
- 69,120 bytes
File Type
The filename DESKTOP.EXE is used by multiple object types including executable programs,objects.
Help the Webroot Community to fight cyber crime
We are always looking for ways to improve the quality and speed of research to help us protect you from malicious software and cyber crime.
PCMag.com Editors' Choice Award Logo is a trademark of Ziff Davis Publishing Holdings Inc. Used under license.