Prevx Research Division
UNZIP.EXE
WormIt is possible that your PC could be infected. The file name UNZIP.EXE is used by both safe and unsafe programs.
You should urgently check your PC to make sure it is not infected. The free version of Webroot Cloud AntiVirus Beta will scan your PC in less than two minutes and check for millions of spyware and malware infections including UNZIP.EXE. Don't put your confidential data, or your identity at risk, check your PC now with Webroot Cloud AntiVirus Beta.
Associated Malware Groups
The unsafe files using this name are associated with the malware group:
- Worm
File Behavior
UNZIP.EXE has been seen to perform the following behavior:
- Executes a Process
- This process creates other processes on disk
- This Process Deletes Other Processes From Disk
- The Process is packed and/or encrypted using a software packing process
- Registers a Dynamic Link Library File
- This Process is a file infector which modifies program files to include a copy of the infection
- Includes file creation code which could be used to test for interception by security products
- The Process is polymorphic and can change its structure
UNZIP.EXE has been the subject of the following behavior:
- Created as a process on disk
- Executed as a Process
- Deleted as a process from disk
- Executed from Temporary Folders
- Has code inserted into its Virtual Memory space by other programs
- Terminated as a Process
- Created by processes which appear to be checking for interception by security products
Country Of Origin
The filename UNZIP.EXE was first seen on Jun 7 2007 in the following geographical regions of the Webroot community:
- Australia on Jun 7 2007
- The United States on Jun 7 2007
- Japan on Oct 22 2007
- New Zealand on Jan 23 2008
- Botswana on Feb 7 2008
- Spain on Jan 21 2009
- Turkey on May 25 2012
File Name Aliases
UNZIP.EXE can also use the following file names:
- PKUNZIP.EXE
- PKUNZIP0.EXE
- PKUNZIP1.EXE
- NEWUNZIP.EXE
- UNCOMPRS.EXE
- PKUNZIP2.EXE
- UNZIPDC13346D_2050_439D_A146_FADD3E20A6F3.EXE
- UNZIP[1].EXE
- UZ.EXE
Filesizes
The following file size has been seen:
- 201,884 bytes
- 29,378 bytes
- 154,112 bytes
- 29,085 bytes
- 208,896 bytes
- 233,179 bytes
- 207,472 bytes
File Type
The filename UNZIP.EXE is used by multiple object types including objects,objects,objects,executable programs.
File Activity
One or more files with the name UNZIP.EXE creates, deletes, copies or moves the following files and folders:
- create folder C:\WINDOWS\uninstall\
- Creates c:\windows\uninstall\rundl132.exe
- Creates c:\windows\Logo1_.exe
- Deletes c:\docume~1\user\locals~1\temp\$$aB.bat
- Creates c:\docume~1\user\locals~1\temp\$$aB.bat
- Creates c:\windows\RichDll.dll
- Creates c:\_desktop.ini
- Deletes c:\mbr\scan.exe
- Creates c:\mbr\scan.exe
- Moves c:\mbr\scan.exe to c:\mbr\scan.exe
- Deletes c:\program files\ati technologies\uninstallall\AtiCimUn.exe
- Creates c:\program files\ati technologies\uninstallall\AtiCimUn.exe
- Moves c:\program files\ati technologies\uninstallall\AtiCimUn.exe to c:\program files\ati technologies\uninstallall\AtiCimUn.exe
- Deletes c:\program files\intel\ncs2\wmiprov\ncs2prov.exe
- Creates c:\program files\intel\ncs2\wmiprov\ncs2prov.exe
- Moves c:\program files\intel\ncs2\wmiprov\ncs2prov.exe to c:\program files\intel\ncs2\wmiprov\ncs2prov.exe
- Deletes c:\program files\intel\ncs2\wmiprov\NCSDiag.exe
- Creates c:\program files\intel\ncs2\wmiprov\NCSDiag.exe
- Moves c:\program files\intel\ncs2\wmiprov\NCSDiag.exe to c:\program files\intel\ncs2\wmiprov\NCSDiag.exe
- Deletes c:\program files\msn\msncorefiles\install\msnsusii.exe
- Creates c:\program files\msn\msncorefiles\install\msnsusii.exe
- Moves c:\program files\msn\msncorefiles\install\msnsusii.exe to c:\program files\msn\msncorefiles\install\msnsusii.exe
- Deletes c:\program files\msn\msncorefiles\install\msn9components\Digcore.exe
- Creates c:\program files\msn\msncorefiles\install\msn9components\Digcore.exe
- Moves c:\program files\msn\msncorefiles\install\msn9components\Digcore.exe to c:\program files\msn\msncorefiles\install\msn9components\Digcore.exe
- Deletes c:\program files\msn\msncorefiles\install\msn9components\Msncli.exe
- Creates c:\program files\msn\msncorefiles\install\msn9components\Msncli.exe
- Moves c:\program files\msn\msncorefiles\install\msn9components\Msncli.exe to c:\program files\msn\msncorefiles\install\msn9components\Msncli.exe
- Deletes c:\program files\realtek\installshield\ChCfg.exe
- Creates c:\program files\realtek\installshield\ChCfg.exe
- Moves c:\program files\realtek\installshield\ChCfg.exe to c:\program files\realtek\installshield\ChCfg.exe
- Deletes c:\program files\realtek\installshield\RtlUpd.exe
- Creates c:\program files\realtek\installshield\RtlUpd.exe
- Moves c:\program files\realtek\installshield\RtlUpd.exe to c:\program files\realtek\installshield\RtlUpd.exe
- Deletes c:\program files\realtek\installshield\RtlUpd64.exe
- Creates c:\program files\realtek\installshield\RtlUpd64.exe
- Moves c:\program files\realtek\installshield\RtlUpd64.exe to c:\program files\realtek\installshield\RtlUpd64.exe
- Deletes c:\program files\windows live\installer\Dashboard.exe
- Creates c:\program files\windows live\installer\Dashboard.exe
- Moves c:\program files\windows live\installer\Dashboard.exe to c:\program files\windows live\installer\Dashboard.exe
- Deletes c:\program files\windows live\installer\WLSetupSvc.exe
- Creates c:\program files\windows live\installer\WLSetupSvc.exe
- Moves c:\program files\windows live\installer\WLSetupSvc.exe to c:\program files\windows live\installer\WLSetupSvc.exe
- Deletes c:\program files\winpcap\rpcapd.exe
- Creates c:\program files\winpcap\rpcapd.exe
- Moves c:\program files\winpcap\rpcapd.exe to c:\program files\winpcap\rpcapd.exe
- Deletes c:\program files\winpcap\Uninstall.exe
- Creates c:\program files\winpcap\Uninstall.exe
- Moves c:\program files\winpcap\Uninstall.exe to c:\program files\winpcap\Uninstall.exe
- Creates c:\docume~1\user\locals~1\temp\60c3_appcompat.txt
Help the Webroot Community to fight cyber crime
We are always looking for ways to improve the quality and speed of research to help us protect you from malicious software and cyber crime.
PCMag.com Editors' Choice Award Logo is a trademark of Ziff Davis Publishing Holdings Inc. Used under license.