File Investigation Report

IAINSTALL.EXE

Worm

PC Cleanup in 3 Easy Steps

Use Prevx 3.0 to remove IAINSTALL.EXE, along with any other viruses, spyware, adware, trojans, rootkits, worms, information stealers, keyloggers, bots, and other form of malicious threat that may reside on your PC.

Remove this Infection »

PC Magazine, Editors' Choice, May 2009

Think your PC might be Infected? Scan Now Prevx 3.0 will scan your PC in seconds to inform you whether your PC is clean or infected.
Malware Removal Prevx 3.0 removes adware infections for free. More complicated infections require purchase of a malware removal license.
Expert Assistance In the rare occurence that Prevx 3.0 malware removal fails - a Prevx Engineer will connect to your PC and manually disinfect.
Money Back Guarantee for Individual Users If within the first 14 days, the Prevx Engineer finds it impossible to clean an infection from your PC, we give you your money back.

Associated Malware Groups

The filename is associated with the malware groups:

Worm
Cloaked Malware

File Behavior

IAINSTALL.EXE has been seen to perform the following behavior:

The Process is packed and/or encrypted using a software packing process
Adds a Registry Key (RUNONCE) to auto start Programs on system start up
Can communicate with other computer systems using HTTP protocols
Writes to another Process's Virtual Memory (Process Hijacking)
Executes a Process
This process creates other processes on disk
Creates system tray popups, messages, errors and security warnings
Visits web sites on your PC without you knowing

IAINSTALL.EXE has been the subject of the following behavior:

Created as a process on disk
Deleted as a process from disk
Executed as a Process
Has code inserted into its Virtual Memory space by other programs
Added as a Registry Key (RUNONCE) to auto start Programs on system start up

Country Of Origin

The filename IAINSTALL.EXE was first seen on Aug 12 2008 in the following geographical regions of the Prevx community:

SPAIN on Aug 12 2008
NETHERLANDS on Aug 12 2008
URUGUAY on Aug 30 2008
HONG KONG on Sep 14 2008
The EUROPEAN UNION on Nov 12 2008

File Name Aliases

IAINSTALL.EXE can also use the following file names:

IAINSTALL[1].EXE
13572093.EXE
55287757.EXE
68319709.EXE
PS7DY_KX.EXE.PART
82012743.SVD
IAINSTALL[n].EXE
G9JNOXBK.EXE
88745862.EXE
89021789.EXE
66769221.EXE
DEVICE
55931649.SVD
85317647.EXE
38307598.EXE
16069412.EXE
69529351.EXE
63990648.EXE
22775679.EXE
30404643.EXE
IAINSTALL[2].EXE
74285472.SVD
INTE0006.EXE
87125942.EXE
72416154.DAT

Filesizes

The following file size has been seen:

40,960 bytes
50,176 bytes
41,984 bytes
41,472 bytes
39,424 bytes

File Type

The filename IAINSTALL.EXE refers to many versions of an executable program.

File Activity

One or more files with the name IAINSTALL.EXE creates, deletes, copies or moves the following files and folders:

create folder c:\program files\Common Files
Opens/modifes c:\autoexec.bat
Creates c:\program files\common files\InternetAntivirus.exe
Creates c:\docume~1\user\locals~1\temp\is-ks993.tmp\is-L6FFN.tmp
Deletes c:\docume~1\user\locals~1\temp\is-ks993.tmp\is-L6FFN.tmp
create folder c:\program files\Internet Antivirus
create folder c:\program files\Internet Antivirus\db
create folder c:\program files\Internet Antivirus\Languages
Creates c:\docume~1\user\locals~1\temp\is-m801n.tmp\_isetup\_RegDLL.tmp
Creates c:\docume~1\user\locals~1\temp\is-m801n.tmp\_isetup\_shfoldr.dll
Creates c:\program files\internet antivirus\unins000.dat
Creates c:\program files\internet antivirus\is-SAASI.tmp
Moves c:\program files\internet antivirus\is-SAASI.tmp to c:\program files\internet antivirus\unins000.exe
Creates c:\program files\internet antivirus\is-EJFQU.tmp
Moves c:\program files\internet antivirus\is-EJFQU.tmp to c:\program files\internet antivirus\activate.ico
Creates c:\program files\internet antivirus\is-OKQC5.tmp
Moves c:\program files\internet antivirus\is-OKQC5.tmp to c:\program files\internet antivirus\Explorer.ico
Creates c:\program files\internet antivirus\is-IUG0E.tmp
Moves c:\program files\internet antivirus\is-IUG0E.tmp to c:\program files\internet antivirus\IAUpdater.exe
Creates c:\program files\internet antivirus\is-248T6.tmp
Moves c:\program files\internet antivirus\is-248T6.tmp to c:\program files\internet antivirus\IAvir.exe
Creates c:\program files\internet antivirus\is-0BD13.tmp
Moves c:\program files\internet antivirus\is-0BD13.tmp to c:\program files\internet antivirus\uninstall.ico
Creates c:\program files\internet antivirus\db\is-IUFPR.tmp
Moves c:\program files\internet antivirus\db\is-IUFPR.tmp to c:\program files\internet antivirus\db\DBInfo.ver
Creates c:\program files\internet antivirus\db\is-0OCFU.tmp
Moves c:\program files\internet antivirus\db\is-0OCFU.tmp to c:\program files\internet antivirus\db\ia080614.db
Creates c:\program files\internet antivirus\db\is-70E1K.tmp
Moves c:\program files\internet antivirus\db\is-70E1K.tmp to c:\program files\internet antivirus\db\ia080618x.db
Creates c:\program files\internet antivirus\languages\is-LKOAC.tmp
Moves c:\program files\internet antivirus\languages\is-LKOAC.tmp to c:\program files\internet antivirus\languages\IAGer.lng
Deletes c:\documents and settings\all users\desktop\Internet Antivirus.lnk
Deletes c:\documents and settings\all users\desktop\Internet Antivirus.pif
Deletes c:\documents and settings\all users\desktop\Internet Antivirus.url
Creates c:\documents and settings\all users\desktop\Internet Antivirus.lnk
Deletes c:\documents and settings\all users\start menu\programs\internet antivirus\Purchase License.lnk
Deletes c:\documents and settings\all users\start menu\programs\internet antivirus\Purchase License.pif
Deletes c:\documents and settings\all users\start menu\programs\internet antivirus\Purchase License.url
Creates c:\documents and settings\all users\start menu\programs\internet antivirus\Purchase License.lnk
Deletes c:\documents and settings\all users\start menu\programs\internet antivirus\Internet Antivirus.lnk
Deletes c:\documents and settings\all users\start menu\programs\internet antivirus\Internet Antivirus.pif
Deletes c:\documents and settings\all users\start menu\programs\internet antivirus\Internet Antivirus.url
Creates c:\documents and settings\all users\start menu\programs\internet antivirus\Internet Antivirus.lnk
Deletes c:\documents and settings\all users\start menu\programs\internet antivirus\Internet Antivirus Home Page.lnk
Deletes c:\documents and settings\all users\start menu\programs\internet antivirus\Internet Antivirus Home Page.pif
Deletes c:\documents and settings\all users\start menu\programs\internet antivirus\Internet Antivirus Home Page.url
Creates c:\documents and settings\all users\start menu\programs\internet antivirus\Internet Antivirus Home Page.lnk
Deletes c:\documents and settings\all users\start menu\programs\internet antivirus\Uninstall Internet Antivirus.lnk
Deletes c:\documents and settings\all users\start menu\programs\internet antivirus\Uninstall Internet Antivirus.pif
Deletes c:\documents and settings\all users\start menu\programs\internet antivirus\Uninstall Internet Antivirus.url

Website Activity

One or more files with the name IAINSTALL.EXE interacts with the following web sites and pages. Web addresses have been deliberately modified to prevent unintentional use.

ia-install .com / download / InternetAntivirus .exe
Remote server connection to ia-install .co
Remote server connection to scan-ia .co
Port 80 IP:216.32.69.162
Port 80 IP:216.32.69.165
Port 80 IP:195.64.164.87
Port 80 IP:213.186.33.4

PCMag.com Editors' Choice Award Logo is a trademark of Ziff Davis Publishing Holdings Inc. Used under license.