Associated Malware Groups
The filename is associated with the malware groups:
File Behavior
IAINSTALL.EXE has been seen to perform the following behavior:
- The Process is packed and/or encrypted using a software packing process
- Adds a Registry Key (RUNONCE) to auto start Programs on system start up
- Can communicate with other computer systems using HTTP protocols
- Writes to another Process's Virtual Memory (Process Hijacking)
- Executes a Process
- This process creates other processes on disk
- Creates system tray popups, messages, errors and security warnings
- Visits web sites on your PC without you knowing
IAINSTALL.EXE has been the subject of the following behavior:
- Created as a process on disk
- Deleted as a process from disk
- Executed as a Process
- Has code inserted into its Virtual Memory space by other programs
- Added as a Registry Key (RUNONCE) to auto start Programs on system start up
Country Of Origin
The filename IAINSTALL.EXE was first seen on Aug 12 2008 in the following geographical regions of the Prevx community:
- SPAIN on Aug 12 2008
- NETHERLANDS on Aug 12 2008
- URUGUAY on Aug 30 2008
- HONG KONG on Sep 14 2008
- The EUROPEAN UNION on Nov 12 2008
File Name Aliases
IAINSTALL.EXE can also use the following file names:
- IAINSTALL[1].EXE
- 13572093.EXE
- 55287757.EXE
- 68319709.EXE
- PS7DY_KX.EXE.PART
- 82012743.SVD
- IAINSTALL[n].EXE
- G9JNOXBK.EXE
- 88745862.EXE
- 89021789.EXE
- 66769221.EXE
- DEVICE
- 55931649.SVD
- 85317647.EXE
- 38307598.EXE
- 16069412.EXE
- 69529351.EXE
- 63990648.EXE
- 22775679.EXE
- 30404643.EXE
- IAINSTALL[2].EXE
- 74285472.SVD
- INTE0006.EXE
- 87125942.EXE
- 72416154.DAT
Filesizes
The following file size has been seen:
- 40,960 bytes
- 50,176 bytes
- 41,984 bytes
- 41,472 bytes
- 39,424 bytes
File Type
The filename IAINSTALL.EXE refers to many versions of an executable program.
File Activity
One or more files with the name IAINSTALL.EXE creates, deletes, copies or moves the following files and folders:
- create folder c:\program files\Common Files
- Opens/modifes c:\autoexec.bat
- Creates c:\program files\common files\InternetAntivirus.exe
- Creates c:\docume~1\user\locals~1\temp\is-ks993.tmp\is-L6FFN.tmp
- Deletes c:\docume~1\user\locals~1\temp\is-ks993.tmp\is-L6FFN.tmp
- create folder c:\program files\Internet Antivirus
- create folder c:\program files\Internet Antivirus\db
- create folder c:\program files\Internet Antivirus\Languages
- Creates c:\docume~1\user\locals~1\temp\is-m801n.tmp\_isetup\_RegDLL.tmp
- Creates c:\docume~1\user\locals~1\temp\is-m801n.tmp\_isetup\_shfoldr.dll
- Creates c:\program files\internet antivirus\unins000.dat
- Creates c:\program files\internet antivirus\is-SAASI.tmp
- Moves c:\program files\internet antivirus\is-SAASI.tmp to c:\program files\internet antivirus\unins000.exe
- Creates c:\program files\internet antivirus\is-EJFQU.tmp
- Moves c:\program files\internet antivirus\is-EJFQU.tmp to c:\program files\internet antivirus\activate.ico
- Creates c:\program files\internet antivirus\is-OKQC5.tmp
- Moves c:\program files\internet antivirus\is-OKQC5.tmp to c:\program files\internet antivirus\Explorer.ico
- Creates c:\program files\internet antivirus\is-IUG0E.tmp
- Moves c:\program files\internet antivirus\is-IUG0E.tmp to c:\program files\internet antivirus\IAUpdater.exe
- Creates c:\program files\internet antivirus\is-248T6.tmp
- Moves c:\program files\internet antivirus\is-248T6.tmp to c:\program files\internet antivirus\IAvir.exe
- Creates c:\program files\internet antivirus\is-0BD13.tmp
- Moves c:\program files\internet antivirus\is-0BD13.tmp to c:\program files\internet antivirus\uninstall.ico
- Creates c:\program files\internet antivirus\db\is-IUFPR.tmp
- Moves c:\program files\internet antivirus\db\is-IUFPR.tmp to c:\program files\internet antivirus\db\DBInfo.ver
- Creates c:\program files\internet antivirus\db\is-0OCFU.tmp
- Moves c:\program files\internet antivirus\db\is-0OCFU.tmp to c:\program files\internet antivirus\db\ia080614.db
- Creates c:\program files\internet antivirus\db\is-70E1K.tmp
- Moves c:\program files\internet antivirus\db\is-70E1K.tmp to c:\program files\internet antivirus\db\ia080618x.db
- Creates c:\program files\internet antivirus\languages\is-LKOAC.tmp
- Moves c:\program files\internet antivirus\languages\is-LKOAC.tmp to c:\program files\internet antivirus\languages\IAGer.lng
- Deletes c:\documents and settings\all users\desktop\Internet Antivirus.lnk
- Deletes c:\documents and settings\all users\desktop\Internet Antivirus.pif
- Deletes c:\documents and settings\all users\desktop\Internet Antivirus.url
- Creates c:\documents and settings\all users\desktop\Internet Antivirus.lnk
- Deletes c:\documents and settings\all users\start menu\programs\internet antivirus\Purchase License.lnk
- Deletes c:\documents and settings\all users\start menu\programs\internet antivirus\Purchase License.pif
- Deletes c:\documents and settings\all users\start menu\programs\internet antivirus\Purchase License.url
- Creates c:\documents and settings\all users\start menu\programs\internet antivirus\Purchase License.lnk
- Deletes c:\documents and settings\all users\start menu\programs\internet antivirus\Internet Antivirus.lnk
- Deletes c:\documents and settings\all users\start menu\programs\internet antivirus\Internet Antivirus.pif
- Deletes c:\documents and settings\all users\start menu\programs\internet antivirus\Internet Antivirus.url
- Creates c:\documents and settings\all users\start menu\programs\internet antivirus\Internet Antivirus.lnk
- Deletes c:\documents and settings\all users\start menu\programs\internet antivirus\Internet Antivirus Home Page.lnk
- Deletes c:\documents and settings\all users\start menu\programs\internet antivirus\Internet Antivirus Home Page.pif
- Deletes c:\documents and settings\all users\start menu\programs\internet antivirus\Internet Antivirus Home Page.url
- Creates c:\documents and settings\all users\start menu\programs\internet antivirus\Internet Antivirus Home Page.lnk
- Deletes c:\documents and settings\all users\start menu\programs\internet antivirus\Uninstall Internet Antivirus.lnk
- Deletes c:\documents and settings\all users\start menu\programs\internet antivirus\Uninstall Internet Antivirus.pif
- Deletes c:\documents and settings\all users\start menu\programs\internet antivirus\Uninstall Internet Antivirus.url
Website Activity
One or more files with the name IAINSTALL.EXE interacts with the following web sites and pages. Web addresses have been deliberately modified to prevent unintentional use.
- ia-install .com / download / InternetAntivirus .exe
- Remote server connection to ia-install .co
- Remote server connection to scan-ia .co
- Port 80 IP:216.32.69.162
- Port 80 IP:216.32.69.165
- Port 80 IP:195.64.164.87
- Port 80 IP:213.186.33.4
PCMag.com Editors' Choice Award Logo is a trademark of Ziff Davis Publishing Holdings Inc. Used under license.