Associated Malware Groups
The unsafe files using this name are associated with the malware group:
File Behavior
VIWC.EXE has been seen to perform the following behavior:
- Executes a Process
- This process creates other processes on disk
- This Process Deletes Other Processes From Disk
- Makes outbound connections to other computers using NETBIOSOUT protocols
- Adds a Registry Key (RUNONCE) to auto start Programs on system start up
- Modifies the Windows Built in Screen Saver
- Disables the built in Windows File Protection System
- The Process is packed and/or encrypted using a software packing process
- Changes the Internet Explorer Home Page Settings
- Registers a Dynamic Link Library File
- Terminates Processes
- Adds a Registry Key (RUN) to auto start Programs on system start up
- Found on infected systems and resists interrogation by security products
- Modifies the Logon Screen Saver Settings
- Disables Access to the Task Manager built into Windows
- Disables Access to the Windows Registry Editior
- Modifies Windows Security Policies to restrict/expand User Privileges on the machine
- Disables the Notification Balloon for the Windows Security Center
- Automatically changes your firewall settings to allow itself or other programs to communicate over the internet
- Adds products to the system registry
- Writes to another Process's Virtual Memory (Process Hijacking)
- Can communicate with other computer systems using HTTP protocols
- Executes Processes stored in Temporary Folders
VIWC.EXE has been the subject of the following behavior:
- Added as a Registry auto start to load Program on Boot up
- Executed as a Process
- Terminated as a Process
- Created as a process on disk
- Deleted as a process from disk
- Has code inserted into its Virtual Memory space by other programs
- Copied to multiple locations on the system
Country Of Origin
The filename VIWC.EXE was first seen on Nov 29 2007 in the following geographical regions of the Prevx community:
- The EUROPEAN UNION on Nov 29 2007
- VIET NAM on Nov 29 2007
- NETHERLANDS on Oct 19 2008
- SPAIN on Oct 19 2008
- ROMANIA on Nov 16 2008
File Name Aliases
VIWC.EXE can also use the following file names:
- 61096229.DAT
- 36285694.SVD
- VIWC[n].EXE
- 72299488.SVD
- 48463385.SVD
- 95749176.SVD
- 63337356.DAT
- 63200579.DAT
Filesizes
The following file size has been seen:
- 334,422 bytes
- 406,853 bytes
- 416,342 bytes
- 346,071 bytes
File Type
The filename VIWC.EXE refers to many versions of an executable program.
PCMag.com Editors' Choice Award Logo is a trademark of Ziff Davis Publishing Holdings Inc. Used under license.