Prevx Research Division
_QBOTINJ.EXE
System Back DoorYour PC is infected. The file called _QBOTINJ.EXE is considered unsafe and there may be other infections on your PC.
You should urgently check your PC and remove any malicious software including _QBOTINJ.EXE as soon as possible. The free version of Prevx will scan your PC for millions of spyware and malware infections in less than 2 minutes. Don't put your confidential data, or your identity at risk, check your PC now with Prevx.
Associated Malware Groups
The filename is associated with the malware groups:
- System Back Door
- Cloaked Malware
File Behavior
_QBOTINJ.EXE has been seen to perform the following behavior:
- The Process is packed and/or encrypted using a software packing process
- Writes to another Process's Virtual Memory (Process Hijacking)
- Terminates Processes
- Executes a Process
- This Process Deletes Other Processes From Disk
- This process creates other processes on disk
- Registers a Dynamic Link Library File
_QBOTINJ.EXE has been the subject of the following behavior:
- Executed as a Process
- Added as a Registry auto start to load Program on Boot up
- Created as a process on disk
- Terminated as a Process
- Has code inserted into its Virtual Memory space by other programs
- Deleted as a process from disk
Country Of Origin
The filename _QBOTINJ.EXE was first seen on Aug 22 2007 in the following geographical regions of the Prevx community:
- on Aug 22 2007
- Germany on Aug 22 2007
- Uruguay on Sep 23 2007
- Mexico on Nov 5 2009
- South Africa on Nov 2 2010
Filesizes
The following file size has been seen:
- 10,752 bytes
- 57,856 bytes
- 138,752 bytes
- 8,192 bytes
Vendor, Product and Version Information
Files with the name _QBOTINJ.EXE have been seen to have the following Vendor, Product and Version Information in the file header:
- Tkl8AJnjdvAx; 4YUrePVAcE2; VqJqd6RK6SymN
- ; (C) 32; 81.7.11
File Type
The filename _QBOTINJ.EXE refers to many versions of an executable program.