File Investigation Report
ADSPIDER_INST.EXE
Malicious SoftwareYour PC may be infected. The presence of a file called ADSPIDER_INST.EXE is a possible sign of infection.
You should urgently check your PC to make sure it is not infected. The free version of Prevx will scan your PC in less than two minutes and check for millions of spyware and malware infections including ADSPIDER_INST.EXE. Don't put your confidential data, or your identity at risk, check your PC now with Prevx.
File Behavior
ADSPIDER_INST.EXE has been seen to perform the following behavior:
- This Process Deletes Other Processes From Disk
- Can communicate with other computer systems using HTTP protocols
- Executes a Process
- This process creates other processes on disk
- Downloads hidden code from covert web sites
- Looks at the contents of the autoexec.bat file
- Reads email address and phone book details
- This Process Contains User Mode Rootkit Functionality and can hide itself from the running process list
- Adds a Registry Key (RUN) to auto start Programs on system start up
- Adds a Winlogon Notification DLL to automatically load on system start up
ADSPIDER_INST.EXE has been the subject of the following behavior:
- Executed as a Process
- Created as a process on disk
Country Of Origin
The filename ADSPIDER_INST.EXE was first seen on Apr 8 2008 in the following geographical regions of the Prevx community:
- Cambodia on Apr 8 2008
- Korea, Republic of on Apr 8 2008
- Spain on Dec 13 2008
Filesizes
Files using the name ADSPIDER_INST.EXE have been seen with the following file size:
- 577,536 bytes
Vendor, Product and Version Information
Files with the name ADSPIDER_INST.EXE have been seen to have the following Vendor, Product and Version Information in the file header:
- 디지탈온넷; AD-Spider 2008 Web Download / Online Installer; 1, 0, 0, 1
- ëì§íì¨ë·; AD-Spider 2008 Web Download / Online Installer; 1, 0, 0, 1
- 9494eca780ed8388ec98a8eb84b7Q8; AD-Spider 2008 Web Download / Online Installer; 1, 0, 0, 1
File Type
The filename ADSPIDER_INST.EXE refers to many versions of an executable program.
File Activity
One or more files with the name ADSPIDER_INST.EXE creates, deletes, copies or moves the following files and folders:
- Opens/modifes c:\autoexec.bat
Website Activity
One or more files with the name ADSPIDER_INST.EXE interacts with the following web sites and pages. Web addresses have been deliberately modified to prevent unintentional use.
- TCP:127.0.0.1:1083 Port:18
- Port 80 IP:218.150.162.238
- Port 80 IP:121.88.251.40