Prevx Research Division
DIFXINSTALL32.EXE
WormThe most common objects with the name of DIFXINSTALL32.EXE are considered safe.
You can use our free Prevx Scanner to thoroughly check your PC for spyware and other infections. It is free and takes less than 2 minutes to run. To start the scan just click the blue button.
Associated Malware Groups
The unsafe files using this name are associated with the malware group:
- Worm
File Behavior
DIFXINSTALL32.EXE has been seen to perform the following behavior:
- Executes a Process
- Registers a Dynamic Link Library File
DIFXINSTALL32.EXE has been the subject of the following behavior:
- Executed as a Process
- Created as a process on disk
Country Of Origin
The filename DIFXINSTALL32.EXE was first seen on Dec 22 2008 in the following geographical regions of the Prevx community:
- Spain on Dec 22 2008
- Russian Federation on Nov 21 2009
- Romania on Nov 21 2009
- Turkey on May 16 2012
File Name Aliases
DIFXINSTALL32.EXE can also use the following file names:
- 71340427.SVD
- 34766405.SVD
- 33387102.EXE
Filesizes
The following file size has been seen:
- 211,159 bytes
- 144,744 bytes
- 136,552 bytes
- 116,584 bytes
Vendor, Product and Version Information
Files with the name DIFXINSTALL32.EXE have been seen to have the following Vendor, Product and Version Information in the file header:
- GEAR Software, Inc.; 32bit DIFx Driver Installer; 1.1.0.1
- GEAR Software, Inc.; VeriSign Class 3 Code Signing 2004 CA;
- GEAR Software, Inc.; 32bit DIFx Driver Installer; 2.0.0.9
File Type
The filename DIFXINSTALL32.EXE is used by multiple object types including objects,executable programs.
File Activity
One or more files with the name DIFXINSTALL32.EXE creates, deletes, copies or moves the following files and folders:
- Deletes d:\autorun.in
- Moves d:\1.taz to d:\autorun.in
- Deletes c:\autorun.in
- Moves c:\1.taz to c:\autorun.in
- Deletes c:\documents and settings\user\local settings\application data\microsoft\cd burning\autorun.in
- Deletes c:\documents and settings\user\local settings\application data\microsoft\cd burning\zPharaoh.ex
Registry Activity
One or more files with the name DIFXINSTALL32.EXE creates or modifies the following registry keys and values:
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced Hidden value:
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced HideFileExt value:
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced ShowSuperHidden value: