Prevx Research Division
SYSTEM_32.EXE
Cloaked MalwareYour PC is infected. The file called SYSTEM_32.EXE is considered unsafe and there may be other infections on your PC.
You should urgently check your PC and remove any malicious software including SYSTEM_32.EXE as soon as possible. The free version of Prevx will scan your PC for millions of spyware and malware infections in less than 2 minutes. Don't put your confidential data, or your identity at risk, check your PC now with Prevx.
Associated Malware Groups
The filename is associated with the malware groups:
- Cloaked Malware
- Worm
- Malicious Software
File Behavior
SYSTEM_32.EXE has been seen to perform the following behavior:
- The Process is packed and/or encrypted using a software packing process
- This Process Contains User Mode Rootkit Functionality and can hide itself from the running process list
- Writes to another Process's Virtual Memory (Process Hijacking)
- Can communicate with other computer systems using HTTP protocols
- Executes a Process
- Injects code into other processes
- Performs DNS look ups to resolve URL IP addresses
SYSTEM_32.EXE has been the subject of the following behavior:
- Added as a Registry auto start to load Program on Boot up
- Copied to multiple locations on the system
- Registered as a Dynamic Link Library File
- Executed as a Process
- Deleted as a process from disk
- Created as a process on disk
- Has code inserted into its Virtual Memory space by other programs
- Terminated as a Process
Country Of Origin
The filename SYSTEM_32.EXE was first seen on Apr 6 2008 in the following geographical regions of the Prevx community:
- Greece on Apr 6 2008
- Iran, Islamic Republic of on Jan 30 2009
- Spain on Jan 30 2009
- Peru on Jan 22 2010
- The United States on Jan 22 2010
- The United Kingdom on Aug 23 2010
File Name Aliases
SYSTEM_32.EXE can also use the following file names:
- SYSTEM_32.EXE
- DC16.EXE
- 06714093.SVD
- 33797805.SVD
- 32050141.SVD
Filesizes
The following file size has been seen:
- 32,768 bytes
- 76,278 bytes
- 14,832 bytes
- 508,942 bytes
- 36,864 bytes
- 53,248 bytes
Vendor, Product and Version Information
Files with the name SYSTEM_32.EXE have been seen to have the following Vendor, Product and Version Information in the file header:
- ; ; 1.00
- PRIVADA; ; 1.00
- vgrN0E; vh7XRybkk; 6.38.0081
File Type
The filename SYSTEM_32.EXE refers to many versions of an executable program.
File Activity
One or more files with the name SYSTEM_32.EXE creates, deletes, copies or moves the following files and folders:
- Copies filec:\8937262.exe to c:\windows\system32\Tapi32init.exe
- Copies filec:\windows\system32\Tapi32init.exe to c:\windows\SYSTEM_32.EXE
- Deletes c:\8937262.ex
Registry Activity
One or more files with the name SYSTEM_32.EXE creates or modifies the following registry keys and values:
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System DisableTaskMgr value:
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System DisableRegistryTools value: