Prevx Research Division
WLSETUP-WEB.EXE
Malicious SoftwareYour PC is infected. The file called WLSETUP-WEB.EXE is considered unsafe and there may be other infections on your PC.
You should urgently check your PC and remove any malicious software including WLSETUP-WEB.EXE as soon as possible. The free version of Prevx will scan your PC for millions of spyware and malware infections in less than 2 minutes. Don't put your confidential data, or your identity at risk, check your PC now with Prevx.
Associated Malware Groups
The filename is associated with the malware groups:
- Malicious Software
- Virus
File Behavior
WLSETUP-WEB.EXE has been seen to perform the following behavior:
- Can communicate with other computer systems using HTTP protocols
- This Process Deletes Other Processes From Disk
- This process creates other processes on disk
- Writes to another Process's Virtual Memory (Process Hijacking)
- Executes a Process
- Creates system tray popups, messages, errors and security warnings
- Uses DNS to retrieve the IP address for web sites
WLSETUP-WEB.EXE has been the subject of the following behavior:
- Created as a process on disk
- Executed by Internet Explorer
- Has code inserted into its Virtual Memory space by other programs
- Executed as a Process
- Deleted as a process from disk
- Terminated as a Process
Country Of Origin
The filename WLSETUP-WEB.EXE was first seen on Sep 17 2008 in the following geographical regions of the Prevx community:
- France on Sep 17 2008
- Luxembourg on Sep 17 2008
- Netherlands on Sep 18 2008
- South Africa on Nov 10 2010
- Turkey on May 21 2013
File Name Aliases
WLSETUP-WEB.EXE can also use the following file names:
- WLSETUP-WEB (1).EXE
- WLSETUP-WEB[n].EXE
- WLSETUP-WEB(n).EXE
- WLSETUP-WEB(2)-144.EXE
- WINDOWS-LIVE-MESSENGER_WLM_BETA_9_14.0.5027.908_FRANCAIS_19367[n].EXE
- WINDOWS-LIVE-MESSENGER_WLM_BETA_9_14.0.5027.908_FRANCAIS_19367.EXE
- WLSETUP-WEB(2)-144[n].EXE
- DXMASF.DLL
- MSDXM.OCX
- 0001000D.DIR
Filesizes
The following file size has been seen:
- 1,247,740 bytes
- 1,027,584 bytes
- 1,031,680 bytes
- 4,096 bytes
- 711 bytes
Vendor, Product and Version Information
Files with the name WLSETUP-WEB.EXE have been seen to have the following Vendor, Product and Version Information in the file header:
- Microsoft Corporation; Windows Temel Parçalar Yükleyicisi; 16.4.3505.0912
- Microsoft Corporation; Microsoft Code Signing PCA;
- Microsoft Corporation; Windows Live Installer; 14.0.5025.0904
File Type
The filename WLSETUP-WEB.EXE refers to many versions of an executable program.
File Activity
One or more files with the name WLSETUP-WEB.EXE creates, deletes, copies or moves the following files and folders:
- Creates c:\documents and settings\all users\application data\microsoft\wlsetup\logs\2008-09-20_22-26_91c-zsqcka4t.log
- Opens/modifes c:\autoexec.bat
- Creates c:\documents and settings\user\application data\microsoft\cryptneturlcache\metadata\3130B1871A126520A8C47861EFE3ED4D
- Creates c:\documents and settings\user\application data\microsoft\cryptneturlcache\content\3130B1871A126520A8C47861EFE3ED4D
- Creates c:\docume~1\user\locals~1\temp\{87bb8892-00f3-47e6-8145-11c6538c5b2e}\wls1.tmp
Network Activity
One or more files with the name WLSETUP-WEB.EXE performs the following network events:
- DNS Lookup wpad.
Website Activity
One or more files with the name WLSETUP-WEB.EXE interacts with the following web sites and pages. Web addresses have been deliberately modified to prevent unintentional use.
- TCP:127.0.0.1:1096 Port:24
- Port 80 IP:131.107.115.28
- Port 80 IP:207.68.179.201
- Port 80 IP:87.248.210.211