SC.INS
Malware DownloaderYour PC is infected. The file called SC.INS is considered unsafe and there may be other infections on your PC.
You should urgently check your PC and remove any malicious software including SC.INS as soon as possible. The free version of Prevx 3.0 will scan your PC for millions of spyware and malware infections in less than 2 minutes. Don't put your confidential data, or your identity at risk, check your PC now with Prevx 3.0.
Associated Malware Groups
The filename is associated with the malware group:
- Malware Downloader
File Behavior
SC.INS has been seen to perform the following behavior:
- The Process is packed and/or encrypted using a software packing process
- This Process is a file infector which modifies program files to include a copy of the infection
- This process creates other processes on disk
SC.INS has been the subject of the following behavior:
- Copied to multiple locations on the system
- Executed as a Process
- Created as a process on disk
- Created as a new Background Service on the machine
Country Of Origin
The filename SC.INS was first seen on Sep 16 2009 in the following geographical region of the Prevx community:
- Australia on Sep 16 2009
File Name Aliases
SC.INS can also use the following file names:
- VRT67.TMP
- VRR2.TMP
- VRR11.TMP
- VRTD39.TMP
- INST[n].EXE
- DPLTMSXBLM-930.PMS.INS
- INST.EXE
- INST[1].EXE
Filesizes
This file has been seen with the following file size:
- 130,560 bytes
Vendor, Product and Version Information
This file has no vendor, product or version information specified in the file header.
File Type
The filename SC.INS refers to an executable program.
File Activity
One or more files with the name SC.INS creates, deletes, copies or moves the following files and folders:
- create folder C:\Program Files\Protection System
- Creates c:\docume~1\user\locals~1\temp\1.ico
- Creates c:\documents and settings\all users\desktop\pornotube.com
- Creates c:\docume~1\user\locals~1\temp\2.ico
- Creates c:\documents and settings\all users\desktop\nudetube.com
- Creates c:\docume~1\user\locals~1\temp\3.ico
- Creates c:\documents and settings\all users\desktop\youporn.com
- Creates c:\windows\sc.exe
- Creates c:\windows\SC.INS
- Deletes c:\program files\protection system\psystem.exe
- Deletes c:\program files\protection system\mal.db
- Deletes c:\program files\protection system\uninst.exe
- Deletes c:\program files\protection system\desktop.ini
Registry Activity
One or more files with the name SC.INS creates or modifies the following registry keys and values:
- HKEY_CURRENT_USER\Software\Protection System Affiliate ID [REG_DWORD, value: 00000020]
- HKEY_CURRENT_USER\Software\Protection System Subaffiliate ID value:
Help the Prevx Community to fight cyber crime
We are always looking for ways to improve the quality and speed of research to help us protect you from malicious software and cyber crime.
© Prevx 2002 - 2010. All Rights Reserved.
