XLOADER[n].EXE

Information Stealer

Your PC is infected. The file called XLOADER[n].EXE is considered unsafe and there may be other infections on your PC.

You should urgently check your PC and remove any malicious software including XLOADER[n].EXE as soon as possible. The free version of Prevx 3.0 will scan your PC for millions of spyware and malware infections in less than 2 minutes. Don't put your confidential data, or your identity at risk, check your PC now with Prevx 3.0.

Download Prevx 3.0 now »

Associated Malware Groups

The filename is associated with the malware group:

Information Stealer

File Behavior

XLOADER[n].EXE has been seen to perform the following behavior:

The Process is packed and/or encrypted using a software packing process
Looks at the contents of the autoexec.bat file
Reads email address and phone book details

XLOADER[n].EXE has been the subject of the following behavior:

Created as a process on disk
Executed as a Process

Country Of Origin

The filename XLOADER[n].EXE was first seen on Nov 12 2008 in the following geographical regions of the Prevx community:

Europe on Nov 12 2008
Canada on Nov 12 2008

File Name Aliases

XLOADER[n].EXE can also use the following file names:

33259893.EXE
08826253.SVD
84488396.TMP
XLOADEDFGR[n].EXE

Filesizes

This file has been seen with the following file size:

15,872 bytes

Vendor, Product and Version Information

This file has no vendor, product or version information specified in the file header.

File Type

The filename XLOADER[n].EXE refers to an executable program.

File Activity

One or more files with the name XLOADER[n].EXE creates, deletes, copies or moves the following files and folders:

Creates c:\docume~1\user\locals~1\temp\cscript.exe
Opens/modifes c:\autoexec.bat
Creates c:\docume~1\user\locals~1\temp\tx1.tm
Deletes c:\docume~1\user\locals~1\temp\t1.tmp
Deletes c:\windows\services.exe
Copies filec:\docume~1\user\locals~1\temp\1\svchost.exe to c:\windows\services.exe
Deletes c:\windows\file.bat
Deletes c:\windows\winlogon.exe
Copies filec:\docume~1\user\locals~1\temp\2\svchost.exe to c:\windows\winlogon.exe
Copies filec:\windows\services.exe to c:\windows\services.exe
Deletes c:\docume~1\user\locals~1\temp\1\svchost.exe
Copies filec:\windows\winlogon.exe to c:\windows\winlogon.exe
Deletes c:\docume~1\user\locals~1\temp\2\svchost.exe

Registry Activity

One or more files with the name XLOADER[n].EXE creates or modifies the following registry keys and values:

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop id 225815474310
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop host 206.51.229.118

Network Activity

One or more files with the name XLOADER[n].EXE performs the following network events:

DNS Lookup206.51.229.118 206.51.229.118
DNS name server0.10.66.1

Website Activity

One or more files with the name XLOADER[n].EXE interacts with the following web sites and pages. Web addresses have been deliberately modified to prevent unintentional use.

TCP:127.0.0.1:1077 Port:16
Port 80 IP:92.48.201.31
TCP:10.10.66.1:53 Port:6