Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Today I've just discovered some strange files on my Win 7 PC. I was browsing through the Windows Firewall Inbound Rules and saw two ACCEPT rules for a program, Aview.exe.
It is located in C:\Users\Administrator\TEMP and contains:
Data1.dat
AView.exe
DEFAULT.INI

I don't see it running in Task Manager and it isn't listed in msconfig / Startup. Also can't find any suspicious entry listed as a Service. I used Tcpview to monitor if it creates any new connection when I run it but it does not.

I have no idea how it got there and google searches yield no relevant results. Antivirus says nothing about it. Earlier when I booted my PC, login screen didn't display my local users and when inputting my Administrator password it didn't do anything. I just rebooted and all was normal again, and I just thought it was another Win hiccup.
I've seen my share of viruses, trojans and roots and this is raising my alarm bar.

EDIT 05 Jan 2013:
VirusTotal scan
Jotti's malware scan

More info about files:
Aview.exe
Description: WinClient
Size: 9.00 KB (9,216 bytes)
Size on disk: 12.0 KB (12.288 bytes)
Created: Thursday 05, July 07, 2012, 20:44:01
Modified: ‎Thursday ‎05, ‎July ‎07, ‎2012, ‏‎20:44:30
Accessed: ‎Thursday ‎05, ‎July ‎07, ‎2012, ‏‎20:44:01

Data1.dat
Size: 205 KB (209,975 bytes)
Size on disk: 208 KB (212,992 bytes)
Created: ‎Thursday ‎05, ‎July ‎07, ‎2012, ‏‎20:44:02
Modified:‎ Thursday ‎05, ‎July ‎07, ‎2012, ‏‎20:44:02
Accessed: ‎Thursday ‎05, ‎July ‎07, ‎2012, ‏‎20:44:02

DEFAULT.INI
Size: 106 bytes (106 bytes)
Size on disk: 4.00 KB (4,096 bytes)
Created: ‎Thursday ‎05, ‎July ‎07, ‎2012, ‏‎20:44:02
Modified: ‎Thursday ‎05, ‎July ‎07, ‎2012, ‏‎20:53:25
Accessed: ‎Thursday ‎05, ‎July ‎07, ‎2012, ‏‎20:44:02

contains:
[Comm]
SoftkeyboardTrans=255
ToolBoxL=417
ToolBoxT=97
ToolBoxHideMode=2
ToolBoxDX=616
ToolBoxDY=72

Related files:
WinClient1.ocx
Size: 409 KB (419,168 bytes)
Size on disk: 412 KB (421,888 bytes)
Created: ‎Thursday ‎05, ‎July ‎07, ‎2012, ‏‎20:43:57
Modified: ‎Thursday ‎05, ‎July ‎07, ‎2012, ‏‎20:43:57
Accessed: ‎Thursday ‎05, ‎July ‎07, ‎2012, ‏‎20:43:57

contains traces of:

 http://ocsp.verisign.com http://crl.verisign.com/tss-ca.crl Western Cape10UDurbanville10UThawte10UThawte Certification10UThawte Timestamping UUS10UVeriSign, Inc.1+0)U"VeriSign Time Stamping Services CA0‚http://ocsp.verisign.com http://crl.verisign.com/ThawteTimestampingCA.crl VeriSign, Inc.1705U.Class 3 Public Primary Certification Authority0040716000000Z140715235959Z0´10UUS10UVeriSign, Inc.10UVeriSign Trust Network1;09U2Terms of use at https://www.verisign.com/rpa (c)041.0,U%VeriSign Class 3 Code Signing 2004 VeriSign, Inc.1705U.Class 3 Public Primary Certification Authority VeriSign, Inc.10UVeriSign Trust Network1;09U2Terms of use at https://www.verisign.com/rpa (c)041.0,U%VeriSign Class 3 Code Signing 2004 Taiwan10Uhijr/Taipei1#0!U ATEN INTERNATIONAL CO.,LTD1 Digital ID Class 3 - Microsoft Software Validation v210UR&D1#0!UATEN INTERNATIONAL CO.http://CSC3-2004-crl.verisign.com/CSC3-2004.crl https://www.verisign.com/rpa0U%0+0u+i0g0$+0†http://ocsp.verisign.com0 http://CSC3-2004-aia.verisign.com/CSC3-2004-aia.cerhttps://www.verisign.com/rpa (c)041.0,U%VeriSign Class 3 Code Signing 2004  

I also made a trace using Procmon of what aview.exe does when executed. I've attached the log (aview-log.PML) to the whole archive. You must download Procmon to open the log.

Files are located at http://dl.transfer.ro/aview_files-transfer_ro-05jan-caf326.rar (rename .ex to .exe)

share|improve this question
    
looking at it it tries to load a winclient.ocx file as well that isn't in your zip. If there is malicious code that is where it will be. –  jcopenha Dec 31 '12 at 16:31
    
how did you discover this? I ran a search on my HDD and found C:\Windows\Downloaded Program Files\WinClient1.ocx which matches the Date Created timestamp of the previous files - 5.7(July).2012, 20:43. The other 3 files in the archive are created after this one, at 20:44. –  w00t Jan 4 '13 at 23:56
    
spent some time with Aview.exe in IDA. If you make WinClient1.ocx available I can probably find time to look at it as well. –  jcopenha Jan 5 '13 at 15:42
    
I've uploaded them again, added more info above. Also added a trace log, worth taking a look at it. –  w00t Jan 5 '13 at 16:48

3 Answers 3

up vote 1 down vote accepted

After looking at Aview.exe and WinClient1.ocx I don't believe this is malware.

There is a clear copyright notice for ATEN Corporation in the about box. And many of graphics in the WinClient1.ocx match the ones in this document. It appears to be a control program for a network based KVM, although probably an older one as the copyright is 2007. The WinClient.ocx is also signed by ATEN Corporation with a VeriSign certification.

if you rename winclient1.cox to winclient.ocx and put it in the same directory as aview.exe you can run it as aview.exe -t6000 and the following screen will be shown. This looks like a legitimate control program to me. The UPX packing is probably used to make it smaller to serve from the actual device and the device itself probably doesn't have much memory on it to begin with.

enter image description here

share|improve this answer
    
Thank you, this solves the mystery. It may have been bundled with some other KVM related program because I've never seen this one. –  w00t Jan 6 '13 at 13:47

Try running the file through VirusTotal and Jotti's malware scan and see if they can detect it as something fishy. It definitely does sound a bit on the shady side, and Prevx notes the following on their site:

AVIEW.EXE has been seen to perform the following behavior: The Process is packed and/or encrypted using a software packing process

Please post VT and Jotti results in comments, I'm curious whether they catch anything inside.

share|improve this answer
    
Here's the links: virustotal.com/file/… and virusscan.jotti.org/en/scanresult/… Should that 1 result be a false positive? –  w00t Dec 25 '12 at 17:54
    
Two engines marked it as a positive, VT has seen the same file being called: AView.exe, WinClient, WinClient.EXE, smona132702768842047518628 and file-4938240_exe. Looks suspicious enough to me. I'd dig a bit deeper. –  code_burgar Dec 25 '12 at 18:15
    
Indeed, that makes it even more suspicious. No idea what to do next though.. I'm trying some 3rd party firewalls with more control than the Windows default one. –  w00t Dec 25 '12 at 18:35

From the VT and Jotti scans you provided, they were flagged as UPX packed executables. UPX is so common that most AVs contain unpacker routines, which allow them to scan the executable as if it weren't packed. The positive result you saw was from an AV that treats packed executables as highly suspicious, which is an arguable stance to take - some use UPX to protect intellectual property, some use it to hide malware. Considering it was detected as UPX by PEiD and various other tools on VT, I'd imagine the AVs would have flagged it up as malware if it was malicious.

However, that's not to say it's definitely something you want to run on your machine. It could be a browser toolbar or other junk that you would rather avoid, and an AV wouldn't flag it as anything worth blocking. My suggestion would be to install it in a virtual machine, and see what happens.

share|improve this answer
    
Already tried it in a VM. It executes only once - can see the process in Task Manager. Subsequent executions result in the following error: "Register Winclient fail!". If I close the process and run AView.exe again, it errors out without remaining started. I can reproduce this behavior by creating a new local user and running the exe again. It obviously does some changes to the local user. –  w00t Dec 25 '12 at 22:55
    
Sounds like it's either badly written, or badware. Since you've already sent it to VirusTotal, it'll be given to all the major AV vendors for analysis anyway. –  Polynomial Dec 26 '12 at 22:39
    
ah, nice. anyone running NOD32 please submit it to them. –  w00t Dec 28 '12 at 16:00

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.