Today I've just discovered some strange files on my Win 7 PC.
I was browsing through the Windows Firewall Inbound Rules and saw two ACCEPT rules for a program, Aview.exe.
It is located in C:\Users\Administrator\TEMP and contains:
Data1.dat
AView.exe
DEFAULT.INI
I don't see it running in Task Manager and it isn't listed in msconfig / Startup. Also can't find any suspicious entry listed as a Service. I used Tcpview to monitor if it creates any new connection when I run it but it does not.
I have no idea how it got there and google searches yield no relevant results.
Antivirus says nothing about it. Earlier when I booted my PC, login screen didn't display my local users and when inputting my Administrator password it didn't do anything. I just rebooted and all was normal again, and I just thought it was another Win hiccup.
I've seen my share of viruses, trojans and roots and this is raising my alarm bar.
EDIT 05 Jan 2013:
VirusTotal scan
Jotti's malware scan
More info about files:
Aview.exe
Description: WinClient
Size: 9.00 KB (9,216 bytes)
Size on disk: 12.0 KB (12.288 bytes)
Created: Thursday 05, July 07, 2012, 20:44:01
Modified: Thursday 05, July 07, 2012, 20:44:30
Accessed: Thursday 05, July 07, 2012, 20:44:01
Data1.dat
Size: 205 KB (209,975 bytes)
Size on disk: 208 KB (212,992 bytes)
Created: Thursday 05, July 07, 2012, 20:44:02
Modified: Thursday 05, July 07, 2012, 20:44:02
Accessed: Thursday 05, July 07, 2012, 20:44:02
DEFAULT.INI
Size: 106 bytes (106 bytes)
Size on disk: 4.00 KB (4,096 bytes)
Created: Thursday 05, July 07, 2012, 20:44:02
Modified: Thursday 05, July 07, 2012, 20:53:25
Accessed: Thursday 05, July 07, 2012, 20:44:02
contains:
[Comm]
SoftkeyboardTrans=255
ToolBoxL=417
ToolBoxT=97
ToolBoxHideMode=2
ToolBoxDX=616
ToolBoxDY=72
Related files:
WinClient1.ocx
Size: 409 KB (419,168 bytes)
Size on disk: 412 KB (421,888 bytes)
Created: Thursday 05, July 07, 2012, 20:43:57
Modified: Thursday 05, July 07, 2012, 20:43:57
Accessed: Thursday 05, July 07, 2012, 20:43:57
contains traces of:
http://ocsp.verisign.com http://crl.verisign.com/tss-ca.crl Western Cape10UDurbanville10UThawte10UThawte Certification10UThawte Timestamping UUS10UVeriSign, Inc.1+0)U"VeriSign Time Stamping Services CA0‚http://ocsp.verisign.com http://crl.verisign.com/ThawteTimestampingCA.crl VeriSign, Inc.1705U.Class 3 Public Primary Certification Authority0040716000000Z140715235959Z0´10UUS10UVeriSign, Inc.10UVeriSign Trust Network1;09U2Terms of use at https://www.verisign.com/rpa (c)041.0,U%VeriSign Class 3 Code Signing 2004 VeriSign, Inc.1705U.Class 3 Public Primary Certification Authority VeriSign, Inc.10UVeriSign Trust Network1;09U2Terms of use at https://www.verisign.com/rpa (c)041.0,U%VeriSign Class 3 Code Signing 2004 Taiwan10Uhijr/Taipei1#0!U ATEN INTERNATIONAL CO.,LTD1 Digital ID Class 3 - Microsoft Software Validation v210UR&D1#0!UATEN INTERNATIONAL CO.http://CSC3-2004-crl.verisign.com/CSC3-2004.crl https://www.verisign.com/rpa0U%0+0u+i0g0$+0†http://ocsp.verisign.com0 http://CSC3-2004-aia.verisign.com/CSC3-2004-aia.cerhttps://www.verisign.com/rpa (c)041.0,U%VeriSign Class 3 Code Signing 2004
I also made a trace using Procmon of what aview.exe does when executed. I've attached the log (aview-log.PML) to the whole archive. You must download Procmon to open the log.
Files are located at http://dl.transfer.ro/aview_files-transfer_ro-05jan-caf326.rar (rename .ex to .exe)