Strange file named Aview.exe - WinClient

Question

Today I've just discovered some strange files on my Win 7 PC. I was browsing through the Windows Firewall Inbound Rules and saw two ACCEPT rules for a program, Aview.exe.
It is located in C:\Users\Administrator\TEMP and contains:
Data1.dat
AView.exe
DEFAULT.INI

I don't see it running in Task Manager and it isn't listed in msconfig / Startup. Also can't find any suspicious entry listed as a Service. I used Tcpview to monitor if it creates any new connection when I run it but it does not.

I have no idea how it got there and google searches yield no relevant results. Antivirus says nothing about it. Earlier when I booted my PC, login screen didn't display my local users and when inputting my Administrator password it didn't do anything. I just rebooted and all was normal again, and I just thought it was another Win hiccup.
I've seen my share of viruses, trojans and roots and this is raising my alarm bar.

EDIT 05 Jan 2013:
VirusTotal scan
Jotti's malware scan

More info about files:
Aview.exe
Description: WinClient
Size: 9.00 KB (9,216 bytes)
Size on disk: 12.0 KB (12.288 bytes)
Created: Thursday 05, July 07, 2012, 20:44:01
Modified: ‎Thursday ‎05, ‎July ‎07, ‎2012, ‏‎20:44:30
Accessed: ‎Thursday ‎05, ‎July ‎07, ‎2012, ‏‎20:44:01

Data1.dat
Size: 205 KB (209,975 bytes)
Size on disk: 208 KB (212,992 bytes)
Created: ‎Thursday ‎05, ‎July ‎07, ‎2012, ‏‎20:44:02
Modified:‎ Thursday ‎05, ‎July ‎07, ‎2012, ‏‎20:44:02
Accessed: ‎Thursday ‎05, ‎July ‎07, ‎2012, ‏‎20:44:02

DEFAULT.INI
Size: 106 bytes (106 bytes)
Size on disk: 4.00 KB (4,096 bytes)
Created: ‎Thursday ‎05, ‎July ‎07, ‎2012, ‏‎20:44:02
Modified: ‎Thursday ‎05, ‎July ‎07, ‎2012, ‏‎20:53:25
Accessed: ‎Thursday ‎05, ‎July ‎07, ‎2012, ‏‎20:44:02
contains:
[Comm]
SoftkeyboardTrans=255
ToolBoxL=417
ToolBoxT=97
ToolBoxHideMode=2
ToolBoxDX=616
ToolBoxDY=72

Related files:
WinClient1.ocx
Size: 409 KB (419,168 bytes)
Size on disk: 412 KB (421,888 bytes)
Created: ‎Thursday ‎05, ‎July ‎07, ‎2012, ‏‎20:43:57
Modified: ‎Thursday ‎05, ‎July ‎07, ‎2012, ‏‎20:43:57
Accessed: ‎Thursday ‎05, ‎July ‎07, ‎2012, ‏‎20:43:57
contains traces of:

 http://ocsp.verisign.com http://crl.verisign.com/tss-ca.crl Western Cape10UDurbanville10UThawte10UThawte Certification10UThawte Timestamping UUS10UVeriSign, Inc.1+0)U"VeriSign Time Stamping Services CA0‚http://ocsp.verisign.com http://crl.verisign.com/ThawteTimestampingCA.crl VeriSign, Inc.1705U.Class 3 Public Primary Certification Authority0040716000000Z140715235959Z0´10UUS10UVeriSign, Inc.10UVeriSign Trust Network1;09U2Terms of use at https://www.verisign.com/rpa (c)041.0,U%VeriSign Class 3 Code Signing 2004 VeriSign, Inc.1705U.Class 3 Public Primary Certification Authority VeriSign, Inc.10UVeriSign Trust Network1;09U2Terms of use at https://www.verisign.com/rpa (c)041.0,U%VeriSign Class 3 Code Signing 2004 Taiwan10Uhijr/Taipei1#0!U ATEN INTERNATIONAL CO.,LTD1 Digital ID Class 3 - Microsoft Software Validation v210UR&D1#0!UATEN INTERNATIONAL CO.http://CSC3-2004-crl.verisign.com/CSC3-2004.crl https://www.verisign.com/rpa0U%0+0u+i0g0$+0†http://ocsp.verisign.com0 http://CSC3-2004-aia.verisign.com/CSC3-2004-aia.cerhttps://www.verisign.com/rpa (c)041.0,U%VeriSign Class 3 Code Signing 2004  

I also made a trace using Procmon of what aview.exe does when executed. I've attached the log (aview-log.PML) to the whole archive. You must download Procmon to open the log.

Files are located at http://dl.transfer.ro/aview_files-transfer_ro-05jan-caf326.rar (rename .ex to .exe)

Answer 1

After looking at Aview.exe and WinClient1.ocx I don't believe this is malware.

There is a clear copyright notice for ATEN Corporation in the about box. And many of graphics in the WinClient1.ocx match the ones in this document. It appears to be a control program for a network based KVM, although probably an older one as the copyright is 2007. The WinClient.ocx is also signed by ATEN Corporation with a VeriSign certification.

if you rename winclient1.cox to winclient.ocx and put it in the same directory as aview.exe you can run it as aview.exe -t6000 and the following screen will be shown. This looks like a legitimate control program to me. The UPX packing is probably used to make it smaller to serve from the actual device and the device itself probably doesn't have much memory on it to begin with.

Answer 2

From the VT and Jotti scans you provided, they were flagged as UPX packed executables. UPX is so common that most AVs contain unpacker routines, which allow them to scan the executable as if it weren't packed. The positive result you saw was from an AV that treats packed executables as highly suspicious, which is an arguable stance to take - some use UPX to protect intellectual property, some use it to hide malware. Considering it was detected as UPX by PEiD and various other tools on VT, I'd imagine the AVs would have flagged it up as malware if it was malicious.

However, that's not to say it's definitely something you want to run on your machine. It could be a browser toolbar or other junk that you would rather avoid, and an AV wouldn't flag it as anything worth blocking. My suggestion would be to install it in a virtual machine, and see what happens.

Answer 3

Try running the file through VirusTotal and Jotti's malware scan and see if they can detect it as something fishy. It definitely does sound a bit on the shady side, and Prevx notes the following on their site:

AVIEW.EXE has been seen to perform the following behavior: The Process is packed and/or encrypted using a software packing process

Please post VT and Jotti results in comments, I'm curious whether they catch anything inside.