|  | 
| write.exe (5.1.2600.0)
| Contained in software | 
|---|
 | Name: | Windows XP Home Edition, Deutsch | 
|---|
 | License: | commercial | 
|---|
 | Information link: | http://www.microsoft.com/windowsxp/ | 
|---|
 | File details | 
|---|
 | Filepath: | C:\WINDOWS\system32 \ write.exe | 
|---|
 | Filedate: | 2002-08-29 14:00:00 | 
|---|
 | Version: | 5.1.2600.0 | 
|---|
 | Filesize: | 5.632 bytes | 
|---|
 | Checksum and file hashes | 
|---|
 | CRC32: | 3747DF67 | 
|---|
 | MD5: | 159A 2EE6 5FC1 0A5D 43FC 56FD 7318 D933 | 
|---|
 | SHA1: | 229F 0A7E 9108 3CA9 EE0F 9012 02EA 2377 41AA 206E | 
|---|
 | Version resource information | 
|---|
 | CompanyName: | Microsoft Corporation | 
|---|
 | FileDescription: | Windows Write | 
|---|
 | FileOS: | Windows NT, Windows 2000, Windows XP, Windows 2003 | 
|---|
 | FileType: | Application | 
|---|
 | FileVersion: | 5.1.2600.0 | 
|---|
 | InternalName: | write | 
|---|
 | LegalCopyright: | © Microsoft Corporation. All rights reserved. | 
|---|
 | OriginalFilename: | write | 
|---|
 | ProductName: | Microsoft® Windows® Operating System | 
|---|
 | ProductVersion: | 5.1.2600.0 | 
|---|
 
 write.exe was found in the following malware reports:
|  | 
|---|
 | BAT.Install.Trojan | 
|---|
 | About BAT.Install.Trojan ...After creating the folders, it copies itself to many locations, and in doing so, overwrites necessary Windows files....
 Threat assessment
 ...Payload: Overwrites files with itself. ...
 Technical details
 ...BAT.Install.Trojan creates or overwrites these files: C:Install.bat...
 ...C:WindowsMspaint.exe C:WindowsWrite.exe C:WindowsFucking...
 Removal instructions
 ...files from a recent backup. Write-up by: Douglas Knowles...
 Source: http://securityresponse.symantec.com/avcenter/venc/data/bat.install.trojan.html
 | 
|---|
 | Trojan.Bat.Live4 | 
|---|
 | Technical details ...C:WindowsMspaint.exe C:WindowsWrite.exe C:WindowsDefrag.exe...
 Removal instructions
 ...files, reinstall Windows. Write-up by: Kaoru Hayashi...
 Source: http://securityresponse.symantec.com/avcenter/venc/data/trojan.bat.live4.html
 | 
|---|
 | W32.Collo | 
|---|
 | Technical details ...Pbrush.exe Write.exe Scandskw.exe...
 Removal instructions
 ...are detected as W32.Collo. Write-up by: Gor Nazaryan...
 Source: http://securityresponse.symantec.com/avcenter/venc/data/w32.collo.html
 | 
|---|
 | W32.Ramlide | 
|---|
 | Technical details ...C:\%windir%Cdplayer.exe C:\%windir%Write.exe C:\%windir%Pbrush.exe...
 Removal instructions
 ...by LiveUpdate, look at the Virus Definitions (LiveUpdate) line at the top of this write-up. Download the definitions using...
 ...Updater, look at the Virus Definitions (Intelligent Updater) line at the top of this write-up. Intelligent Updater virus...
 ...backups or reinstall them. Write-up by: Yana Liu...
 ......
 Source: http://securityresponse.symantec.com/avcenter/venc/data/w32.ramlide.html
 | 
|---|
 |  |