Mustek Scanning software or possible virus – WEB.EXE

A program called WEB.EXE is installed along with the for many Mustek ScanMagic scanners including the 1200CU, 1200UB, 1200DUF and 2400DUF. It is part of their "BearPaw" software. If you scan directly into another program and don't use scan to web features, this file can be removed.

Unfortunately, a file named WEB.EXE on your system may also indicate that you have a the Gokar Virus/worm (alias W32/Gokar@mm). Gokar is a combination of e-mail, IRC and IIS web worm. It was found in the wild early on December 13th, 2001. Gokar sends itself via Microsoft Outlook, using a long list of variable subject fields, contents and attachment names. The attachment always has an extension of PIF, SCR, COM, EXE or BAT. An infected machine can be manually detected by checking the existance of KAREN.EXE in Windows directory. If the infected machine is working as a web server, the worm will modify the Microsoft IIS starting page to offer WEB.EXE to be downloaded by all visitors to the website. More info is available at http://www.f-secure.com/v-descs/gokar.shtml. If you suspect you have a virus, please make sure your virus software is up to date and then run a complete system scan.

Because this is a common name, there may be other instances of a program called "WEB.EXE".

Safe if not part of Gokar Virus