Files with the extension .CEO are associated with the 'Winevar worm' an e-mail worm virus thought to have originated in Korea.

The Winevar worm does damage to the system registry by creating Run keys and by continuously terminating processes and services using the following text: debu, scan, mon, vir, view, iom, fir, anti, ice, prot, dbg, secu, avk, spy and pcc.

The .CEO worm file also scans the system hard-drive and attempts to delete any files found containing the following: antivirus, cillin, vacc and nlab.