MCLUBCLIENT.EXE

Malware Downloader

Your PC may be infected. The presence of a file called MCLUBCLIENT.EXE is a possible sign of infection.

You should urgently check your PC to make sure it is not infected. The free version of Prevx will scan your PC in less than two minutes and check for millions of spyware and malware infections including MCLUBCLIENT.EXE. Don't put your confidential data, or your identity at risk, check your PC now with Prevx.

Download Prevx 3.0 »

Associated Malware Groups

The unsafe files using this name are associated with the malware group:

Malware Downloader

File Behavior

MCLUBCLIENT.EXE has been seen to perform the following behavior:

The Process is packed and/or encrypted using a software packing process
Adds a Registry Key (RUN) to auto start Programs on system start up
Registers a Dynamic Link Library File
Executes a Process
Looks at the contents of the autoexec.bat file
Reads email address and phone book details
Visits web sites on your PC without you knowing

MCLUBCLIENT.EXE has been the subject of the following behavior:

Executed as a Process
Copied to multiple locations on the system
Added as a Registry auto start to load Program on Boot up

Country Of Origin

The filename MCLUBCLIENT.EXE was first seen on Jun 20 2007 in the following geographical regions of the Prevx community:

on Jun 20 2007
Spain on Jun 20 2007
Singapore on Oct 26 2007

Filesizes

The following file size has been seen:

31,232 bytes
30,720 bytes

Vendor, Product and Version Information

These files have no vendor, product or version information specified in the file header.

File Type

The filename MCLUBCLIENT.EXE refers to many versions of an executable program.

File Activity

One or more files with the name MCLUBCLIENT.EXE creates, deletes, copies or moves the following files and folders:

create folder C:\Program Files\Tencent
create folder C:\Program Files\Tencent\QQ
create folder C:\Program Files\Tencent\QQ\
Creates c:\windows\gafsdaz.bat
Copies filec:\windows\system32\mClubclient.exe to c:\docume~1\user\locals~1\temp\v20070328.rar
Creates c:\windows\system32\QMsgRecver.dll
Deletes c:\windows\system32\QMsgRecver.dl
Opens/modifes c:\autoexec.bat
Creates c:\docume~1\user\locals~1\temp\adbc_appcompat.txt
Creates c:\docume~1\user\locals~1\temp\werb8e5.dir00\svchost.exe
Creates c:\docume~1\user\locals~1\temp\werb8e5.dir00\drwtsn32.exe
Creates c:\docume~1\user\locals~1\temp\werb8e5.dir00\appcompat.txt
Creates c:\docume~1\user\locals~1\temp\werb8e5.dir00\manifest.txt
Creates c:\docume~1\user\locals~1\temp\1AF55.dmp
Deletes c:\windows\gafsdaz.ba

Registry Activity

One or more files with the name MCLUBCLIENT.EXE creates or modifies the following registry keys and values:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run mClubclient.exe C:\WINDOWS\system32\mClubclient.exe
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run mClubclient.exe C:\WINDOWS\system32\mClubclient.exe

Website Activity

One or more files with the name MCLUBCLIENT.EXE interacts with the following web sites and pages. Web addresses have been deliberately modified to prevent unintentional use.

cmd .checkthisdoor .com / cmd20070328 .html
Port 80 IP:8.15.231.115

Virus, Spyware & Malware Center »