File Investigation Report
MCLUBCLIENT.EXE
Malware DownloaderYour PC may be infected. The presence of a file called MCLUBCLIENT.EXE is a possible sign of infection.
You should urgently check your PC to make sure it is not infected. The free version of Prevx will scan your PC in less than two minutes and check for millions of spyware and malware infections including MCLUBCLIENT.EXE. Don't put your confidential data, or your identity at risk, check your PC now with Prevx.
Associated Malware Groups
The unsafe files using this name are associated with the malware group:
- Malware Downloader
File Behavior
MCLUBCLIENT.EXE has been seen to perform the following behavior:
- The Process is packed and/or encrypted using a software packing process
- Adds a Registry Key (RUN) to auto start Programs on system start up
- Registers a Dynamic Link Library File
- Executes a Process
- Looks at the contents of the autoexec.bat file
- Reads email address and phone book details
- Visits web sites on your PC without you knowing
MCLUBCLIENT.EXE has been the subject of the following behavior:
- Executed as a Process
- Copied to multiple locations on the system
- Added as a Registry auto start to load Program on Boot up
Country Of Origin
The filename MCLUBCLIENT.EXE was first seen on Jun 20 2007 in the following geographical regions of the Prevx community:
- The UNITED KINGDOM on Jun 20 2007
- SPAIN on Jun 20 2007
- SINGAPORE on Oct 26 2007
File Name Aliases
MCLUBCLIENT.EXE can also use the following file names:
- 40504991.SVD
- V20070328.RAR
Filesizes
The following file size has been seen:
- 31,232 bytes
- 30,720 bytes
Vendor, Product and Version Information
These files have no vendor, product or version information specified in the file header.
File Type
The filename MCLUBCLIENT.EXE refers to many versions of an executable program.
File Activity
One or more files with the name MCLUBCLIENT.EXE creates, deletes, copies or moves the following files and folders:
- create folder C:\Program Files\Tencent
- create folder C:\Program Files\Tencent\QQ
- create folder C:\Program Files\Tencent\QQ\
- Creates c:\windows\gafsdaz.bat
- Copies filec:\windows\system32\mClubclient.exe to c:\docume~1\user\locals~1\temp\v20070328.rar
- Creates c:\windows\system32\QMsgRecver.dll
- Deletes c:\windows\system32\QMsgRecver.dl
- Opens/modifes c:\autoexec.bat
- Creates c:\docume~1\user\locals~1\temp\adbc_appcompat.txt
- Creates c:\docume~1\user\locals~1\temp\werb8e5.dir00\svchost.exe
- Creates c:\docume~1\user\locals~1\temp\werb8e5.dir00\drwtsn32.exe
- Creates c:\docume~1\user\locals~1\temp\werb8e5.dir00\appcompat.txt
- Creates c:\docume~1\user\locals~1\temp\werb8e5.dir00\manifest.txt
- Creates c:\docume~1\user\locals~1\temp\1AF55.dmp
- Deletes c:\windows\gafsdaz.ba
Registry Activity
One or more files with the name MCLUBCLIENT.EXE creates or modifies the following registry keys and values:
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run mClubclient.exe C:\WINDOWS\system32\mClubclient.exe
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run mClubclient.exe C:\WINDOWS\system32\mClubclient.exe
Website Activity
One or more files with the name MCLUBCLIENT.EXE interacts with the following web sites and pages. Web addresses have been deliberately modified to prevent unintentional use.
- cmd .checkthisdoor .com / cmd20070328 .html
- Port 80 IP:8.15.231.115