The file PVJZALZC.EXE is identified as a virus dropper.
The dropper PVJZALZC.EXE is used for downloading and installing other malware, Trojans, viruses by the commands received from the Command Center.
The file PVJZALZC.EXE loads into the computer memory and tries to connect to the dangerous web site.
Usually the PVJZALZC.EXE dropper does not infect the files on the computer and does not replicate itself on other computers.
Kill the PVJZALZC.EXE process and delete the file PVJZALZC.EXE.
Malware Analysis of PVJZALZC.EXE
Full path on a computer: %Temp%\pvjzalzc.exe
Detected by UnHackMe:
PVJZALZC.EXE
Default location: %Temp%\pvjzalzc.exe
Removal Results: Success
Number of reboot: 1
PVJZALZC.EXE is known as:
Trojan.Dorkbot, Win32.VB.CFD, Trojan.Inject.hhkp, Troj.VB-HAX, Trojan.Siggen6.5979, TR.Rogue.AI.141217, Troj.Inject.hh.(kcloud), Trojan.KillAV, Win32.Boaxxe.BE, Trojan.Inject, W32.Inject.BE.tr, Trojan.Inject.awv, Win32.Trojan.BO.b83
PVJZALZC.EXE hash:
- MD5: 7084581571da39070cf24584d7f589d4
Clik here to view.
Registry:- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\YXPack: “regsvr32.exe “%Local Appdata%\YXPack\MsWebMon2.dll”"
Clik here to view.
Folders:- %Appdata%\Mozilla\Firefox\Profiles\profile.default\extensions\{0B129884-0F69-B02F-2C4A-F42D723D8D77}
- %Appdata%\Mozilla\Firefox\Profiles\profile.default\extensions\{0B129884-0F69-B02F-2C4A-F42D723D8D77}\components
- %Local Appdata%\Google\Chrome\User Data\Default\iejibcalgjapcplacmekpecnhcdninhh
- %Local Appdata%\Google\Chrome\User Data\Default\iejibcalgjapcplacmekpecnhcdninhh\4.0.4
- %Local Appdata%\YXPack
Clik here to view.
Files:- %Appdata%\Microsoft\Protect\S-1-5-21-1659004503-1708537768-1801674531-500\173848f0-517c-49ea-8676-df79b2d23323
- %Appdata%\Mozilla\Firefox\Profiles\profile.default\extensions\{0B129884-0F69-B02F-2C4A-F42D723D8D77}\chrome.manifest
- %Appdata%\Mozilla\Firefox\Profiles\profile.default\extensions\{0B129884-0F69-B02F-2C4A-F42D723D8D77}\components\BroadcastEventService.js
- %Appdata%\Mozilla\Firefox\Profiles\profile.default\extensions\{0B129884-0F69-B02F-2C4A-F42D723D8D77}\install.rdf
- %Local Appdata%\Google\Chrome\User Data\Default\iejibcalgjapcplacmekpecnhcdninhh\4.0.4\background.js
- %Local Appdata%\Google\Chrome\User Data\Default\iejibcalgjapcplacmekpecnhcdninhh\4.0.4\content.js
- %Local Appdata%\Google\Chrome\User Data\Default\iejibcalgjapcplacmekpecnhcdninhh\4.0.4\manifest.json
- %Local Appdata%\YXPack\MsWebMon2.dll
- %Local Appdata%\YXPack\MsWebMon2.txt
- %Temp%\pvjzalzc.exe
- %Temp%\rs.dat
- %Temp%\setup.dat