XQueue cliente.exe Virus ??

[nikita75]

link scansione virus total

sul pc dei ragazzi di un mio inquilino, lanciando Process explorer ha rivelato questo processo a me sconosciuto XQueueclient.exe

PC infetto ?

Il pc funziona, si connette in rete , ma Saltuariamente quando chrome è aperto appaiono pagine di spam

https://postimg.org/image/ec70l53vx/

malware bytes dice che va tutto bene



cosa suggerite di fare ? nel link il collegamento del processo a virus total

Codice: Seleziona tutto

SHA256:   73ec4c7b28e44e9c4aacee80c5acc4e25a2cb84b6026300c18ef9f6ddbff657e
Nome del file:   XQueue.exe
Rapporto rilevamento:   41 / 67
Data analisi:   2018-01-16 17:01:10 UTC ( 1 ora, 20 minuti fa )
0 0
 Analisi
 File detail
 Ulteriori informazioni
 Commenti 0
 Voti
Antivirus   Risultato   Aggiornamento
Ad-Aware   Trojan.GenericKD.12532491   20180116
AegisLab   Troj.W32.Yakes.tp6Z   20180116
AhnLab-V3   Malware/Gen.Generic.C2240122   20180116
ALYac   Trojan.GenericKD.12532491   20180116
Antiy-AVL   Trojan/Win32.Yakes   20180116
Arcabit   Trojan.Generic.DBF3B0B   20180116
Avast   Win32:Malware-gen   20180116
AVG   Win32:Malware-gen   20180116
Avira (no cloud)   TR/Injector.ivjfy   20180116
AVware   Trojan.Win32.Generic!BT   20180103
BitDefender   Trojan.GenericKD.12532491   20180116
Bkav   W32.PagakaDAAV.Trojan   20180116
CAT-QuickHeal   Trojan.Yakes   20180116
Cyren   W32/Trojan.JKGG-0382   20180116
Emsisoft   Trojan.GenericKD.12532491 (B)   20180116
Endgame   malicious (moderate confidence)   20171130
ESET-NOD32   a variant of Win32/Injector.DTDV   20180116
F-Secure   Trojan.GenericKD.12532491   20180116
Fortinet   W32/Yakes.DTDV!tr   20180116
GData   Trojan.GenericKD.12532491   20180116
Jiangmin   Trojan.Yakes.xgb   20180116
K7AntiVirus   Trojan ( 0051ad9e1 )   20180116
K7GW   Trojan ( 0051ad9e1 )   20180116
Kaspersky   Trojan.Win32.Yakes.usku   20180116
MAX   malware (ai score=100)   20180116
McAfee-GW-Edition   Artemis   20180116
Microsoft   Trojan:Win32/Tiggre!rfn   20180116
eScan   Trojan.GenericKD.12532491   20180116
NANO-Antivirus   Trojan.Win32.Yakes.eurocj   20180116
Palo Alto Networks (Known Signatures)   generic.ml   20180116
Panda   Trj/GdSda.A   20180116
Qihoo-360   Win32/Trojan.33d   20180116
Sophos AV   Mal/Generic-S   20180116
Symantec   Trojan.Gen   20180116
Tencent   Win32.Trojan.Yakes.Phgc   20180116
VBA32   Trojan.Yakes   20180116
VIPRE   Trojan.Win32.Generic!BT   20180116
Webroot   W32.Trojan.Gen   20180116
Yandex   Trojan.Yakes!xI9uSdTwhoc   20180112
Zillya   Trojan.Yakes.Win32.66519   20180116
ZoneAlarm by Check Point   Trojan.Win32.Yakes.usku   20180116
Alibaba      20180116
Avast-Mobile      20180116
Baidu      20180116
ClamAV      20180116
CMC      20180116
Comodo      20180116
CrowdStrike Falcon (ML)      20171016
Cybereason      20171103
Cylance      20180116
DrWeb      20180116
eGambit      20180116
F-Prot      20180116
Ikarus      20180116
Sophos ML      20170914
Kingsoft      20180116
Malwarebytes      20180116
McAfee      20180116
nProtect      20180116
Rising      20180116
SentinelOne (Static ML)      20180115
SUPERAntiSpyware      20180116
Symantec Mobile Insight      20180116
TheHacker      20180115
TotalDefense      20180116
TrendMicro      20180116
TrendMicro-HouseCall      20180116
Trustlook      20180116
ViRobot      20180116
WhiteArmor      20180110
Zoner      20180116[/list]

[nikita75]

ricerca di google su questo processo

[nikita75]

sicuramente Virus - i dettagli della scansione sul processo virustotal Description XQueueClientTest.exe

Codice: Seleziona tutto

 FileVersionInfo properties
CopyrightCopyright © 2002-2005 Hans Dietrich
Product XQueue
Original name XQueue.exe
File version 1, 2, 0, 1
Description XQueueClientTest.exe
 PE header basic information
Target machine Intel 386 or later processors and compatible processors
Compilation timestamp 2017-10-31 15:34:30
Entry Point 0x0001318A
Number of sections 4
 PE sections
Name Virtual address Virtual size Raw size Entropy MD5
.text  4096 164090 167936 5.96 787becbc687ab5b36675ea1afbb2a989
.rdata  172032 23512 24576 4.74 36729971e4b424a1aa97fd9caeed6f41
.data  196608 33000 16384 2.08 15c692bdd233c4cc16788a3439138fc2
.rsrc  233472 15216 16384 3.62 fed8b60ade2e82bfd7bf6cc237e74e6f
 Overlays
MD5 1ffad64f96e47abe60f671597780e747
File type data
Offset 229376
Size 60010000
Entropy 0.00
 PE imports
[+] ADVAPI32.dll
[+] COMCTL32.dll
[+] GDI32.dll
[+] KERNEL32.dll
[+] SHELL32.dll
[+] USER32.dll
[+] WINSPOOL.DRV
 Number of PE resources by type
RT_STRING 12
RT_BITMAP 4
RT_DIALOG 3
RT_CURSOR 2
RT_GROUP_CURSOR 1
RT_ICON 1
RT_MANIFEST 1
RT_MENU 1
RT_VERSION 1
RT_GROUP_ICON 1
 Number of PE resources by language
ENGLISH US 25
CHINESE SIMPLIFIED 2
 PE resources
05e0d5787611ed4f643733e3e6e62d00f426422b5d3e443ceebac22e9d294bc4  ASCII text
0714c554acd308b38c3d6319f7e470f76a16d712f696545eacac2bdc725dfb95  ASCII text
1b8660b0c53b94f3e029de58e56d08c8097a080244e9dc65d4155a9b603820d8  ASCII text
1bf3b476c90b4d69ffacf814700ff58d3745713ee100baa8d6a5f6c64862d4d4  ASCII text
1ec6ce4f8c6daf05def39c709a775069d55195d3ed49f24ac792479d74c92021  data
31bff9afbf08a8869318cd946a1d73a4425afefc5693c6e06671bde1e86de1dc  ASCII text
36db380991291cac5c99e42332efda20210f63985544d95e8fa6ef85bf2bdf8e  ASCII text
3dc813f2aa5b552212a5a49f97c4e4bd7baa6dbc45f7edbc38d360764e039ebb  data
3f6b4d09eff5904d35d366988f7ab28821df18fc4266e441d5afec8c7434f245  ASCII text
4406c7739acdebe7be0510fb2cf7043ebec1f3dfd4fd876e1b6d0eb29fa79a14  data
Show all
 ExifTool file metadata
SubsystemVersion4.0
InitializedDataSize77824
ImageVersion0.0
ProductNameXQueue
FileVersionNumber1.2.0.1
UninitializedDataSize0
LanguageCodeEnglish (U.S.)
FileFlagsMask0x003f
CharacterSetUnicode
LinkerVersion6.0
FileTypeExtensionexe
OriginalFileNameXQueue.exe
MIMETypeapplication/octet-stream
SubsystemWindows GUI
FileVersion1, 2, 0, 1
TimeStamp2017:10:31 16:34:30+01:00
FileTypeWin32 EXE
PETypePE32
ProductVersion1, 2, 0, 1
[b][color=#FF0000]FileDescriptionXQueueClientTest.exe[/color][/b]
OSVersion4.0
FileOSWin32
LegalCopyrightCopyright 2002-2005 Hans Dietrich
MachineTypeIntel 386 or later, and compatibles
CodeSize167936
FileSubtype0
ProductVersionNumber1.2.0.1
EntryPoint0x1318a
ObjectFileTypeExecutable application

[nikita75]

cosa suggerite?

[davide72]

https://translate.google.it/translate?h ... rev=search
per me è sospetto

[nikita75]

Grazie Davide72
Con process explorer riesco ad Killarlo ..lo uccido , ma non so di cosa si tratta

è un processo sospetto!

[nikita75]

Grazie Davide72
Con process explorer riesco ad Killarlo ..lo uccido , ma non so di cosa si tratta

è un processo sospetto!

Con process explorer riesco a terminare (kill) XQueue client.ex ma non riesco a terminare WsAppService.exe



https://postimg.org/image/yewrxrg0d/



scrrenshot di process explorer

in fondo alla jpeg il processo Xquee

https://postimg.org/image/qaont7oi5/

[nikita75]

https://translate.google.it/translate?hl=it&sl=en&u=https://www.file.net/process/wsappservice.exe.html&prev=search
per me è sospetto

Da comando ho chiesto a processo explorer analisi con virustolal per wsappservice - processo pulito



SHA256: a008e00fe9151a8e73bf5faf4ecd7b201ae6bbe0c3504b973bc1fd96ae189810
Nome del file: WsAppService.exe
Rapporto rilevamento: 0 / 68 pulito
Data analisi: 2017-12-17 10:44:40 UTC ( 1 mese fa )

[nikita75]

Risposta da F Secure

Greetings,

Thank you for your submission.

The sample is malicious and already detected by our product as Trojan.GenericKD.12532491.

Kindly update your database version to the latest database. You can also right click on the malicious process from Process Explorer and choose "kill process". Thank you.

If there is anything else we can help you with, please do not hesitate to contact us again.
Best regards,
Azim
Malware Analyst
F-Secure Security Labs

Visit our Labs blog at https://labsblog.f-secure.com/
Give and get advice in our F-Secure Community at https://community.f-secure.com
Contact Support at https://www.f-secure.com/support

in response to:



ref:_00Db0JXpV._5000X1NsIa3:ref

[nikita75]

https://www.xqueue.de/

che lavoro svolge questo sito internet??

[nikita75]

risolto installando il kasperky antivirus , la versione demo per 30 gg .
il problema non è piu' riscontrato