- May 19, 2016
- 1,580
Is "zlunwise.exe" a Windows process ?
- Thread starter JB007
- Start date
Please provide comments and solutions that are helpful to the author of this topic.
- Feb 25, 2017
- 2,597
Which antivirus do you have installed on that system?
- Aug 17, 2014
- 11,207
You may uploading to Kaspersky Threat Intelligence Portal
I found your file hash on AnyRun:
Analysis 93cdff364604debf54228a942ade70a2678520a5d912d4ba2b1fdea1f458f584.exe (MD5: AC2BF0BAE2CD5C57E085A25FF56A3BBD) Malicious activity - Interactive analysis ANY.RUN
Interactive malware hunting service. Live testing of most type of threats in any environments. No installation and no waiting necessary.
app.any.run
- Feb 25, 2017
- 2,597
It should be part of ZoneAlarm. So if you are using a ZoneAlarm product, then you have nothing to worry about.
- May 19, 2016
- 1,580
You may uploading to Kaspersky Threat Intelligence Portal
I found your file hash on AnyRun:
Analysis 93cdff364604debf54228a942ade70a2678520a5d912d4ba2b1fdea1f458f584.exe (MD5: AC2BF0BAE2CD5C57E085A25FF56A3BBD) Malicious activity - Interactive analysis ANY.RUN
Interactive malware hunting service. Live testing of most type of threats in any environments. No installation and no waiting necessary.
Thanks @SecureKongo and @silversurfer for your answers.
I'll upload the file to KTIP.
Currently I'm using ESET SSP since the end of march (previously KSC) but I remember to have installed ZoneAlarm on this PC 1 or 2 years ago...
- Aug 17, 2014
- 11,207
This file seems to be something like "uninstaller" software from Wise, that's shown on AnyRun... but might be related to ZoneAlarm as mentioned by @SecureKongo
app.any.run
Analysis 93cdff364604debf54228a942ade70a2678520a5d912d4ba2b1fdea1f458f584.exe (MD5: AC2BF0BAE2CD5C57E085A25FF56A3BBD) Malicious activity - Interactive analysis ANY.RUN
Interactive malware hunting service. Live testing of most type of threats in any environments. No installation and no waiting necessary.
app.any.run
- May 19, 2016
- 1,580
This is the result of KTIP Kaspersky Threat Intelligence Portal
but I don't know how to understand these results.
but I don't know how to understand these results.
- May 19, 2016
- 1,580
WiseVector ?This file seems to be something like "uninstaller" software from Wise, that's shown on AnyRun... but might be related to ZoneAlarm as mentioned by @SecureKongo
Analysis 93cdff364604debf54228a942ade70a2678520a5d912d4ba2b1fdea1f458f584.exe (MD5: AC2BF0BAE2CD5C57E085A25FF56A3BBD) Malicious activity - Interactive analysis ANY.RUN
Interactive malware hunting service. Live testing of most type of threats in any environments. No installation and no waiting necessary.
Also tested on this PC.
- Aug 17, 2014
- 11,207
I meant different software, might be from WiseCleaner Software - Optimize, Clean and Speed Up Your Windows PC
That looks like clean so far, later sometimes changing the verdict but happens rarely in case of file type .exeThis is the result of KTIP Kaspersky Threat Intelligence Portal
but I don't know how to understand these results.
- Feb 25, 2017
- 2,597
File now seems to be whitelisted for every engine. Strange, it was detected by one engine some minutes ago...
- Aug 17, 2014
- 11,207
Your file also uploaded to Hybrid Analysis, marked as "whitelisted, based on MD5" so this file hash was known there:
www.hybrid-analysis.com
EDIT: But a new file analysis 64-bit, looks different and marked red as "ambiguous"
www.hybrid-analysis.com
Free Automated Malware Analysis Service - powered by Falcon Sandbox - Viewing online file analysis results for 'zlunwise.exe'
Submit malware for free analysis with Falcon Sandbox and Hybrid Analysis technology. Hybrid Analysis develops and licenses analysis tools to fight malware.
EDIT: But a new file analysis 64-bit, looks different and marked red as "ambiguous"
Free Automated Malware Analysis Service - powered by Falcon Sandbox - Viewing online file analysis results for '93cdff364604debf54228a942ade70a2678520a5d912d4ba2b1fdea1f458f584.exe'
Submit malware for free analysis with Falcon Sandbox and Hybrid Analysis technology. Hybrid Analysis develops and licenses analysis tools to fight malware.
Last edited:
- May 19, 2016
- 1,580
I'm almost sure that I never used a WiseCleaner Software.
However I just sent the file to ESET for further analysis.
Also the current file reputation on ESET:
Last edited:
- May 19, 2016
- 1,580
- Apr 24, 2016
- 7,367
Not an answer to the question, but maybe it's time to check your system for leftovers from other antivirus software:
malwaretips.com
EDIT: added links to the mentioned software.
From this thread:Optimal removal for me is now:
1) Use the av's own uninstaller (Programs and Features).
2) Use the Antivirus Removal Tool to scan for leftovers and optionally run the included av's official specialized uninstaller.
3) Use the Farbar Recovery Scan Tool to clean registered security programs.
Antivirus Removal Tool - The technician friendly tool to detect and completely remove antivirus software.
Antivirus Removal Tool (freeware) is a portable program to detect and completely remove antivirus software. It will help you to identify current and past installations, and it will provide you with the official specialized uninstallers.antivirus-removal-tool.com
4) Use the Registrar Registry Manager to clean the registry
Download Farbar Recovery Scan Tool
Farbar Recovery Scan Tool, or FRST, is a portable application designed to run on Windows XP, Windows Vista, Windows 7, Windows 8, and Windows 10 in normal or safe mode to diagnose malware issues.www.bleepingcomputer.com
Resplendence Software - Registrar Registry Manager Home Edition
Advanced Registry Manager for Windowswww.resplendence.com
Troubleshoot - Not a real problem, but I think it is weird none the less?
Not even sure if I should post this here in this forum, but here it goes. Okay, over a month ago I uninstalled KSC Free because I wanted to try Ziggo Safe online from F-Secure. (And I like Ziggo Safe Online so far.) Now today I used a program called HiBit System Information so that I would have...
malwaretips.com
Last edited:
- May 19, 2016
- 1,580
Thanks @Gandalf_The_GreyNot an answer to the question, but maybe it's time to check your system for leftovers from other antivirus software:
From this thread:
Troubleshoot - Not a real problem, but I think it is weird none the less?
Not even sure if I should post this here in this forum, but here it goes. Okay, over a month ago I uninstalled KSC Free because I wanted to try Ziggo Safe online from F-Secure. (And I like Ziggo Safe Online so far.) Now today I used a program called HiBit System Information so that I would have...
I will take a look at this ASAP.
A 1/xx in VT would make me curious when it would be kaspersky, norton or so. For me Zillya was one of the engines often prone to fp in VT.
- Feb 8, 2016
- 537
- Dec 23, 2014
- 8,545
@JB007
Do you also have zatutor.exe, zonestub.exe, and zclient.exe?
What is the location of zlunwise.exe? Is it a part of some installation?
See also:
www.agicssecurity.com
The file hash is present on the nsrl list.
Do you also have zatutor.exe, zonestub.exe, and zclient.exe?
What is the location of zlunwise.exe? Is it a part of some installation?
See also:
Risk analysis for ZLUNWISE.EXE MD5:ac2bf0bae2cd5c57e085a25ff56a3bbd - Threat analysis: Low risk | Agics Security
Agics Filethreatrank geeft gratis malware informatie over bestanden op uw pc.
The file hash is present on the nsrl list.
Last edited:
- Jul 15, 2016
- 321
All I can say is that ZoneAlarm's unistaller suc*s.
The files stay in the pc.
The files stay in the pc.
- May 19, 2016
- 1,580
Thanks @Andy Ful for your interest.@JB007
Do you also have zatutor.exe, zonestub.exe, and zclient.exe?
What is the location of zlunwise.exe? Is it a part of some installation?
See also:
Risk analysis for ZLUNWISE.EXE MD5:ac2bf0bae2cd5c57e085a25ff56a3bbd - Threat analysis: Low risk | Agics Security
Agics Filethreatrank geeft gratis malware informatie over bestanden op uw pc.
The file hash is present on the nsrl list.
The file is not located in any folder; only in C:\zlunwise.exe ; no I did not find "zatutor.exe, zonestub.exe, and zclient.exe".
Is the presence on tyhe NSRL list mening that this file should be malicious ?
Last edited:
