coreext.dll - Dangerous

coreext.dll

Free Download

Manual removal instructions:

Antivirus Report of coreext.dll:
coreext.dll Malware
coreext.dllDangerous
coreext.dllHigh Risk
coreext.dll
We suggest you to remove pcscout.exe from your computer as soon as possible.
Pcscout.exe is Trojan/Backdoor.
Kill the process pcscout.exe and remove pcscout.exe from Windows startup.

Malware dropper: C:\sand-box\pcscout.exe
Removed: C:\Program Files\PC Scout\CoreExt.dll; C:\Program Files\PC Scout\pcscout.exe
-------------------------------------------------------------------------------------
Classification:
Code:
Antivirus Version Last Update Result
F-Secure 9.0.15300.0 2009.10.20 -
Kaspersky 7.0.0.125 2009.10.20 Trojan.Win32.FraudPack.wsz
McAfee 5777 2009.10.20 -
Microsoft 1.5101 2009.10.20 VirTool:Win32/Obfuscator.EW
NOD32 4527 2009.10.20 a variant of Win32/Kryptik.AMH
Symantec 1.4.4.12 2009.10.20 -

Additional information
File size: 6021120 bytes
MD5 : 4933618ad0e65dd30d10f13137523e77
SHA1 : c7b9696809cc2f66715647b5b81e3fcbe51da931
-------------------------------------------------------------------------------------
Installation
When the program is executed, it creates the following registry subkeys and values:

----------------------------------
Keys added:6
----------------------------------
HKLM\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\SimpleShlExt
HKLM\SOFTWARE\Classes\CLSID\{5E2121EE-0300-11D4-8D3B-444553540000}
HKLM\SOFTWARE\Classes\CLSID\{5E2121EE-0300-11D4-8D3B-444553540000}\InprocServer32
HKLM\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\SimpleShlExt
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PC Scout
HKLM\SOFTWARE\PC Scout

----------------------------------
Values added:24
----------------------------------
HKLM\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\SimpleShlExt\: "{5E2121EE-0300-11D4-8D3B-444553540000}"
HKLM\SOFTWARE\Classes\CLSID\{5E2121EE-0300-11D4-8D3B-444553540000}\InprocServer32\: "C:\Program Files\PC Scout\CoreExt.dll"
HKLM\SOFTWARE\Classes\CLSID\{5E2121EE-0300-11D4-8D3B-444553540000}\InprocServer32\ThreadingModel: "Apartment"
HKLM\SOFTWARE\Classes\CLSID\{5E2121EE-0300-11D4-8D3B-444553540000}\: "SimpleShlExt Class"
HKLM\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\SimpleShlExt\: "{5E2121EE-0300-11D4-8D3B-444553540000}"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{5E2121EE-0300-11D4-8D3B-444553540000}: "Protection System extension"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PC Scout\DisplayIcon: "C:\Program Files\PC Scout\pcscout.exe"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PC Scout\DisplayName: "PC Scout"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PC Scout\DisplayVersion: "1.0"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PC Scout\Publisher: "PC Scout Software"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PC Scout\UninstallString: "C:\Program Files\PC Scout\Uninstall.exe"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PC Scout\URLInfoAbout: "http://pcscoutlab.com"
HKLM\SOFTWARE\PC Scout\FD: 0x00000000
HKLM\SOFTWARE\PC Scout\Settings_0: 0x00000000
HKLM\SOFTWARE\PC Scout\SecStatus_3: 0x00000001
HKLM\SOFTWARE\PC Scout\SecStatus_4: 0x00000001
HKLM\SOFTWARE\PC Scout\SecStatus_5: 0x00000001
HKLM\SOFTWARE\PC Scout\GUID: "358226903582262735822573"
HKLM\SOFTWARE\PC Scout\Data: ":1956:2082:2208:2460:2586:2712:2838:3090:3216:3342:3468:"
HKLM\SOFTWARE\PC Scout\swver: "1.0"
HKLM\SOFTWARE\PC Scout\dbver: "1.0"
HKLM\SOFTWARE\PC Scout\dbsigns: "61473"
HKCU\Software\Microsoft\Internet Explorer\Main\Use FormSuggest: "Yes"
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\PC Scout: ""C:\Program Files\PC Scout\pcscout.exe" -noscan"

----------------------------------
Values modified:0
----------------------------------

----------------------------------
Files added:11
----------------------------------
C:\Documents and Settings\Administrator\Local Settings\Temp\4otjesjty.mof
C:\Documents and Settings\All Users\Desktop\PC Scout Support.lnk
C:\Documents and Settings\All Users\Desktop\PC Scout.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\PC Scout\PC Scout Support.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\PC Scout\PC Scout.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\PC Scout\Uninstall PC Scout.lnk
C:\Program Files\PC Scout\core.cga
C:\Program Files\PC Scout\CoreExt.dll
C:\Program Files\PC Scout\help.ico
C:\Program Files\PC Scout\pcscout.exe
C:\Program Files\PC Scout\Uninstall.exe

----------------------------------
Files deleted:1
----------------------------------
C:\sand-box\pcscout.exe

----------------------------------
Files [attributes?] modified:0
----------------------------------

----------------------------------
Folders added:2
----------------------------------
C:\Documents and Settings\All Users\Start Menu\Programs\PC Scout
C:\Program Files\PC Scout

----------------------------------
Folders deleted:0
----------------------------------

----------------------------------
Total changes:44
----------------------------------

-------------------------------------------------------------------------------------
Internet activity:
Code:
HTTP GET http://updatepclab.com/c.dat Customer Area
HTTP GET http://updatepclab.com/creg.dat Customer Area
HTTP GET http://updatepclab.com/auth/autologin/em...
HTTP GET http://updatepclab.com/tickets
HTTP GET http://updatepclab.com/tickets/add Customer Area - Open new ticket
HTTP GET http://updatepclab.com/css/godzilla.css
HTTP GET http://updatepclab.com/img/bg.png Customer Area
HTTP GET http://updatepclab.com/img/contentBg.png...
HTTP GET http://updatepclab.com/img/contentBox.pn...
HTTP GET http://updatepclab.com/core.cga Customer Area
HTTP GET http://updatepclab.com/img/breadCrumbBg....
HTTP GET http://updatepclab.com/img/icons/control...
-------------------------------------------------------------------------------------
Detected by UnHackMe:

Item Name: SimpleShlExt
Author:
Related File: C:\Program Files\PC Scout\CoreExt.dll
Type: Context Menu Handlers

Item Name: PC Scout
Author: Protection System Software
Related File: "C:\Program Files\PC Scout\pcscout.exe" -noscan
Type: Registry Run

Item Name: pcscout.exe
Author: Protection System Software
Related File: C:\PROGRAM FILES\PC SCOUT\PCSCOUT.EXE
Type: Running Processes


Removal Results: Success
Number of reboot: 1
-------------------------------------------------------------------------------------

Recommended software:
UnHackMe anti-rootkit and anti-malware
http://www.unhackme.com
RegRun Security Suite (Good choice for removal and protection)


Remove coreext.dll now!

Dmitry Sokolov:

I created UnHackMe in 2006 to fix the problem that antivioruses did not fix: detecting rootkits.

Since that time I work every day to fix the issues that antiviruses cannot.

If your antivirus have not helped you solve the problem, you should try UnHackMe.

We are a small company and you can ask me directly, if you have any questions.

Testimonials

You can read UnHackMe testimonials here.