pcscout.exe - Dangerous

Application database

Startupapps.com recommends you:

Malware Tests - removal of the newest malware.

Detect and remove hidden rootkits using UnHackMe Free fully functional 30-days trial.

RegRun Security Suite = 24 system utilities for protecting your computer. Get it!

I would like to say that RegRun has helped me on more than 1 occasion when it comes to spyware/adware by letting me know automatically that a piece of it got added to Windows startup. There is so much spyware/addware out there today it's hard to imagine being without RegRun. I like many other features too including the daily registry backups and file protection.

Chris Wagers

pcscout.exe - Dangerous

pcscout.exe

We suggest you to remove pcscout.exe from your computer as soon as possible.
Pcscout.exe is Trojan/Backdoor.
Kill the process pcscout.exe and remove pcscout.exe from Windows startup.

Malware dropper: C:\sand-box\pcscout.exe
Removed: C:\Program Files\PC Scout\CoreExt.dll; C:\Program Files\PC Scout\pcscout.exe
-------------------------------------------------------------------------------------
Classification:
Code:
Antivirus Version Last Update Result
F-Secure 9.0.15300.0 2009.10.20 -
Kaspersky 7.0.0.125 2009.10.20 Trojan.Win32.FraudPack.wsz
McAfee 5777 2009.10.20 -
Microsoft 1.5101 2009.10.20 VirTool:Win32/Obfuscator.EW
NOD32 4527 2009.10.20 a variant of Win32/Kryptik.AMH
Symantec 1.4.4.12 2009.10.20 -

Additional information
File size: 6021120 bytes
MD5 : 4933618ad0e65dd30d10f13137523e77
SHA1 : c7b9696809cc2f66715647b5b81e3fcbe51da931
-------------------------------------------------------------------------------------
Installation
When the program is executed, it creates the following registry subkeys and values:

----------------------------------
Keys added:6
----------------------------------
HKLM\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\SimpleShlExt
HKLM\SOFTWARE\Classes\CLSID\{5E2121EE-0300-11D4-8D3B-444553540000}
HKLM\SOFTWARE\Classes\CLSID\{5E2121EE-0300-11D4-8D3B-444553540000}\InprocServer32
HKLM\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\SimpleShlExt
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PC Scout
HKLM\SOFTWARE\PC Scout

----------------------------------
Values added:24
----------------------------------
HKLM\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\SimpleShlExt\: "{5E2121EE-0300-11D4-8D3B-444553540000}"
HKLM\SOFTWARE\Classes\CLSID\{5E2121EE-0300-11D4-8D3B-444553540000}\InprocServer32\: "C:\Program Files\PC Scout\CoreExt.dll"
HKLM\SOFTWARE\Classes\CLSID\{5E2121EE-0300-11D4-8D3B-444553540000}\InprocServer32\ThreadingModel: "Apartment"
HKLM\SOFTWARE\Classes\CLSID\{5E2121EE-0300-11D4-8D3B-444553540000}\: "SimpleShlExt Class"
HKLM\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\SimpleShlExt\: "{5E2121EE-0300-11D4-8D3B-444553540000}"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{5E2121EE-0300-11D4-8D3B-444553540000}: "Protection System extension"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PC Scout\DisplayIcon: "C:\Program Files\PC Scout\pcscout.exe"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PC Scout\DisplayName: "PC Scout"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PC Scout\DisplayVersion: "1.0"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PC Scout\Publisher: "PC Scout Software"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PC Scout\UninstallString: "C:\Program Files\PC Scout\Uninstall.exe"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PC Scout\URLInfoAbout: "http://pcscoutlab.com"
HKLM\SOFTWARE\PC Scout\FD: 0x00000000
HKLM\SOFTWARE\PC Scout\Settings_0: 0x00000000
HKLM\SOFTWARE\PC Scout\SecStatus_3: 0x00000001
HKLM\SOFTWARE\PC Scout\SecStatus_4: 0x00000001
HKLM\SOFTWARE\PC Scout\SecStatus_5: 0x00000001
HKLM\SOFTWARE\PC Scout\GUID: "358226903582262735822573"
HKLM\SOFTWARE\PC Scout\Data: ":1956:2082:2208:2460:2586:2712:2838:3090:3216:3342:3468:"
HKLM\SOFTWARE\PC Scout\swver: "1.0"
HKLM\SOFTWARE\PC Scout\dbver: "1.0"
HKLM\SOFTWARE\PC Scout\dbsigns: "61473"
HKCU\Software\Microsoft\Internet Explorer\Main\Use FormSuggest: "Yes"
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\PC Scout: ""C:\Program Files\PC Scout\pcscout.exe" -noscan"

----------------------------------
Values modified:0
----------------------------------

----------------------------------
Files added:11
----------------------------------
C:\Documents and Settings\Administrator\Local Settings\Temp\4otjesjty.mof
C:\Documents and Settings\All Users\Desktop\PC Scout Support.lnk
C:\Documents and Settings\All Users\Desktop\PC Scout.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\PC Scout\PC Scout Support.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\PC Scout\PC Scout.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\PC Scout\Uninstall PC Scout.lnk
C:\Program Files\PC Scout\core.cga
C:\Program Files\PC Scout\CoreExt.dll
C:\Program Files\PC Scout\help.ico
C:\Program Files\PC Scout\pcscout.exe
C:\Program Files\PC Scout\Uninstall.exe

----------------------------------
Files deleted:1
----------------------------------
C:\sand-box\pcscout.exe

----------------------------------
Files [attributes?] modified:0
----------------------------------

----------------------------------
Folders added:2
----------------------------------
C:\Documents and Settings\All Users\Start Menu\Programs\PC Scout
C:\Program Files\PC Scout

----------------------------------
Folders deleted:0
----------------------------------

----------------------------------
Total changes:44
----------------------------------

-------------------------------------------------------------------------------------
Internet activity:
Code:
HTTP GET http://updatepclab.com/c.dat Customer Area
HTTP GET http://updatepclab.com/creg.dat Customer Area
HTTP GET http://updatepclab.com/auth/autologin/em...
HTTP GET http://updatepclab.com/tickets
HTTP GET http://updatepclab.com/tickets/add Customer Area - Open new ticket
HTTP GET http://updatepclab.com/css/godzilla.css
HTTP GET http://updatepclab.com/img/bg.png Customer Area
HTTP GET http://updatepclab.com/img/contentBg.png...
HTTP GET http://updatepclab.com/img/contentBox.pn...
HTTP GET http://updatepclab.com/core.cga Customer Area
HTTP GET http://updatepclab.com/img/breadCrumbBg....
HTTP GET http://updatepclab.com/img/icons/control...
-------------------------------------------------------------------------------------
Detected by UnHackMe:

Item Name: SimpleShlExt
Author:
Related File: C:\Program Files\PC Scout\CoreExt.dll
Type: Context Menu Handlers

Item Name: PC Scout
Author: Protection System Software
Related File: "C:\Program Files\PC Scout\pcscout.exe" -noscan
Type: Registry Run

Item Name: pcscout.exe
Author: Protection System Software
Related File: C:\PROGRAM FILES\PC SCOUT\PCSCOUT.EXE
Type: Running Processes

Removal Results: Success
Number of reboot: 1
-------------------------------------------------------------------------------------

Recommended software:
UnHackMe anti-rootkit and anti-malware
http://www.unhackme.com
RegRun Security Suite (Good choice for removal and protection)
http://www.regrun.com

Removal: pcscout.exe is removed by RegRun.

UnHackMe - Rootkit/Malware killer

Also recommended software:
RegRun Security Suite Platinum - removal and protection.

UnHackMe is a part of RegRun Security Suite Platinum.

RegRun - User's Choice

Vista Programs - full info...

What is hidden in MSDN?
.NET Secrets Revealed

Why software developers prefer Win32.FreeTechSecrets.com?

All Unix Manuals in Alphabetical Order

C# controls for .NET in 3 simple steps.

Constantly updated. Last update: November 16 2009

Interesting information about Vista programs...
Need consultation?

Would you like to add your opinion?

Quick Links: What's new?
RSS Feed
Add to AppDatabase
Ask Experts
Join forum
Links
Articles: Virus or not? SPTD####.sys
What is mc21.tmp, mc22.tmp, mc23.tmp?
Select: Necessary
Useless
At your option
Dangerous