|
|
UnHackMe Warrior Removing rootkits is best done from the "clean" Windows!
Blog: New viruses/malware/rootkits. Everyday!
Blog: How to remove malware/Trojans/rootkits using UnHackMe or manually. We know how to remove malware.
Shortcut Antivirus protects against Microsoft LNK and PIF vulnerability, notify a user about found threats and give possibility to immediately remove threats.
StuxnetRemover - free of charge Stuxnet/Tmphider rootkit removal tool.
|
 pcscout.exe - Dangerous
Fix it immediately
Pcscout.exe is Trojan/Backdoor. Kill the process pcscout.exe and remove pcscout.exe from Windows startup. Malware dropper: C:\sand-box\pcscout.exe Removed: C:\Program Files\PC Scout\CoreExt.dll; C:\Program Files\PC Scout\pcscout.exe ------------------------------------------------------------------------------------- Classification: Code: Antivirus Version Last Update Result F-Secure 9.0.15300.0 2009.10.20 - Kaspersky 7.0.0.125 2009.10.20 Trojan.Win32.FraudPack.wsz McAfee 5777 2009.10.20 - Microsoft 1.5101 2009.10.20 VirTool:Win32/Obfuscator.EW NOD32 4527 2009.10.20 a variant of Win32/Kryptik.AMH Symantec 1.4.4.12 2009.10.20 - Additional information File size: 6021120 bytes MD5 : 4933618ad0e65dd30d10f13137523e77 SHA1 : c7b9696809cc2f66715647b5b81e3fcbe51da931 ------------------------------------------------------------------------------------- Installation When the program is executed, it creates the following registry subkeys and values: ---------------------------------- Keys added:6 ---------------------------------- HKLM\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\SimpleShlExt HKLM\SOFTWARE\Classes\CLSID\{5E2121EE-0300-11D4-8D3B-444553540000} HKLM\SOFTWARE\Classes\CLSID\{5E2121EE-0300-11D4-8D3B-444553540000}\InprocServer32 HKLM\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\SimpleShlExt HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PC Scout HKLM\SOFTWARE\PC Scout ---------------------------------- Values added:24 ---------------------------------- HKLM\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\SimpleShlExt\: "{5E2121EE-0300-11D4-8D3B-444553540000}" HKLM\SOFTWARE\Classes\CLSID\{5E2121EE-0300-11D4-8D3B-444553540000}\InprocServer32\: "C:\Program Files\PC Scout\CoreExt.dll" HKLM\SOFTWARE\Classes\CLSID\{5E2121EE-0300-11D4-8D3B-444553540000}\InprocServer32\ThreadingModel: "Apartment" HKLM\SOFTWARE\Classes\CLSID\{5E2121EE-0300-11D4-8D3B-444553540000}\: "SimpleShlExt Class" HKLM\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\SimpleShlExt\: "{5E2121EE-0300-11D4-8D3B-444553540000}" HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{5E2121EE-0300-11D4-8D3B-444553540000}: "Protection System extension" HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PC Scout\DisplayIcon: "C:\Program Files\PC Scout\pcscout.exe" HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PC Scout\DisplayName: "PC Scout" HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PC Scout\DisplayVersion: "1.0" HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PC Scout\Publisher: "PC Scout Software" HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PC Scout\UninstallString: "C:\Program Files\PC Scout\Uninstall.exe" HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PC Scout\URLInfoAbout: "http://pcscoutlab.com" HKLM\SOFTWARE\PC Scout\FD: 0x00000000 HKLM\SOFTWARE\PC Scout\Settings_0: 0x00000000 HKLM\SOFTWARE\PC Scout\SecStatus_3: 0x00000001 HKLM\SOFTWARE\PC Scout\SecStatus_4: 0x00000001 HKLM\SOFTWARE\PC Scout\SecStatus_5: 0x00000001 HKLM\SOFTWARE\PC Scout\GUID: "358226903582262735822573" HKLM\SOFTWARE\PC Scout\Data: ":1956:2082:2208:2460:2586:2712:2838:3090:3216:3342:3468:" HKLM\SOFTWARE\PC Scout\swver: "1.0" HKLM\SOFTWARE\PC Scout\dbver: "1.0" HKLM\SOFTWARE\PC Scout\dbsigns: "61473" HKCU\Software\Microsoft\Internet Explorer\Main\Use FormSuggest: "Yes" HKCU\Software\Microsoft\Windows\CurrentVersion\Run\PC Scout: ""C:\Program Files\PC Scout\pcscout.exe" -noscan" ---------------------------------- Values modified:0 ---------------------------------- ---------------------------------- Files added:11 ---------------------------------- C:\Documents and Settings\Administrator\Local Settings\Temp\4otjesjty.mof C:\Documents and Settings\All Users\Desktop\PC Scout Support.lnk C:\Documents and Settings\All Users\Desktop\PC Scout.lnk C:\Documents and Settings\All Users\Start Menu\Programs\PC Scout\PC Scout Support.lnk C:\Documents and Settings\All Users\Start Menu\Programs\PC Scout\PC Scout.lnk C:\Documents and Settings\All Users\Start Menu\Programs\PC Scout\Uninstall PC Scout.lnk C:\Program Files\PC Scout\core.cga C:\Program Files\PC Scout\CoreExt.dll C:\Program Files\PC Scout\help.ico C:\Program Files\PC Scout\pcscout.exe C:\Program Files\PC Scout\Uninstall.exe ---------------------------------- Files deleted:1 ---------------------------------- C:\sand-box\pcscout.exe ---------------------------------- Files [attributes?] modified:0 ---------------------------------- ---------------------------------- Folders added:2 ---------------------------------- C:\Documents and Settings\All Users\Start Menu\Programs\PC Scout C:\Program Files\PC Scout ---------------------------------- Folders deleted:0 ---------------------------------- ---------------------------------- Total changes:44 ---------------------------------- ------------------------------------------------------------------------------------- Internet activity: Code: HTTP GET http://updatepclab.com/c.dat Customer Area HTTP GET http://updatepclab.com/creg.dat Customer Area HTTP GET http://updatepclab.com/auth/autologin/em... HTTP GET http://updatepclab.com/tickets HTTP GET http://updatepclab.com/tickets/add Customer Area - Open new ticket HTTP GET http://updatepclab.com/css/godzilla.css HTTP GET http://updatepclab.com/img/bg.png Customer Area HTTP GET http://updatepclab.com/img/contentBg.png... HTTP GET http://updatepclab.com/img/contentBox.pn... HTTP GET http://updatepclab.com/core.cga Customer Area HTTP GET http://updatepclab.com/img/breadCrumbBg.... HTTP GET http://updatepclab.com/img/icons/control... ------------------------------------------------------------------------------------- Detected by UnHackMe: Item Name: SimpleShlExt Author: Related File: C:\Program Files\PC Scout\CoreExt.dll Type: Context Menu Handlers Item Name: PC Scout Author: Protection System Software Related File: "C:\Program Files\PC Scout\pcscout.exe" -noscan Type: Registry Run Item Name: pcscout.exe Author: Protection System Software Related File: C:\PROGRAM FILES\PC SCOUT\PCSCOUT.EXE Type: Running Processes Removal Results: Success Number of reboot: 1 ------------------------------------------------------------------------------------- Recommended software: UnHackMe anti-rootkit and anti-malware http://www.unhackme.com RegRun Security Suite (Good choice for removal and protection)
Virus Problem? Google Redirects? Ads? Slow?
Constantly updated. Last update: February 5 2012
Fix Windows PC's Fast! Automated Software Repairs damaged & slow windows systems in 1 click.
|
|
