PUP.Passview.F

The detection of PUP.Passview.F on your system indicates the presence of a potentially unwanted program (PUP) that may be causing issues with your computer's performance and security. It is essential to understand the nature of this threat and take appropriate steps to remove it and prevent future infections.

What Is PUP.Passview.F?

PUP.Passview.F is a type of potentially unwanted program that can be installed on your system without your knowledge or consent. These types of programs are often bundled with other software or downloaded from the internet, and they can cause a range of problems, including slowing down your computer, displaying unwanted advertisements, and potentially compromising your personal data. While PUPs are not typically considered to be as malicious as other types of malware, they can still pose a significant threat to your system's security and stability.

How PUP.Passview.F Operates

PUP.Passview.F, like other PUPs, operates by installing itself on your system and then executing its payload. This can happen through various means, such as when you download and install software from the internet, click on malicious links, or open infected email attachments. Once installed, PUP.Passview.F can start to cause problems, such as displaying unwanted advertisements, changing your browser settings, or even installing additional malware on your system. It is crucial to remove PUP.Passview.F as soon as possible to prevent further damage to your system.

Symptoms of Infection

If your system is infected with PUP.Passview.F, you may notice a range of symptoms, including slow system performance, unwanted advertisements or pop-ups, changed browser settings, and unexpected crashes or freezes. You may also notice that your system is taking longer to start up or shut down, or that your internet connection is slower than usual. In some cases, you may not notice any symptoms at all, which is why it is essential to regularly scan your system for malware and other threats.

• Unwanted advertisements or pop-ups
• Changed browser settings
• Slow system performance
• Unexpected crashes or freezes
• Slower internet connection

How to Remove PUP.Passview.F

1. Boot your system in Safe Mode with Networking to prevent PUP.Passview.F from loading and to allow you to download and install removal tools.
2. Download and install a reputable anti-malware tool, such as SpyHunter, and perform a full scan of your system to detect and remove PUP.Passview.F and any other malware that may be present.
3. Uninstall any suspicious programs that may be related to PUP.Passview.F, as these can be used to reinstall the malware or download additional threats.
4. Reset your web browsers, including Chrome, Firefox, and Edge, to their default settings to remove any changes made by PUP.Passview.F.
5. Reboot your system and perform a follow-up scan to ensure that PUP.Passview.F has been completely removed and that your system is free from other threats.

Conclusion

Removing PUP.Passview.F from your system requires careful attention to detail and a thorough understanding of the steps involved. By following the guidance outlined above, you can help to ensure that your system is free from this potentially unwanted program and that you are protected from future infections. Remember to always be cautious when downloading software from the internet, and never click on links or open attachments from unknown sources. By taking these precautions, you can help to keep your system safe and secure.

Analysis Report

General information

Family Name:	PUP.Passview.F
Signature status:	No Signature

Known Samples

i

Known Samples

This section lists other file samples believed to be associated with this family.

MD5: 98a31a67efb283108228dd7ecf4d0824 SHA1: 44dcf27027bf5b896b999700bbafb5101869bba3 SHA256: B23281D9CF95773F8BA16525381B612175BF13718AE81F67FD78E50EC27EACC8 File Size: 40.45 KB, 40448 bytes

MD5: 0eea354164681edcb34ca8afac82c94f SHA1: 3255ed4fa83681936eb2e19aefdc82097cd52ede SHA256: F05EE19BEC9A8C1763C220156DF263C88910D87928B3A882CCB6847A93142592 File Size: 67.07 KB, 67072 bytes

MD5: ddb5c9c16d49879128198059405053a6 SHA1: e75c8d2c475b3857bdf0a768018574103b5d3570 SHA256: C4F7D480D27C4E856A248EF89B9237FF992D830BBFF79A678756EEE6103A5CDB File Size: 30.72 KB, 30720 bytes

MD5: 3220728e48e2722554e9bcb46cdbf8f2 SHA1: 6d1e66d7736e9d1e4f5f0a82bcc9e50e4d4d19fa SHA256: 0A7630B86C34D9A7F5DAA8E72E161492055C7D2FC059F0C74A415FF64E16C04E File Size: 32.77 KB, 32768 bytes

MD5: 29c23f6fdffc8b33db12d7cce45cc8a1 SHA1: d34ff0e2c8e682e0bc6e2a1ce6cd5a8c12d11db2 SHA256: 6C5EB4DF10BA20419BBF6D4730B7C7BCD4158B0A5FBE942EDD59CE8F207B6D80 File Size: 294.91 KB, 294912 bytes

Show More

MD5: a4fbbf5edd06ab04c8bce717b4d12fff SHA1: b5bda405e98cf4b26735183b51cfef8400f08ad0 SHA256: B414CAF64AAE8BF53A5F21C7B48B694CE61AC4BAB5802D6854DDD8C7B067CD6A File Size: 37.89 KB, 37888 bytes

MD5: 8bfc039e5efd084394c482b9c6d2ad2b SHA1: 395b2a8557fa71040079d829aa605783d38f031b SHA256: D5A60E8A6EF9C942581E02F58D46ED624FA1A2B2D1AA65A0824FD3E2EAF7E5DC File Size: 106.50 KB, 106496 bytes

Windows Portable Executable Attributes

i

Windows Portable Executable Attributes

This section lists file attributes found within family samples. These attributes are extracted from the files’ Windows PE (Portable Executable) specification and various system flags. Portable Executable Attributes give malware researchers insight into a file’s functionality, executable details, platform and runtime environment.

• File doesn't have "Rich" header
• File doesn't have debug information
• File doesn't have exports table
• File doesn't have relocations information
• File doesn't have security information
• File has been packed
• File has exports table
• File is .NET application
• File is 32-bit executable
• File is either console or GUI application

Show More

• File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
• File is Native application (NOT .NET application)
• File is not packed
• IMAGE_FILE_DLL is not set inside PE header (Executable)
• IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Icons

i

File Icons

This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.

Windows PE Version Information

i

Windows PE Version Information

This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.

Name	Value
Assembly Version	1.5.6.41148
Comments	A quality control tool that checks for the presence of a specified list of items (software and hardware).
Company Name	Kodak Graphic Communications Canada Company - Unified Workflow NirSoft
File Description	IPNetInfo MMCompView MyUninstaller Server Build Quality Control Tool ServiWin Shell Extensions Manager
File Version	1.70 1.13 1.10 1.5.6.41148 1.00
Internal Name	IPNetInfo MMCompView MyUninstaller ServerQC.exe ServiWin ShellExView
Legal Copyright	(C) 2012 Kodak Graphic Communications Canada Company Copyright © 2003 - 2004 Nir Sofer Copyright © 2003 - 2005 Nir Sofer Copyright © 2003 - 2010 Nir Sofer Copyright © 2003 Nir Sofer Copyright © 2004 Nir Sofer
Original Filename	ipnetinfo.exe mmview.exe myuninst.exe ServerQC.exe ServiWin.exe shexview.exe
Product Name	IPNetInfo MMCompView MyUninstaller ServerQC ServiWin ShellExView
Product Version	1.70 1.13 1.10 1.5 1.00

File Traits

• Installer Version
• packed
• x86

Block Information

i

Block Information

During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.

Total Blocks:	93
Potentially Malicious Blocks:	0
Whitelisted Blocks:	93
Unknown Blocks:	0

Visual Map

0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0

0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block

Similar Families

i

Similar Families

This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.

• Passview.F

Files Modified

i

Files Modified

This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.

File	Attributes
\device\namedpipe\gmdasllogger	Generic Write,Read Attributes
c:\users\user\appdata\local\microsoft\windows\usrclass.dat{dba6b5ef-640a-11ed-9bcb-f677369d361c}.txr.0.regtrans-ms	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\microsoft\windows\usrclass.dat{dba6b5ef-640a-11ed-9bcb-f677369d361c}.txr.1.regtrans-ms	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\microsoft\windows\usrclass.dat{dba6b5ef-640a-11ed-9bcb-f677369d361c}.txr.2.regtrans-ms	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\windows\appcompat\programs\amcache.hve	Read Data,Read Control,Write Data
c:\windows\appcompat\programs\amcache.hve	Write Attributes

Registry Modifications

i

Registry Modifications

This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.

Key::Value	Data	API Name
HKLM\system\software\microsoft\tip\aggregateresults::data	�ӹ ��J� +z� �,�� +z� �Tg ��3 �0��E �4 ��� (�4 ��|� l��\� �lk �Ϛ ���� Ϛ ���� Ϛ ���� Ϛ ���r	RegNtPreCreateKey

Windows API Usage

i

Windows API Usage

This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.

Category	API
Network Winsock2	WSAStartup
Anti Debug	IsDebuggerPresent
User Data Access	GetUserObjectInformation
Keyboard Access	GetAsyncKeyState GetKeyState
Service Control	OpenSCManager
Process Manipulation Evasion	NtUnmapViewOfSection ReadProcessMemory
Process Shell Execute	CreateProcess
Encryption Used	BCryptOpenAlgorithmProvider

Shell Command Execution

i

Shell Command Execution

This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.

C:\Windows\Microsoft.NET\Framework\v2.0.50727\\dw20.exe dw20.exe -x -s 944