Solved [Suspected infection] EventService from ViewSonic

[ZevinZenph]

Hello,

Few days ago I found something called "EventService" installed on my old XP laptop as an "driver".

I've made another post asking whether the program is malicious or not, but no conclusion is made. Here's all the detail I know:
https://malwaretips.com/threads/que...iver-from-viewsonic-laptop.57144/#post-490866

I don't know if there are still suspicious or even malicious files on my laptop after I uninstalled it, so I come here to for your help, thanks!

-Zevin

 

[TwinHeadedEagle]

Hello,

Did you try to scan that file on VirusTotal?

VirusTotal - Free Online Virus, Malware and URL Scanner

 

[ZevinZenph]

Yeah. The installer is FUD, but the main executable it installed is (only) flagged by Kaspersky.
(I've put all the details in the link above, thanks! )

VT links:
https://www.virustotal.com/en/file/...c12a63b507400f410b049ba9cb7628f71d4/analysis/
https://www.virustotal.com/en/file/...f959fd2865688d0e874716acfa2d1793001/analysis/

 

[TwinHeadedEagle]

This doesn't look like something malicious to me.

 

[ZevinZenph]

Ummm... But why would you think it's not malicious?

I'm worry about this program due to these indicators:
1. The installer provides no EULA or the description of its service. Seriously, nothing is found.
2. The program states that it's produced by "OEM" in control panel, with "SweetHome" as its registered company name. Both of them look fake.
3. The main executable states that its produced by "Gray Workshop". It's different from the "producer" mentioned in 2., and nothing informative can be found by searching "Gray Workshop EventService" on Google.
4. The "3G Module" mentioned in the log file is unknown. Neither itself or the Internet said anything.
To be honest, I find no explanation other than it's a piece of grayware or even malware disguised as a legit program.

 

[TwinHeadedEagle]

Can you scan this file?

S3 PHYMEM; C:\Program Files\OEM\EventService\phymem.sys [6656 2009-04-11] ()

 

[ZevinZenph]

It's not detected by VT at all.
link: Antivirus scan for 04496c3552a0c9b0ae7d3aa52f7eaf91c668690f4a24c038bec4ffc1c1b2d7d7 at 2016-03-15 14:46:57 UTC - VirusTotal

BTW I think I accidentally found some source codes. (phymem.sys and pmdll.dll)
The CRC32s in the source file I found match the one installed by the suspicious program.
Here's the link of the source codes I found:
Access Physical Memory, Port and PCI Configuration Space - CodeProject
The site looks trustworthy (It's a source controlling site, I think.), but the codes are released in China.

 

[TwinHeadedEagle]

I am not sure, but it looks legit. Chinese programs are a huge mess and a headache, so I really don't know how to help you.

 

[ZevinZenph]

Well... Thank you anyways.

But can I ask you 1 more question?
Is there any free/low-cost deep program analyzing platform on the Internet? I wonder why it needs to access physical memory...

 

[TwinHeadedEagle]

I think you should ask it in other forum areas. There are many knowledgeable people around these forums

 

[ZevinZenph]

I'm already asking.
And thanks for your help!