Results of system analysis

Kaspersky Virus Removal Tool 11.0.0.1245 (database released 11/10/2011; 03:55)

List of processes

File name	PID	Description	Copyright	MD5	Information
c:\program files\alwil software\avast5\avastsvc.exe Script: Quarantine, Delete, BC delete, Terminate	1280	avast! Service	Copyright (c) 2011 AVAST Software	??	43.72 kb, rsAh, created: 24.09.2011 17:06:42, modified: 06.09.2011 22:45:28 Command line: "C:\Program Files\Alwil Software\Avast5\AvastSvc.exe"
wmpnetwk.exe Script: Quarantine, Delete, BC delete, Terminate	3124			??	error getting file info Command line:
Detected:50, recognized as trusted 49

Module name	Handle	Description	Copyright	MD5	Used by processes
C:\Program Files\Alwil Software\Avast5\defs\11101102\algo.dll Script: Quarantine, Delete, BC delete	1824063488			--	1280
Modules detected:391, recognized as trusted 390

Kernel Space Modules Viewer

Module	Base address	Size in memory	Description	Manufacturer
C:\Windows\system32\DRIVERS\24752363.sys Script: Quarantine, Delete, BC delete	D229000	75F000 (7729152)
C:\Windows\system32\DRIVERS\35631669.sys Script: Quarantine, Delete, BC delete	CA49000	75F000 (7729152)
C:\Windows\System32\Drivers\dump_atapi.sys Script: Quarantine, Delete, BC delete	43DB000	009000 (36864)
C:\Windows\System32\Drivers\dump_dumpata.sys Script: Quarantine, Delete, BC delete	43CF000	00C000 (49152)
C:\Windows\System32\Drivers\dump_dumpfve.sys Script: Quarantine, Delete, BC delete	43E4000	013000 (77824)
C:\Windows\System32\Drivers\sprg.sys Script: Quarantine, Delete, BC delete	105E000	126000 (1204224)
Modules detected - 199, recognized as trusted - 193

Services

Service	Description	Status	File	Group	Dependencies
Detected - 159, recognized as trusted - 159

Drivers

Service	Description	Status	File	Group	Dependencies
24752363 Driver: Unload, Delete, Disable, BC delete	24752363	Running	24752363.sys Script: Quarantine, Delete, BC delete
35631669 Driver: Unload, Delete, Disable, BC delete	35631669	Running	35631669.sys Script: Quarantine, Delete, BC delete
sptd Driver: Unload, Delete, Disable, BC delete	sptd	Running	C:\Windows\System32\Drivers\sptd.sys Script: Quarantine, Delete, BC delete	Boot Bus Extender
catchme Driver: Unload, Delete, Disable, BC delete	catchme	Not started	C:\ComboFix\catchme.sys Script: Quarantine, Delete, BC delete	Base
Detected - 252, recognized as trusted - 248

Autoruns

File name	Status	Startup method	Description
C:\6557d091ac9fccef4477258930bc\DW\DW20.exe Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\VSSetup, EventMessageFile
C:\Program Files (x86)\Common Files\Microsoft Shared\Ink\IPSEventLogMsg.dll Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Handwriting Recognition, EventMessageFile
C:\Program Files (x86)\F-Secure\Anti-Virus\minifilter\fsgk.sys Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\System\F-Secure Gatekeeper, EventMessageFile
C:\Program Files (x86)\F-Secure\Common\AMEHEVN.DLL Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\FSecure-FSecure-F-Secure Management Agent, EventMessageFile
C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE Script: Quarantine, Delete, BC delete	Active	Shortcut in Autoruns folder	C:\Users\Stene\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\, C:\Users\Stene\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Microsoft Outlook.lnk,
C:\Users\Stene\AppData\Local\Temp\NEventMessages.dll Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\Eventlog\Application\Nokia M Platform, EventMessageFile
C:\Users\Stene\AppData\Local\Temp\_uninst_77286306.bat Script: Quarantine, Delete, BC delete	Active	Shortcut in Autoruns folder	C:\Users\Stene\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\, C:\Users\Stene\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_uninst_77286306.lnk,
C:\Windows\System32\appmgmts.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\AppMgmt\Parameters, ServiceDll Delete
C:\Windows\system32\psxss.exe Script: Quarantine, Delete, BC delete	--	Registry key	HKEY_LOCAL_MACHINE, System\CurrentControlSet\Control\Session Manager\SubSystems, Posix
auditcse.dll Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, Software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{f3ccc681-b74c-4060-9f26-cd84525dca2a}, DLLName Delete
rdpclip Script: Quarantine, Delete, BC delete	Active	Registry key	HKEY_LOCAL_MACHINE, System\CurrentControlSet\Control\Terminal Server\Wds\rdpwd, StartupPrograms Delete
Autoruns items detected - 670, recognized as trusted - 659

Microsoft Internet Explorer extension modules (BHOs, Toolbars ...)

File name	Type	Description	Manufacturer	CLSID
	Toolbar			{32099AAC-C132-4136-9E9A-4E364A424E17} Delete
	Extension module			{2670000A-7350-4f3c-8081-5663EE0C6C49} Delete
	Extension module			{789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} Delete
Elements detected - 6, recognized as trusted - 3

Windows Explorer extension modules

File name	Destination	Description	Manufacturer	CLSID
	F-Prot Shell Extension			{23814B80-52A2-11D0-BC1A-004095606CB9} Delete
	ColumnHandler			{7D4D6379-F301-4311-BEBA-E26EB0561882} Delete
	ColumnHandler			{F9DB5320-233E-11D1-9F84-707F02C10627} Delete
Elements detected - 43, recognized as trusted - 40

Printing system extensions (print monitors, providers)

File name	Type	Name	Description	Manufacturer
localspl.dll Script: Quarantine, Delete, BC delete	Monitor	Local Port
FXSMON.DLL Script: Quarantine, Delete, BC delete	Monitor	Microsoft Shared Fax Monitor
tcpmon.dll Script: Quarantine, Delete, BC delete	Monitor	Standard TCP/IP Port
usbmon.dll Script: Quarantine, Delete, BC delete	Monitor	USB Monitor
WSDMon.dll Script: Quarantine, Delete, BC delete	Monitor	WSD Port
inetpp.dll Script: Quarantine, Delete, BC delete	Provider	HTTP Print Services
Elements detected - 7, recognized as trusted - 1

Task Scheduler jobs

File name	Job name	Job status	Description	Manufacturer
Elements detected - 4, recognized as trusted - 4

SPI/LSP settings

Namespace providers (NSP)

Provider	Status	EXE file	Description	GUID
Detected - 7, recognized as trusted - 7

Transport protocol providers (TSP, LSP)

Provider EXE file Description
Detected - 10, recognized as trusted - 10
Results of automatic SPI settings check
LSP settings checked. No errors detected

TCP/UDP ports

Port Status Remote Host Remote Port Application Notes
TCP ports
135 LISTENING 0.0.0.0 0 [844] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
139 LISTENING 0.0.0.0 0 [4] System
Script: Quarantine, Delete, BC delete, Terminate
445 LISTENING 0.0.0.0 0 [4] System
Script: Quarantine, Delete, BC delete, Terminate
554 LISTENING 0.0.0.0 0 [3124] wmpnetwk.exe
Script: Quarantine, Delete, BC delete, Terminate
2869 LISTENING 0.0.0.0 0 [4] System
Script: Quarantine, Delete, BC delete, Terminate
5354 LISTENING 0.0.0.0 0 [2172] c:\program files (x86)\bonjour\mdnsresponder.exe
Script: Quarantine, Delete, BC delete, Terminate
5357 LISTENING 0.0.0.0 0 [4] System
Script: Quarantine, Delete, BC delete, Terminate
10243 LISTENING 0.0.0.0 0 [4] System
Script: Quarantine, Delete, BC delete, Terminate
12025 LISTENING 0.0.0.0 0 [1280] c:\program files\alwil software\avast5\avastsvc.exe
Script: Quarantine, Delete, BC delete, Terminate
12080 LISTENING 0.0.0.0 0 [1280] c:\program files\alwil software\avast5\avastsvc.exe
Script: Quarantine, Delete, BC delete, Terminate
12110 LISTENING 0.0.0.0 0 [1280] c:\program files\alwil software\avast5\avastsvc.exe
Script: Quarantine, Delete, BC delete, Terminate
12119 LISTENING 0.0.0.0 0 [1280] c:\program files\alwil software\avast5\avastsvc.exe
Script: Quarantine, Delete, BC delete, Terminate
12143 LISTENING 0.0.0.0 0 [1280] c:\program files\alwil software\avast5\avastsvc.exe
Script: Quarantine, Delete, BC delete, Terminate
12465 LISTENING 0.0.0.0 0 [1280] c:\program files\alwil software\avast5\avastsvc.exe
Script: Quarantine, Delete, BC delete, Terminate
12563 LISTENING 0.0.0.0 0 [1280] c:\program files\alwil software\avast5\avastsvc.exe
Script: Quarantine, Delete, BC delete, Terminate
12993 LISTENING 0.0.0.0 0 [1280] c:\program files\alwil software\avast5\avastsvc.exe
Script: Quarantine, Delete, BC delete, Terminate
12995 LISTENING 0.0.0.0 0 [1280] c:\program files\alwil software\avast5\avastsvc.exe
Script: Quarantine, Delete, BC delete, Terminate
49152 LISTENING 0.0.0.0 0 [516] wininit.exe
Script: Quarantine, Delete, BC delete, Terminate
49153 LISTENING 0.0.0.0 0 [984] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
49155 LISTENING 0.0.0.0 0 [588] lsass.exe
Script: Quarantine, Delete, BC delete, Terminate
49158 LISTENING 0.0.0.0 0 [360] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
49159 LISTENING 0.0.0.0 0 [572] services.exe
Script: Quarantine, Delete, BC delete, Terminate
51072 ESTABLISHED 127.0.0.1 51073 [4672] c:\program files (x86)\mozilla firefox\firefox.exe
Script: Quarantine, Delete, BC delete, Terminate
51073 ESTABLISHED 127.0.0.1 51072 [4672] c:\program files (x86)\mozilla firefox\firefox.exe
Script: Quarantine, Delete, BC delete, Terminate
51074 ESTABLISHED 127.0.0.1 51075 [4672] c:\program files (x86)\mozilla firefox\firefox.exe
Script: Quarantine, Delete, BC delete, Terminate
51075 ESTABLISHED 127.0.0.1 51074 [4672] c:\program files (x86)\mozilla firefox\firefox.exe
Script: Quarantine, Delete, BC delete, Terminate
51567 TIME_WAIT 74.125.39.139 80 [0]
51569 TIME_WAIT 74.125.47.120 80 [0]
51571 TIME_WAIT 74.125.39.102 80 [0]
51573 TIME_WAIT 74.125.39.113 80 [0]
UDP ports
137 LISTENING -- -- [4] System
Script: Quarantine, Delete, BC delete, Terminate
138 LISTENING -- -- [4] System
Script: Quarantine, Delete, BC delete, Terminate
500 LISTENING -- -- [360] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
1900 LISTENING -- -- [2208] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
1900 LISTENING -- -- [2208] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
3702 LISTENING -- -- [2208] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
3702 LISTENING -- -- [392] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
3702 LISTENING -- -- [392] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
3702 LISTENING -- -- [2208] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
4500 LISTENING -- -- [360] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
5004 LISTENING -- -- [3124] wmpnetwk.exe
Script: Quarantine, Delete, BC delete, Terminate
5005 LISTENING -- -- [3124] wmpnetwk.exe
Script: Quarantine, Delete, BC delete, Terminate
5353 LISTENING -- -- [2172] c:\program files (x86)\bonjour\mdnsresponder.exe
Script: Quarantine, Delete, BC delete, Terminate
5355 LISTENING -- -- [1140] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
51552 LISTENING -- -- [392] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
53879 LISTENING -- -- [2172] c:\program files (x86)\bonjour\mdnsresponder.exe
Script: Quarantine, Delete, BC delete, Terminate
53881 LISTENING -- -- [2208] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
54825 LISTENING -- -- [392] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
62448 LISTENING -- -- [2208] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate
62449 LISTENING -- -- [2208] svchost.exe
Script: Quarantine, Delete, BC delete, Terminate

Downloaded Program Files (DPF)

File name Description Manufacturer CLSID Source URL
Elements detected - 0, recognized as trusted - 0

Control Panel Applets (CPL)

File name Description Manufacturer
C:\Windows\system32\FlashPlayerCPLApp.cpl
Script: Quarantine, Delete, BC delete Adobe Flash Player Control Panel Applet Copyright © 1996-2010 Adobe Systems Incorporated. All Rights Reserved. Adobe and Flash are either trademarks or registered trademarks in the United States and/or other countries.
Elements detected - 19, recognized as trusted - 18

Active Setup

File name Description Manufacturer CLSID
Elements detected - 9, recognized as trusted - 9

HOSTS file

Hosts file record
127.0.0.1 localhost
Clear Hosts file

Protocols and handlers

File name Type Description Manufacturer CLSID
mscoree.dll
Script: Quarantine, Delete, BC delete Protocol Microsoft .NET Runtime Execution Engine () © Microsoft Corporation. All rights reserved. {1E66F26B-79EE-11D2-8710-00C04F79ED0D}
Delete
mscoree.dll
Script: Quarantine, Delete, BC delete Protocol Microsoft .NET Runtime Execution Engine () © Microsoft Corporation. All rights reserved. {1E66F26B-79EE-11D2-8710-00C04F79ED0D}
Delete
mscoree.dll
Script: Quarantine, Delete, BC delete Protocol Microsoft .NET Runtime Execution Engine () © Microsoft Corporation. All rights reserved. {1E66F26B-79EE-11D2-8710-00C04F79ED0D}
Delete
Elements detected - 24, recognized as trusted - 21

Suspicious objects

File Description Type

Main script of analysis
Windows version: Windows Vista (TM) Ultimate, Build=6000, SP="Service Pack 1"
System Restore: enabled
>> Services: potentially dangerous service allowed: TermService (@%SystemRoot%\System32\termsrv.dll,-268)
>> Services: potentially dangerous service allowed: SSDPSRV (@%systemroot%\system32\ssdpsrv.dll,-100)
>> Services: potentially dangerous service allowed: Schedule (@%SystemRoot%\system32\schedsvc.dll,-100)
> Services: please bear in mind that the set of services depends on the use of the PC (home PC, office PC connected to corporate network, etc)!
>> Security: disk drives' autorun is enabled
>> Security: administrative shares (C$, D$ ...) are enabled
>> Security: anonymous user access is enabled
>> Security: sending Remote Assistant queries is enabled
 >>  Disable HDD autorun
 >>  Disable autorun from network drives
 >>  Disable CD/DVD autorun
 >>  Disable removable media autorun
 >>  Windows Explorer - show extensions of known file types
System Analysis in progress

 System Analysis - complete


Script commands 
Add commands to script:
Blocking hooks using Anti-Rootkit
Enable AVZGuard
Operations with AVZPM (true=enable,false=disable)
BootCleaner - import list of deleted files
BootCleaner - import all
Registry cleanup after deleting files
ExecuteWizard ('TSW',2,3,true) - Running Troubleshooting wizard
BootCleaner - activate
Reboot
Insert template for QuarantineFile() - quarantining file
Insert template for BC_QrFile() - quarantining file via BootCleaner
Insert template for DeleteFile() - deleting file
Insert template for DelCLSID() - deleting CLSID item from registry
Additional operations:Performance tweaking: disable service TermService (@%SystemRoot%\System32\termsrv.dll,-268)
Performance tweaking: disable service SSDPSRV (@%systemroot%\system32\ssdpsrv.dll,-100)
Performance tweaking: disable service Schedule (@%SystemRoot%\system32\schedsvc.dll,-100)
Security tweaking: disable CD autorun
Security tweaking: disable administrative shares
Security tweaking: disable anonymous user access
Security: disable sending Remote Assistant queries

File list

Port	Status	Remote Host	Remote Port	Application	Notes
TCP ports
135	LISTENING	0.0.0.0	0	[844] svchost.exe Script: Quarantine, Delete, BC delete, Terminate
139	LISTENING	0.0.0.0	0	[4] System Script: Quarantine, Delete, BC delete, Terminate
445	LISTENING	0.0.0.0	0	[4] System Script: Quarantine, Delete, BC delete, Terminate
554	LISTENING	0.0.0.0	0	[3124] wmpnetwk.exe Script: Quarantine, Delete, BC delete, Terminate
2869	LISTENING	0.0.0.0	0	[4] System Script: Quarantine, Delete, BC delete, Terminate
5354	LISTENING	0.0.0.0	0	[2172] c:\program files (x86)\bonjour\mdnsresponder.exe Script: Quarantine, Delete, BC delete, Terminate
5357	LISTENING	0.0.0.0	0	[4] System Script: Quarantine, Delete, BC delete, Terminate
10243	LISTENING	0.0.0.0	0	[4] System Script: Quarantine, Delete, BC delete, Terminate
12025	LISTENING	0.0.0.0	0	[1280] c:\program files\alwil software\avast5\avastsvc.exe Script: Quarantine, Delete, BC delete, Terminate
12080	LISTENING	0.0.0.0	0	[1280] c:\program files\alwil software\avast5\avastsvc.exe Script: Quarantine, Delete, BC delete, Terminate
12110	LISTENING	0.0.0.0	0	[1280] c:\program files\alwil software\avast5\avastsvc.exe Script: Quarantine, Delete, BC delete, Terminate
12119	LISTENING	0.0.0.0	0	[1280] c:\program files\alwil software\avast5\avastsvc.exe Script: Quarantine, Delete, BC delete, Terminate
12143	LISTENING	0.0.0.0	0	[1280] c:\program files\alwil software\avast5\avastsvc.exe Script: Quarantine, Delete, BC delete, Terminate
12465	LISTENING	0.0.0.0	0	[1280] c:\program files\alwil software\avast5\avastsvc.exe Script: Quarantine, Delete, BC delete, Terminate
12563	LISTENING	0.0.0.0	0	[1280] c:\program files\alwil software\avast5\avastsvc.exe Script: Quarantine, Delete, BC delete, Terminate
12993	LISTENING	0.0.0.0	0	[1280] c:\program files\alwil software\avast5\avastsvc.exe Script: Quarantine, Delete, BC delete, Terminate
12995	LISTENING	0.0.0.0	0	[1280] c:\program files\alwil software\avast5\avastsvc.exe Script: Quarantine, Delete, BC delete, Terminate
49152	LISTENING	0.0.0.0	0	[516] wininit.exe Script: Quarantine, Delete, BC delete, Terminate
49153	LISTENING	0.0.0.0	0	[984] svchost.exe Script: Quarantine, Delete, BC delete, Terminate
49155	LISTENING	0.0.0.0	0	[588] lsass.exe Script: Quarantine, Delete, BC delete, Terminate
49158	LISTENING	0.0.0.0	0	[360] svchost.exe Script: Quarantine, Delete, BC delete, Terminate
49159	LISTENING	0.0.0.0	0	[572] services.exe Script: Quarantine, Delete, BC delete, Terminate
51072	ESTABLISHED	127.0.0.1	51073	[4672] c:\program files (x86)\mozilla firefox\firefox.exe Script: Quarantine, Delete, BC delete, Terminate
51073	ESTABLISHED	127.0.0.1	51072	[4672] c:\program files (x86)\mozilla firefox\firefox.exe Script: Quarantine, Delete, BC delete, Terminate
51074	ESTABLISHED	127.0.0.1	51075	[4672] c:\program files (x86)\mozilla firefox\firefox.exe Script: Quarantine, Delete, BC delete, Terminate
51075	ESTABLISHED	127.0.0.1	51074	[4672] c:\program files (x86)\mozilla firefox\firefox.exe Script: Quarantine, Delete, BC delete, Terminate
51567	TIME_WAIT	74.125.39.139	80	[0]
51569	TIME_WAIT	74.125.47.120	80	[0]
51571	TIME_WAIT	74.125.39.102	80	[0]
51573	TIME_WAIT	74.125.39.113	80	[0]
UDP ports
137	LISTENING	--	--	[4] System Script: Quarantine, Delete, BC delete, Terminate
138	LISTENING	--	--	[4] System Script: Quarantine, Delete, BC delete, Terminate
500	LISTENING	--	--	[360] svchost.exe Script: Quarantine, Delete, BC delete, Terminate
1900	LISTENING	--	--	[2208] svchost.exe Script: Quarantine, Delete, BC delete, Terminate
1900	LISTENING	--	--	[2208] svchost.exe Script: Quarantine, Delete, BC delete, Terminate
3702	LISTENING	--	--	[2208] svchost.exe Script: Quarantine, Delete, BC delete, Terminate
3702	LISTENING	--	--	[392] svchost.exe Script: Quarantine, Delete, BC delete, Terminate
3702	LISTENING	--	--	[392] svchost.exe Script: Quarantine, Delete, BC delete, Terminate
3702	LISTENING	--	--	[2208] svchost.exe Script: Quarantine, Delete, BC delete, Terminate
4500	LISTENING	--	--	[360] svchost.exe Script: Quarantine, Delete, BC delete, Terminate
5004	LISTENING	--	--	[3124] wmpnetwk.exe Script: Quarantine, Delete, BC delete, Terminate
5005	LISTENING	--	--	[3124] wmpnetwk.exe Script: Quarantine, Delete, BC delete, Terminate
5353	LISTENING	--	--	[2172] c:\program files (x86)\bonjour\mdnsresponder.exe Script: Quarantine, Delete, BC delete, Terminate
5355	LISTENING	--	--	[1140] svchost.exe Script: Quarantine, Delete, BC delete, Terminate
51552	LISTENING	--	--	[392] svchost.exe Script: Quarantine, Delete, BC delete, Terminate
53879	LISTENING	--	--	[2172] c:\program files (x86)\bonjour\mdnsresponder.exe Script: Quarantine, Delete, BC delete, Terminate
53881	LISTENING	--	--	[2208] svchost.exe Script: Quarantine, Delete, BC delete, Terminate
54825	LISTENING	--	--	[392] svchost.exe Script: Quarantine, Delete, BC delete, Terminate
62448	LISTENING	--	--	[2208] svchost.exe Script: Quarantine, Delete, BC delete, Terminate
62449	LISTENING	--	--	[2208] svchost.exe Script: Quarantine, Delete, BC delete, Terminate