Tag Archives: Thawte

safe InStAll OPT – 28% Detection Rate – PUP.Optional.Bundle / OutBrowse

September 10, 2015digital signatureThawteRoger Karlsson

Hi there! Just wanted to give you the heads up on files digitally signed by safe InStAll OPT.

You can see who the signer is when double-clicking on an executable file. safe InStAll OPT appears in the publisher field in the dialog that pops up. To get more details on the publisher, you can view the certificate by right-clicking on the file, and looking under the Digital Signatures tab. According to the certificate we can see that safe InStAll OPT appears to be located in Ireland and that the certificate is issued by thawte SHA256 Code Signing CA.

Here’s Thawte in the certificate chain:

When I uploaded the file to VirusTotal – as I usually do when I find something that looks suspicious – 28% of the antivirus scanners detected the file. The file is detected as Downloader.USS by AVG, PUP.Optional.Bundle by Malwarebytes and Adware-OutBrowse.h by McAfee-GW-Edition.

Did you also find a safe InStAll OPT file? What kind of download was it? If you remember the download link, please post it in the comments below.

Thanks for reading.

viD PLAY – 33% Detection Rate – OutBrowse

September 9, 2015digital signatureThawteRoger Karlsson

Hello readers! If you are a regular here on the FreeFixer blog, you know that I’ve been examining files that have a digital signature and bundle various types of potentially unwanted software. Today I found another publisher named viD PLAY that bundles some software.

If you have a viD PLAY file on your computer you may have noticed that viD PLAY pops up as the publisher in the User Account Control dialog when running the file. The certificate is issued by thawte SHA256 Code Signing CA.

Thawte at the root in the certificate chain:

After uploading the viD PLAY file – Player.exe – to VirusTotal, it was clear that it’s probably better to delete the file than running it. The detection rate was 33% and some of the detection names were: Downloader.UIA, PUP.Optional.Vidplay, Adware-OutBrowse.h and OutBrowse.

Did you also find a viD PLAY file? What kind of download was it? If you remember the download link, please post it in the comments below.

Thank you for reading.

Vega Resource, LLC – 16% Detection Rate – HEUR:AdWare.Win32.Generic

August 14, 2015digital signatureMultiPlug, Thawte, UkraineRoger Karlsson

Hello readers! Just a short post on a publisher called Vega Resource, LLC. I just found a download named “Download.exe” that was digitally by this publisher, and it turns out that it is detected by some anti-virus programs.

This is how it looks when double-clicking on the file and Vega Resource, LLC appears as the publisher. It is also possible to check a digital signature by looking at a file’s properties. Here’s a screenshot of the Vega Resource, LLC certificate.

By clicking at the Certificate Path tab, we can see that Thawte has issued the certificate:

The scan result from VirusTotal below clearly shows why you should avoid the Vega Resource, LLC file. It is detected under names such as Generic6.BURQ, a variant of Win32/Adware.MultiPlug.NX, Unwanted-Program ( 004ccd421 ), not-a-virus:HEUR:AdWare.Win32.Generic, PE:Packer.Win32.Mian007.a!1074235325 and Trojan.Agent/Gen-Downloader.

Did you also run into a download that was digitally signed by Vega Resource, LLC? What kind of download was it and was it reported by the anti-malwares at VirusTotal? Please share in posting comments below.

Hope this blog post helped you avoid some unwanted software on your machine.

Thanks for reading.

starT PlaYInG – 53% Detection Rate – Mikey / PUGO / OutBrowse

August 10, 2015digital signatureDublin, Ireland, ThawteRoger Karlsson

Hi there! Just wanted to let you know about a publisher called starT PlaYInG before going back to writing some code for FreeFixer.

If you have a starT PlaYInG file on your machine you may have noticed that starT PlaYInG is displayed as the publisher in the UAC dialog when double-clicking on the file. It is also possible to check a digital signature by looking at a file’s properties. Here’s a screenshot of the starT PlaYInG certificate.

Thawte has issued the certificate:

If you are considering to run the starT PlaYInG signed file, I’ll advice you not to. Delete it instead. Just check out detection list by some of the anti-virus program:

Avast reports Player.exe as NSIS:OutBrowse-DQ [PUP], AVG calls it Downloader.OPP, BitDefender detects it as Gen:Variant.Adware.Mikey.21084, Cyren reports W32/Adware.PUGO-0761 and VIPRE reports OutBrowse (fs).

Did you also find a starT PlaYInG file?

Thank you for reading.