{"id":3473,"date":"2014-12-06T09:26:21","date_gmt":"2014-12-06T09:26:21","guid":{"rendered":"http:\/\/www.freefixer.com\/b\/?p=3473"},"modified":"2018-05-29T12:01:14","modified_gmt":"2018-05-29T12:01:14","slug":"dova-network-new-media-holdings-ltd-detection-rate-installcore","status":"publish","type":"post","link":"https:\/\/www.freefixer.com\/b\/dova-network-new-media-holdings-ltd-detection-rate-installcore\/","title":{"rendered":"Dova Network (New Media Holdings Ltd.) – 9% Detection Rate – InstallCore"},"content":{"rendered":"

Hi there! Just a quick post today from a rainy Stockholm. Working with the next release of FreeFixer<\/a>. Anyway, did you see a file, such as ChromeSetup.exe<\/a>, on your system digitally signed by Dova Network (New Media Holdings Ltd.)<\/strong>? Then read on..<\/p>\n

\"Dova<\/a><\/p>\n

You can also check who signed a file by checking the digital signature tab. According to the certificate we can see that Dova Network (New Media Holdings Ltd.) is located in Tel Aviv in Israel and that the certificate is issued by GlobalSign CodeSigning CA – G2.<\/p>\n

\"Dova<\/a><\/p>\n

What caught my attention was that the download was called ChromeSetup.exe. This might look like an official Google Chrome<\/strong> download, but it is not. If it was an official download, it would be digitally signed by Google Inc.<\/strong>. Here’s how the authentic Google Chrome<\/strong> looks like when you double click on it. Notice that the “Verified publisher” says “Google Inc”.
\n\"Chrome<\/a><\/p>\n

When I uploaded the file to VirusTotal<\/a> – as I usually do when I find something that looks suspicious – 9% of the scanners detected the file. The file is detected as Generic.C54<\/strong> by AVG, InstallCore.b (fs)<\/strong> by AVware, a variant of Win32\/InstallCore.SS<\/strong> by ESET-NOD32 and InstallCore.b (fs)<\/strong> by VIPRE.<\/p>\n

\"Dova<\/a><\/p>\n

To see more in details what changes the Dova Network (New Media Holdings Ltd.) file would do on a user’s computer I decided to run the file on my lab machine. The installer bundled some additional software such as Vosteran<\/a>, Avast Anti-Virus, Google Chrome Packages, Hold Page<\/a> and MyPC Backup:<\/p>\n

\"Dova<\/a><\/p>\n

Did you also find an Dova Network (New Media Holdings Ltd.)? Do you remember the download link? Please post it in the comments below and I’ll upload it to VirusTotal<\/a> to see if that one is also detected.<\/p>\n

Thank you for reading.<\/p>\n","protected":false},"excerpt":{"rendered":"

Hi there! Just a quick post today from a rainy Stockholm. Working with the next release of FreeFixer. Anyway, did you see a file, such as ChromeSetup.exe, on your system digitally signed by Dova Network (New Media Holdings Ltd.)? Then read on.. You can also check who signed a file by checking the digital signature … Continue reading Dova Network (New Media Holdings Ltd.) – 9% Detection Rate – InstallCore<\/span> →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[3,54],"tags":[311,252,251],"_links":{"self":[{"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/posts\/3473"}],"collection":[{"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/comments?post=3473"}],"version-history":[{"count":2,"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/posts\/3473\/revisions"}],"predecessor-version":[{"id":3479,"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/posts\/3473\/revisions\/3479"}],"wp:attachment":[{"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/media?parent=3473"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/categories?post=3473"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/tags?post=3473"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}