{"id":4058,"date":"2015-01-26T09:40:44","date_gmt":"2015-01-26T09:40:44","guid":{"rendered":"http:\/\/www.freefixer.com\/b\/?p=4058"},"modified":"2018-05-29T12:01:01","modified_gmt":"2018-05-29T12:01:01","slug":"install-path-ltd-25-detection-rate-strictor-amonetize","status":"publish","type":"post","link":"https:\/\/www.freefixer.com\/b\/install-path-ltd-25-detection-rate-strictor-amonetize\/","title":{"rendered":"Install Path Ltd &#8211; 25% Detection Rate &#8211; Strictor, Amonetize"},"content":{"rendered":"<p>Hi there! Sorry for the silence for the last days. I&#8217;ve been having a few days off. \u00a0Anyway, I&#8217;m back on the blog again.<\/p>\n<p>Did you just download something to\u00a0your system digitally signed by <strong>Install Path Ltd<\/strong>? Then read on..<\/p>\n<p><a href=\"http:\/\/www.freefixer.com\/b\/wp-content\/uploads\/2015\/01\/Install-Path-LTD-comodo.png\"><img loading=\"lazy\" class=\"alignnone size-full wp-image-4062\" src=\"http:\/\/www.freefixer.com\/b\/wp-content\/uploads\/2015\/01\/Install-Path-LTD-comodo.png\" alt=\"Install Path LTD comodo\" width=\"513\" height=\"310\" srcset=\"https:\/\/www.freefixer.com\/b\/wp-content\/uploads\/2015\/01\/Install-Path-LTD-comodo.png 513w, https:\/\/www.freefixer.com\/b\/wp-content\/uploads\/2015\/01\/Install-Path-LTD-comodo-300x181.png 300w\" sizes=\"(max-width: 513px) 100vw, 513px\" \/><\/a><\/p>\n<p>By examining the embedded certificate, we can see that Install Path Ltd is located in Israel. The certificate is issued by COMODO RSA Code Signing CA. The certificate appears to be quite new.<\/p>\n<p><a href=\"http:\/\/www.freefixer.com\/b\/wp-content\/uploads\/2015\/01\/Install-Path-Ltd-certificate.png\"><img loading=\"lazy\" class=\"alignnone size-full wp-image-4059\" src=\"http:\/\/www.freefixer.com\/b\/wp-content\/uploads\/2015\/01\/Install-Path-Ltd-certificate.png\" alt=\"Install Path Ltd certificate\" width=\"685\" height=\"541\" srcset=\"https:\/\/www.freefixer.com\/b\/wp-content\/uploads\/2015\/01\/Install-Path-Ltd-certificate.png 685w, https:\/\/www.freefixer.com\/b\/wp-content\/uploads\/2015\/01\/Install-Path-Ltd-certificate-300x236.png 300w\" sizes=\"(max-width: 685px) 100vw, 685px\" \/><\/a><\/p>\n<p>So, why did I put up this blog post? Well, the thing is that the Install Path Ltd file is detected by many of the scanners, according to <a title=\"How To Scan a File for Viruses with VirusTotal\" href=\"http:\/\/www.freefixer.com\/b\/scan-files-for-viruses-virustotal\/\">VirusTotal<\/a>. Avast detects Setup__6741_i1454683454_il235.exe as <strong>Win32:Rootkit-gen [Rtk]<\/strong>, AVG calls it <strong>InstallPath.7F5 <\/strong>, Avira detects it as <strong>ADWARE\/Adware.Gen2<\/strong>, BitDefender calls it <strong>Gen:Variant.Adware.Strictor.75886<\/strong>, ESET-NOD32 classifies it as <strong>a variant of Win32\/Amonetize.CX<\/strong>, Malwarebytes classifies it as <strong>PUP.Optional.Bundle<\/strong> and Panda calls it <strong>PUP\/MultiToolbar.A.<\/strong><\/p>\n<p><a href=\"http:\/\/www.freefixer.com\/b\/wp-content\/uploads\/2015\/01\/Install-Path-Ltd-virustotal.png\"><img loading=\"lazy\" class=\"alignnone size-full wp-image-4061\" src=\"http:\/\/www.freefixer.com\/b\/wp-content\/uploads\/2015\/01\/Install-Path-Ltd-virustotal.png\" alt=\"Install Path Ltd virustotal\" width=\"702\" height=\"452\" srcset=\"https:\/\/www.freefixer.com\/b\/wp-content\/uploads\/2015\/01\/Install-Path-Ltd-virustotal.png 702w, https:\/\/www.freefixer.com\/b\/wp-content\/uploads\/2015\/01\/Install-Path-Ltd-virustotal-300x193.png 300w\" sizes=\"(max-width: 702px) 100vw, 702px\" \/><\/a><\/p>\n<p>Did you also find an Install Path Ltd? Do you remember the download link? Please post it in the comments below and I&#8217;ll upload it to <a title=\"How To Scan a File for Viruses with VirusTotal\" href=\"http:\/\/www.freefixer.com\/b\/scan-files-for-viruses-virustotal\/\">VirusTotal<\/a> to see if that one is also detected.<\/p>\n<p>Thank you for reading.<\/p>\n<p><strong>Update 2015-03-03<\/strong>: Found another <a href=\"http:\/\/www.freefixer.com\/library\/file\/MediaPlayer__6741_i1473973960_il50075.exe-169456\/\">Install Path file<\/a>. The detection was almost the same: 28%.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Hi there! Sorry for the silence for the last days. I&#8217;ve been having a few days off. \u00a0Anyway, I&#8217;m back on the blog again. Did you just download something to\u00a0your system digitally signed by Install Path Ltd? Then read on.. By examining the embedded certificate, we can see that Install Path Ltd is located in &hellip; <a href=\"https:\/\/www.freefixer.com\/b\/install-path-ltd-25-detection-rate-strictor-amonetize\/\" class=\"more-link\">Continue reading <span class=\"screen-reader-text\">Install Path Ltd &#8211; 25% Detection Rate &#8211; Strictor, Amonetize<\/span> <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[54],"tags":[126,134,252,306],"_links":{"self":[{"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/posts\/4058"}],"collection":[{"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/comments?post=4058"}],"version-history":[{"count":4,"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/posts\/4058\/revisions"}],"predecessor-version":[{"id":5063,"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/posts\/4058\/revisions\/5063"}],"wp:attachment":[{"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/media?parent=4058"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/categories?post=4058"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/tags?post=4058"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}