{"id":5157,"date":"2015-03-07T00:57:43","date_gmt":"2015-03-07T00:57:43","guid":{"rendered":"http:\/\/www.freefixer.com\/b\/?p=5157"},"modified":"2018-05-29T11:58:37","modified_gmt":"2018-05-29T11:58:37","slug":"jelbrus-llc-pirate-bay-anti-virus-detection-strictor-techsnab-hfsadware","status":"publish","type":"post","link":"https:\/\/www.freefixer.com\/b\/jelbrus-llc-pirate-bay-anti-virus-detection-strictor-techsnab-hfsadware\/","title":{"rendered":"Jelbrus LLC from The Pirate Bay – 23% Anti-Virus Detection Rate – Strictor \/ Techsnab \/ HfsAdware"},"content":{"rendered":"

Welcome! Saturday night post this time \ud83d\ude09 Just wanted to let you know about a publisher called Jelbrus LLC<\/strong>. You may run into this download if you are visiting sites such as The Pirate Bay<\/a>.<\/p>\n

\"Jelbrus<\/a><\/p>\n

Information about a digital signature and the certificate can also be found under the Digital Signature tab. According to the embedded certificate we can see that Jelbrus LLC seems to be located in Moscow<\/strong> in Russia<\/strong> and that the certificate is issued by Thawte Code Signing CA – G2.<\/p>\n

\"Jelbrus<\/a><\/p>\n

So what’s up with\u00a0Jelbrus?\u00a0The file I found is, named\u00a0Breaking_Bad_Season_1_Complete_720p.BRrip.Sujaidr_(pimprg)_.exe<\/a>, so you might get the impression that this is a download for the famous TV-Series called Breaking Bad<\/a>. It’s not.<\/p>\n

Here’s how the Jelbrus installer looks like if you run the file:<\/p>\n

\"Jelbrus<\/a><\/p>\n

When clicking the Next button a bunch settings are changed and some files are added on your computer. Here’s the interesting stuff from a FreeFixer<\/a> log:<\/p>\n

FreeFixer v1.13 log\r\nhttp:\/\/www.freefixer.com\/\r\n\r\nScheduled tasks (39 whitelisted)\r\n================================\r\nGreat Performance Ultimate, C:\\Program Files (x86)\\PrivateVPN\\gpup.exe , signer: [unsigned]\r\nJelbrus Secure Web Task, C:\\Program Files (x86)\\Jelbrus Secure Web\\jswtask.exe , signer: [unsigned]\r\nMalware Cleaner, C:\\Users\\honeypotter\\AppData\\Roaming\\1265.tmp.exe (file is missing)\r\n\r\nProcesses (42 whitelisted)\r\n==========================\r\nC:\\Windows\\mlwps.exe, signer: [unsigned]\r\nC:\\Users\\HONEYP~1\\AppData\\Local\\Temp\\92.tmp.exe, signer: [unsigned]\r\nC:\\Program Files (x86)\\Jelbrus Secure Web\\privoxy.exe, signer: [unsigned]\r\n\r\nServices (47 whitelisted)\r\n=========================\r\nLive Malware Protection, Live Malware Protection, c:\\windows\\mlwps.exe, signer: [unsigned]\r\nPrivoxyService, Privoxy (PrivoxyService), c:\\program files (x86)\\jelbrus secure web\\privoxy.exe, signer: [unsigned]\r\n\r\nRecently created\/modified files\r\n===============================\r\n20 minutes, c:\\Program Files (x86)\\Jelbrus Secure Web\\mgwz.dll, signer: [unsigned]\r\n20 minutes, c:\\Program Files (x86)\\Jelbrus Secure Web\\privoxy.exe, signer: [unsigned]\r\n20 minutes, c:\\Program Files (x86)\\Jelbrus Secure Web\\jsie.dll, signer: [unsigned]\r\n20 minutes, c:\\Program Files (x86)\\Jelbrus Secure Web\\jswff.exe, signer: Jelbrus LLC [valid]\r\n20 minutes, c:\\Program Files (x86)\\Jelbrus Secure Web\\jsweb64.dll, signer: [unsigned]\r\n20 minutes, c:\\Program Files (x86)\\Jelbrus Secure Web\\jswchromium64.exe, signer: [unsigned]\r\n20 minutes, c:\\Program Files (x86)\\Jelbrus Secure Web\\jsweb.dll, signer: [unsigned]\r\n20 minutes, c:\\Program Files (x86)\\Jelbrus Secure Web\\jswchromium.exe, signer: [unsigned]\r\n20 minutes, c:\\Program Files (x86)\\Jelbrus Secure Web\\jswtask.exe, signer: [unsigned]\r\n20 minutes, c:\\Users\\honeypotter\\AppData\\Local\\Temp\\92.tmp.exe, signer: [unsigned]\r\n21 minutes, c:\\Program Files (x86)\\PrivateVPN\\tasks.dll, signer: [unsigned]\r\n21 minutes, c:\\Users\\honeypotter\\AppData\\Local\\Temp\\tasks.dll, signer: [unsigned]\r\n21 minutes, c:\\Program Files (x86)\\PrivateVPN\\gpup.exe, signer: [unsigned]\r\n21 minutes, c:\\Users\\honeypotter\\AppData\\Local\\Temp\\580C.tmp.exe, signer: [unsigned]\r\n23 minutes, c:\\Users\\honeypotter\\AppData\\Local\\Temp\\1716.tmp.exe, signer: [unsigned]\r\n24 minutes, c:\\Users\\honeypotter\\AppData\\Local\\Temp\\6E23.tmp.exe, signer: [unsigned]\r\n\r\nLAN Proxy Settings\r\n==================\r\n*=127.0.0.1:8118<\/pre>\n
You will also see advertisements while browsing the web labelled\u00a0“Ad by CouponDropDown<\/strong>“. Here’s the\u00a0“Ad by CouponDropDown” ads on Google:<\/p>\n
\"Ad<\/a><\/p>\n
So what does the anti-virus scanners at VirusTotal<\/a> say about Jelbrus’ “Breaking Bad” file? The detection rate is 13\/57<\/strong>. Gen:Variant.Strictor.75172, Jelbrus.3C0, Adware\/Techsnab.9058, Jelbrus LLC (fs), W32.HfsAdware.307F and Gen:Variant.Strictor.75172 were some of the detection names.<\/p>\n
\"Jelbrus<\/a><\/p>\n
Did you also find an Jelbrus LLC? Did you also find it at The Pirate Bay?<\/p>\n
Thank you for reading.<\/p>\n","protected":false},"excerpt":{"rendered":"
Welcome! Saturday night post this time \ud83d\ude09 Just wanted to let you know about a publisher called Jelbrus LLC. You may run into this download if you are visiting sites such as The Pirate Bay. Information about a digital signature and the certificate can also be found under the Digital Signature tab. According to the … Continue reading Jelbrus LLC from The Pirate Bay – 23% Anti-Virus Detection Rate – Strictor \/ Techsnab \/ HfsAdware<\/span> →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[3,54],"tags":[509,506,507,448,447,306,508],"_links":{"self":[{"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/posts\/5157"}],"collection":[{"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/comments?post=5157"}],"version-history":[{"count":4,"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/posts\/5157\/revisions"}],"predecessor-version":[{"id":5166,"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/posts\/5157\/revisions\/5166"}],"wp:attachment":[{"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/media?parent=5157"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/categories?post=5157"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/tags?post=5157"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}