PodoWeb - 35% Detection Rate *
Did you just find a download or a file on your computer that is digitally signed by PodoWeb? Some of the security products refers to the detected files as Adware.SwiftBrowse.CV and AdWare.SwiftBrowse. The detection rate for the PodoWeb files collected here is 35%. Please read on for more details.
You will probably notice PodoWeb when running the file. The publisher name is displayed as the "Verified publisher" in the UAC dialog as the screenshot shows:
You can also view the PodoWeb certificate with the following procedure:
- Open up Windows Explorer and locate the PodoWeb file
- Right-click the file and select Properties
- Click the Digital Signatures tab
- Click the View Certificate button
Here is a screencap of a file signed by PodoWeb:
As you can see in the screenshot above, Windows reports that "This digital signature is OK". This means that the file has been published by PodoWeb and that the file has not been tampered with.
If you click the View Certificate button shown in the screenshot above, you can see all the details of the certificate, such as when it was issued, who issued the certificate, how long it is valid, etc. You can also view the address for PodoWeb, such as the street name, city and country.
DigiCert Assured ID Code Signing CA-1 and VeriSign Class 3 Code Signing 2010 CA has issued the PodoWeb certificates. You can also examine the details of the issuer by clicking the View Certificate button shown in the screenshot above.
PodoWeb Files
These are the PodoWeb files I've gathered, thanks to the FreeFixer users.
Scanner and Detection Names
Here is the detection names for the PodoWeb files. I've grouped the detection names by each scanner engine. Thanks to VirusTotal for the scan results.
| Scanner | Detection Names |
|---|---|
| ALYac | Adware.SwiftBrowse.CH, Adware.SwiftBrowse.CV |
| AVG | Generic.33B, Generic.4CA, BrowseFox.F, Generic6.DAP, AdPlugin.CWT |
| AVware | Trojan.Win32.Generic!BT, Yontoo, Yontoo (fs) |
| Ad-Aware | Gen:Variant.Adware.SwiftBrowse.1, Adware.SwiftBrowse.CH, Adware.SwiftBrowse.CV |
| Agnitum | PUA.Yotoon!, Trojan.BPlug!, Riskware.Agent! |
| AhnLab-V3 | Trojan/Win64.SwiftBrowse, Adware/Win32.SwiftBrowse, Adware/Win32.BHO, Win-PUP/BrowseFox.Gen, PUP/Win32.BrowseFox |
| Antiy-AVL | GrayWare[AdWare:not-a-virus]/Win32.Kranet, GrayWare[NetTool:not-a-virus]/Win64.NetFilter.a, GrayWare[AdWare:not-a-virus]/Win32.Yotoon.bfm, GrayWare[AdWare:not-a-virus]/Win64.Agent |
| Avast | Win32:Adware-BYZ [PUP], MSIL:BrowseFox-AJ [PUP] |
| Avira | ADWARE/BrowseFox.Gen7, ADWARE/BrowseFox.Gen2 |
| Baidu-International | Adware.Win32.BrowseFox.BV, Adware.Win32.BrowseFox.BO, Adware.Win64.BrowseFox.bAQ, Adware.Win32.BrowseFox.V |
| BitDefender | Gen:Variant.Adware.SwiftBrowse.1, Adware.SwiftBrowse.CH, Adware.SwiftBrowse.CV |
| Bkav | W32.HfsAdware.9A29 |
| CAT-QuickHeal | AdWare.Yotoon.A5, PUA.Podoweb1.Gen |
| ClamAV | Win.Adware.Agent-22685, Win.Adware.Swiftbrowse-497, Win.Adware.Agent-41785 |
| Comodo | Application.Win32.BrowseFox.JM, Application.Win32.BrowseFox.B |
| Cyren | W32/S-ad054542!Eldorado |
| DrWeb | Trojan.BPlug.123, Trojan.BPlug.281, Trojan.BPlug.144, Tool.NetFilter.313, Trojan.BPlug.437, Trojan.Yontoo.1734 |
| ESET-NOD32 | Win32/BrowseFox.V, a variant of Win32/BrowseFox.O, a variant of Win64/BrowseFox.AQ, a variant of Win32/BrowseFox.V potentially unwanted |
| Emsisoft | Gen:Variant.Adware.SwiftBrowse.1 (B), Adware.SwiftBrowse.CH (B), Adware.SwiftBrowse.CV (B) |
| F-Prot | W64/A-59c9c70a!Eldorado, W32/A-de841313!Eldorado, W32/S-ad054542!Eldorado |
| F-Secure | Gen:Variant.Adware.SwiftBrowse.1, Adware.SwiftBrowse.CH, Adware.SwiftBrowse.CV |
| Fortinet | Riskware/BrowseFox |
| GData | Gen:Variant.Adware.SwiftBrowse.1, Adware.SwiftBrowse.CH, Adware.SwiftBrowse.CV |
| Ikarus | AdWare.SwiftBrowse, not-a-virus:AdWare.Kranet, PUA.BrowseFox |
| Jiangmin | AdWare/Yotoon.m, AdWare/Yotoon.l, AdWare/Yotoon.aq, AdWare/Yotoon.ap, AdWare/SwiftBrowse.ssl |
| K7AntiVirus | Adware ( 0040f9f21 ), Trojan ( 004af26b1 ), Adware ( 004b92811 ) |
| K7GW | Adware ( 004b92811 ) |
| Kaspersky | not-a-virus:AdWare.Win32.Yotoon.bfm |
| Malwarebytes | PUP.Optional.PodoWeb.A, PUP.Optional.SwiftBrowse, PUP.Optional.BrowseFox |
| McAfee | Artemis!965CA3FDA2D9, RDN/Generic.grp!hm, Artemis!E95839B0DB94, Artemis!ADB0FC8DCC1E, BrowseFox-FTR, BrowseFox-FXS |
| McAfee-GW-Edition | Artemis, Artemis!A288B792D14F, BrowseFox-FTR, BrowseFox-FXS |
| MicroWorld-eScan | Gen:Variant.Adware.SwiftBrowse.1, Adware.SwiftBrowse.CH, Adware.SwiftBrowse.CV |
| NANO-Antivirus | Riskware.Win32.Kranet.dgiwfc, Trojan.Win32.BPlug.dfogbn, Trojan.Win32.Yontoo.dpmcsm |
| Panda | Trj/CI.A |
| Qihoo-360 | Win32/Virus.Adware.708, HEUR/QVM30.1.Malware.Gen, HEUR/QVM10.1.Malware.Gen |
| SUPERAntiSpyware | Adware.SwiftBrowse |
| Sophos | Generic PUA PK, Generic PUA KI, Browse Fox |
| Symantec | Yontoo.C, WS.Reputation.1, Yontoo |
| Tencent | Win32.Trojan.Falsesign.Hssi, Win32.Trojan.Falsesign.Akou, Win32.Trojan.Falsesign.Syrp, Win32.Trojan.Falsesign.Edxr, Win32.Trojan.Falsesign.Htct, Win32.Trojan.Falsesign.Hqvl, Win32.Trojan.Falsesign.Pgmp |
| TrendMicro | HS_BROWSEFOX.SM |
| TrendMicro-HouseCall | Suspicious_GEN.F47V0819, Suspicious_GEN.F47V1029, HS_BROWSEFOX.SM |
| VBA32 | AdWare.Kranet, AdWare.Win64.Yotoon, AdWare.Yotoon, AdWare.SwiftBrowse |
| VIPRE | Trojan.Win32.Generic!BT, Yontoo, Yontoo (fs) |
| Zillya | Adware.Yotoon.Win64.3, Adware.Kranet.Win32.476, Adware.Yotoon.Win64.7, Adware.Yotoon.Win64.14, Adware.Agent.Win32.52012 |
| nProtect | Adware.SwiftBrowse.CH, Trojan-Clicker/W32.Yotoon.123632, Adware.SwiftBrowse.CV |
* How the Detection Percentage is Calculated
The detection percentage is based on that I've collected 714 scan reports for the PodoWeb files. 250 of these scan results came up with some sort of detection. You can review the full details of the scan reports by examining the files listed above.
Analysis Details
The analysis is based on certificates with the following serial numbers:
- 0a93446d6247875e905539f949588c94
- 00d53df9c14bcaa20e79f402aa9dd4f5
Comments
I liked your review of PodoWeb’s detection rate and how its files are classified by various security products. It’s concerning to see a 35% detection rate for these files, which may indicate potential risks for users. As we become more dependent on digital platforms, it's essential to stay aware of such threats. I was looking for more ideas on cybersecurity and related topics for my college studies, and was recommended to look
https://www.linkedin.com/feed/update/urn:li:activity:7215309899088474113 for additional resources. Staying informed is crucial in today’s tech-driven world.
# 3 Oct 2024, 8:24
Henry Gilbert writes