home

ccleaner_setup.exe

Pro Installer

Covus Pro GmbH

The application ccleaner_setup.exe by Covus Pro GmbH has been detected as adware by 3 anti-malware scanners. The program is a setup application that uses the Covus installer. The installer is marketed through download protals and search ads as the free Piriform CCleaner but will also install additional software offers which include adware, PUPs and browser toolbars. It is also typically executed from an Internet Explorer cache folder.
Publisher:
covus pro  (signed by Covus Pro GmbH)

Product:
Pro Installer

Version:
4.3.2.0

MD5:
81fbf036532e9c33999171efdc915b9f

SHA-1:
455251f7e9bc79b278ee1025f6b115cc898f19d6

SHA-256:
c58e7ae1880aa2f27df3dbbb293fbcf838d58d833ab5669a342e771a09d3c7da

Scanner detections:
3 / 68

Status:
Adware

Explanation:
Includes bundled offers in the installer/download manager that include adware components such as Best-markit, and Search Protect (ClientConnect).

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
12/25/2024 6:35:11 PM UTC  (today)

Scan engine
Detection
Engine version

AVG
Generic
2015.0.3384

herdProtect (fuzzy)
variant of minecraft_setup.exe (Adware)
2014.10.22.6

Reason Heuristics
PUP.Installer.CovusProGmbH.O
14.8.12.13

File size:
561.5 KB (575,016 bytes)

Product version:
4.3.2.0

Copyright:
Copyright © 2014

Original file name:
Multiproduct.exe

File type:
Executable application (Win32 EXE)

Bundler/Installer:
Covus

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\ccleaner_setup.exe

Digital Signature
Signed by:
Covus Pro GmbH

Authority:
COMODO CA Limited

Valid from:
2/5/2014 1:00:00 AM

Valid to:
2/6/2015 12:59:59 AM

Subject:
CN=Covus Pro GmbH, O=Covus Pro GmbH, STREET=Schwedter Str. 263, L=Berlin, S=Berlin, PostalCode=10119, C=DE

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
61A79175C602D4C6B8D777D3A741B75A

File PE Metadata
Compilation timestamp:
8/7/2014 10:56:17 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
12288:Ng3G5FdI1pERXv0d61eFCAXjd9ELMu7rV:dFIEXvF4FCAb+MuvV

Entry address:
0x641AE

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 48, B8, 00, 00, 00, 00, 00, 00, 00, 00, 49, 39, 40, 08, 74, 0C, 48, B8, 00, 00, 00, 00, 00, 00, 00, 00, FF, E0, 48, B8, 00, 00, 00, 00, 00, 00, 00, 00, FF, E0, 55, 8B, EC, 8B, 45, 10...
 
[+]

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
392.5 KB (401,920 bytes)

Remove ccleaner_setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.