home

fwtunerso.exe

Free Windows Tuner

FreeWindowsTuner.com

The application fwtunerso.exe, “Free Windows Tuner Setup ” has been detected as a potentially unwanted program by 2 anti-malware scanners. The program is a setup application that uses the Inno Setup installer, however the file is not signed with an authenticode signature from a trusted source. The installer uses the InstallMonetizer platform which will donwload and install adware toolbars and other potentially unwanted software offers during setup. The file has been seen being downloaded from www.freewindowstuner.com.
Publisher:
FreeWindowsTuner.com

Product:
Free Windows Tuner

Description:
Free Windows Tuner Setup

Version:
2.0.0.6

MD5:
cb365d88ccac500f1b8cfef68b05fad3

SHA-1:
5cbe168351065ff3eef0994304a0af2dcc43bcb3

SHA-256:
618f8e6a1b1541178ebcf8d7547a9ebb8e62a9d42a71f8802e3072c640b15980

Scanner detections:
2 / 68

Status:
Potentially unwanted

Explanation:
Uses the InstallMonetizer distribution platform to bundle adware.

Analysis date:
11/25/2024 12:48:04 AM UTC  (today)

Scan engine
Detection
Engine version

ESET NOD32
Win32/InstallMonetizer.AF
8.7771

Reason Heuristics
PUP.InstallMonetizer.Bundle (M)
16.3.10.15

File size:
5.4 MB (5,690,266 bytes)

Product version:
2.0.0.6

Copyright:
© 2012 FreeWindowsTuner.com

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\fwtunerso.exe

File PE Metadata
Compilation timestamp:
12/20/2011 9:16:50 AM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
98304:vmPE3bV/ljX4w2PPJRphJ2nHvHrik4CK70XPZp5nNc94WbmLIFRqj:vIErXjP2HzpLSHPrT40fZzNosqqj

Entry address:
0x16478

Entry point:
55, 8B, EC, 83, C4, A4, 53, 56, 57, 33, C0, 89, 45, C4, 89, 45, C0, 89, 45, A4, 89, 45, D0, 89, 45, C8, 89, 45, CC, 89, 45, D4, 89, 45, D8, 89, 45, EC, B8, B0, 52, 41, 00, E8, AC, 03, FF, FF, 33, C0, 55, 68, 45, 6B, 41, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 01, 6B, 41, 00, 64, FF, 32, 64, 89, 22, A1, 48, AB, 41, 00, E8, 4E, EC, FF, FF, E8, F5, E7, FF, FF, 8D, 55, EC, 33, C0, E8, 7F, 84, FF, FF, 8B, 55, EC, B8, AC, D6, 41, 00, E8, E2, E9, FE, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, AC, D6, 41, 00, B2, 01...
 
[+]

Entropy:
7.9940

Developed / compiled with:
Microsoft Visual C++

Code size:
84 KB (86,016 bytes)

The file fwtunerso.exe has been seen being distributed by the following URL.

http://www.freewindowstuner.com/fwtunerSO.exe

Remove fwtunerso.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.