home

pclunst.exe

PC Cleaner Pro

PC Cleaner Inc.

The application pclunst.exe by PC Cleaner has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. This is a setup program which is used to install the application. This is the uninstaller utility registered in the Windows Control Panel for the program PC Cleaners by PC Cleaners. The file has been seen being downloaded from RevenueWire's affiliate distribution platform love2008.nwpc.revenuewire.net and multiple other hosts.
Publisher:
(c) PC Cleaners Inc  (signed by PC Cleaner Inc.)

Product:
PC Cleaner Pro

Version:
21.0.0.0

MD5:
0dc4c225cff5f47ecd4f1914ee173878

SHA-1:
ca247f70891ee3211b278aeba807c3ca277819a5

SHA-256:
ffa6cbf477c4fa4abe3d061e7fb5bd7e37cf06eb5614b0a63df11d796eb647fe

Scanner detections:
1 / 68

Status:
Potentially unwanted

Analysis date:
11/27/2024 8:28:19 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.PCCleaner.cPCClean.Meta (L)
16.6.10.14

File size:
4.3 MB (4,466,072 bytes)

Product version:
21.0.0.0

Copyright:
(c)2016 PC Cleaners Inc. All rights reserved.

Original file name:
PCInstaller.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\ProgramData\pclunst.exe

Digital Signature
Signed by:
PC Cleaner Inc.

Authority:
Symantec Corporation

Valid from:
8/10/2015 8:00:00 PM

Valid to:
8/10/2016 7:59:59 PM

Subject:
CN=PC Cleaner Inc., O=PC Cleaner Inc., L=Laguna Niguel, S=California, C=US

Issuer:
CN=Symantec Class 3 SHA256 Code Signing CA, OU=Symantec Trust Network, O=Symantec Corporation, C=US

Serial number:
3D4B99D267157B4AE7602BBCE79FE9DE

File PE Metadata
Compilation timestamp:
1/27/2016 2:10:25 PM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
98304:lUTVdgV6km5EMXFt0HT9pHp1Q5ABJsm2U0qopdG4JFv8EqljySkUcDIEEC44nuFT:6a7m5EAuPrsS+t2tluSk5D7EA/JHF/VW

Entry address:
0x907AA0

Entry point:
60, BE, 00, D0, 8C, 00, 8D, BE, 00, 40, B3, FF, 57, EB, 0B, 90, 8A, 06, 46, 88, 07, 47, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 72, ED, B8, 01, 00, 00, 00, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, 01, DB, 73, 0B, 75, 28, 8B, 1E, 83, EE, FC, 11, DB, 72, 1F, 48, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, EB, D4, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C9, EB, 52, 31, C9, 83, E8, 03, 72, 11, C1, E0, 08, 8A, 06, 46, 83, F0, FF, 74, 75, D1, F8, 89, C5, EB, 0B, 01, DB, 75, 07, 8B...
 
[+]

Entropy:
7.7955

Packer / compiler:
UPX v0.89.6 - v1.02 / v1.05 -v1.24

Code size:
4.2 MB (4,435,968 bytes)

Program Uninstaller
Program name:
PC Cleaners

Display publisher:
PC Cleaners

Uninstall string:
"C:\ProgramData\pclunst.exe" -removeit


The file pclunst.exe has been seen being distributed by the following 14 URLs.

http://love2008.nwpc.revenuewire.net/.../PCPro-English?367

http://love2008.nwpc.revenuewire.net/.../PCPro-English?processlibrary-IN-0-broad18139

http://love2008.nwpc.revenuewire.net/.../PCPro-English?2error240

http://love2008.nwpc.revenuewire.net/.../PCPro-English?697

http://love2008.nwpc.revenuewire.net/PCPRO-Private/.../?new_dll_005

http://love2008.nwpc.revenuewire.net/.../PCPro-English?770

http://love2008.nwpc.revenuewire.net/.../PCPro-English?processlibrary-DH-0-phrase174

http://love2008.nwpc.revenuewire.net/.../PCPro-English?clean133-sitelink01-clean

http://love2008.nwpc.revenuewire.net/.../PCPro-English?error3085

http://love2008.nwpc.revenuewire.net/.../PCPro-English?tasklist-0-broad2404

http://pc-cleaners.com/English-install.exe

http://www.nonabyte.net/.../download

http://love2008.nwpc.revenuewire.net/.../PCPro-English?E2new-6326

http://love2008.nwpc.revenuewire.net/.../PCPro-English?error916

Remove pclunst.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.