home

uninstalltoolwizcare.exe

ToolWiz Care

XII CNC Inc.

This is a setup program which is used to install the application. This is the uninstaller utility registered in the Windows Control Panel for the program Toolwiz Care by ToolWiz Care. This file is installed with the program Toolwiz Care. The file has been seen being downloaded from bcs.duapp.com and multiple other hosts.
Publisher:
ToolWiz  (signed by XII CNC Inc.)

Product:
ToolWiz Care

Version:
3.1.0.4000

MD5:
76acff4c47285ab5bd2941b6f4a2004d

SHA-1:
fde7ae797392f9b25cea3f52c599deec9d7af1b4

SHA-256:
51bae46b1bdbf0595efb1f39fbb6be54f74c01429600e34e46b423c5459d2ec0

Scanner detections:
1 / 68

Status:
Clean  (1 probable false positive detection)

Explanation:
This is mosty likely a false positive detection, the file is probably clean.

Analysis date:
12/26/2024 8:43:01 PM UTC  (today)

Scan engine
Detection
Engine version

Rising Antivirus
PE:Trojan.Agent!6.670
23.00.65.14129

File size:
7.3 MB (7,632,640 bytes)

Product version:
2.0

Copyright:
Copyright(c) 2013 by ToolWiz.com

Trademarks:
ToolWiz

Original file name:
Setup.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\Documents and Settings\{user}\Application data\toolwizcarefree\uninstalltoolwizcare.exe

Digital Signature
Signed by:
XII CNC Inc.

Authority:
VeriSign, Inc.

Valid from:
8/29/2012 2:00:00 AM

Valid to:
9/29/2013 1:59:59 AM

Subject:
CN=XII CNC Inc., OU=Digital ID Class 3 - Microsoft Software Validation v2, O=XII CNC Inc., L=Anyang-si, S=Gyunggi-do, C=KR

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
5AE657C73341F9A5D7BDDD336C543E67

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
196608:mqv1nUGk0RfcKvm7nDkKUMrDkHJr0J1Xc4VmFI:mY1U8RUem7Dz3Ul0n9

Entry address:
0xFE0001

Entry point:
60, E9, 3D, 04, 00, 00, 4B, 8B, F8, F8, A3, 44, FC, 43, 93, 96, B8, F8, A0, 72, D7, 65, 73, 90, B8, F8, 20, 12, 00, B1, E7, AF, FC, 71, 3E, 53, B5, BC, A3, A0, 79, 9E, A0, AF, FC, 3F, 26, 9C, C5, BC, A3, AF, FC, F8, A3, 22, 79, FC, E9, EB, FC, A8, 5C, 3A, FC, B3, E7, AF, 75, 7D, A3, E5, B8, F8, 28, 57, 71, 65, B2, E5, B8, F8, F0, FF, 03, 6D, 5F, E5, B8, F8, 2A, 2A, 00, C7, E7, AF, 71, 65, BD, E5, B8, F8, F0, F8, 03, 6D, 5F, E5, B8, F8, 2A, 2A, FC, B8, E7, AF, 71, 7D, 16, 96, B8, F8, 5C, 4F, E0, 90, B6, AF...
 
[+]

Packer / compiler:
ASPack v2.11

Code size:
1.3 MB (1,400,320 bytes)

Program Uninstaller
Program name:
Toolwiz Care

Display publisher:
ToolWiz Care

Display version:
3.1.0.4000

Uninstall string:
"C:\Program Files (x86)\ToolwizCareFree\UninstallToolwizCare.exe" /REMOVE


The file uninstalltoolwizcare.exe has been discovered within the following program.

Toolwiz Care  by ToolWiz
Publisher's description - “ToolWiz Care is a set of free-of-charge tools designed to speed up your PC and give your system a full range of care.”
www.Toolwiz.com
4% remove it
 
Powered by Should I Remove It?

The file uninstalltoolwizcare.exe has been seen being distributed by the following 2 URLs.

http://bcs.duapp.com/btowssoft/.../Setup.exe

http://www.majorgeeks.com/index.php?ct=files&action=download&

Scan uninstalltoolwizcare.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.