» Updater.exe
Overview
Analysis
File Details
Behaviors (1)
Programs (3)

Updater.exe

Updater

Ask.com

This is a component of the Ask.com toolbar, a browser extension that will modify the default web browser's search provider, home page and various other settings. The application Updater.exe by Ask.com has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. It is set to automatically execute when any user logs into Windows (through the local user run registry setting) with the name ‘ApnUpdater’. Additionally, the file is typically installed by a number of programs including Ask Toolbar by Ask.com and Ask Toolbar Updater by Ask.com, both potentially unwanted software.

File name:

Updater.exe

Publisher:

Ask (signed by Ask.com)

Product:

Updater

Description:

Ask Updater

Version:

1.4.457710

MD5:

bc2d854bf70e6b65cf9f077f47c2d331

SHA-1:

bde743278301e4ee2c7e90763fefd28721b5c751

SHA-256:

bf444b01917e565a8904ac271b8334b5cf902c921effb6e45ccb822a2dd51fc3

Scanner detections:

1 / 68

Status:

Potentially unwanted

Note:

Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Analysis date:

11/4/2024 5:14:03 PM UTC (today)

Scan engine

Detection

Engine version

Reason Heuristics

PUP.Ask (M)

16.12.14.17

File size:

1.6 MB (1,648,056 bytes)

Product version:

1.4.457710

Original file name:

Updater.exe

File type:

Executable application (Win32 EXE)

Common path:

C:\Program Files\ask.com\updater\updater.exe

Digital Signature

Signed by:

Ask.com

Authority:

VeriSign, Inc.

Valid from:

1/23/2014 8:00:00 AM

Valid to:

6/19/2014 7:59:59 AM

Subject:

CN=Ask.com, OU=Distribution, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=Ask.com, L=Oakland, S=California, C=US

Issuer:

CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:

0E92120309E5E292CD4FFE132C48D3D8

File PE Metadata

Compilation timestamp:

2/1/2014 3:03:07 AM

OS version:

5.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

9.0

Entry address:

0xAF3D1

Entry point:

E8, F3, DA, 00, 00, E9, 79, FE, FF, FF, CC, CC, CC, CC, CC, 55, 8B, EC, 57, 56, 8B, 75, 0C, 8B, 4D, 10, 8B, 7D, 08, 8B, C1, 8B, D1, 03, C6, 3B, FE, 76, 08, 3B, F8, 0F, 82, A4, 01, 00, 00, 81, F9, 00, 01, 00, 00, 72, 1F, 83, 3D, C0, D7, 4F, 00, 00, 74, 16, 57, 56, 83, E7, 0F, 83, E6, 0F, 3B, FE, 5E, 5F, 75, 08, 5E, 5F, 5D, E9, BE, 82, 00, 00, F7, C7, 03, 00, 00, 00, 75, 15, C1, E9, 02, 83, E2, 03, 83, F9, 08, 72, 2A, F3, A5, FF, 24, 95, 54, F5, 4A, 00, 90, 8B, C7, BA, 03, 00, 00, 00, 83, E9, 04, 72, 0C, 83... 
[+]

Entropy:

6.1065

Code size:

817 KB (836,608 bytes)

Startup File (All Users Run)

Registry location:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:

ApnUpdater

Command:

"C:\Program Files\ask.com\updater\updater.exe"

The file Updater.exe has been discovered within the following programs.

Ask Toolbar by Ask.com

The Ask Toolbar is a web-browser add-on that can appear as an extra bar added to the browser's window and/or menu. It is often installed (sometimes without warning) during the installation of other software. Ask.

help.ask.com/link/portal/30015/30018/Article/1/How-do-I-remove-the-Ask-com-Toolbar

81% remove it

Ask Toolbar Updater by Ask.com

The Ask Toolbar Updater is designed to periodically (once a day) check for an install updates to the toolbar without the interaction of the user. The Ask Toolbar and other applications are increasingly being bundled with programs; most notably freeware.

75% remove it

Avira SearchFree Toolbar plus Web Protection Updater by Ask.com

Avira SearchFree Toolbar plus Web Protection Updater installs with the Ask.com internet browser toolbar and keeps it automatically updated. Avira SearchFree Toolbar gets installed through bundled software.

www.avira.com

74% remove it

Remove Updater.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.