» Updater.exe
Overview
Analysis
File Details
Behaviors (1)
Programs (1)

Updater.exe

Updater

Ask.com

This is a component of the Ask.com toolbar, a browser extension that will modify the default web browser's search provider, home page and various other settings. The application Updater.exe by Ask.com has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. It is set to automatically execute when any user logs into Windows (through the local user run registry setting) with the name ‘ApnUpdater’. This file is typically installed with the program Ask Toolbar by Ask.com which is a potentially unwanted software program.

File name:

Updater.exe

Publisher:

Ask (signed by Ask.com)

Product:

Updater

Description:

Ask Updater

Version:

1.4.457710

MD5:

926360ff50f2f2b63ef57905330bf574

SHA-1:

f3ee04ddfdc6debee790fe9766834f4f73941dec

SHA-256:

0baa929ffcbf79854105ddf04ec3a1ff17d4940e55cc52773f12d16122db1459

Scanner detections:

1 / 68

Status:

Potentially unwanted

Note:

Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Analysis date:

11/4/2024 5:13:22 PM UTC (today)

Scan engine

Detection

Engine version

Reason Heuristics

PUP.Ask (M)

17.3.5.3

File size:

1.6 MB (1,648,056 bytes)

Product version:

1.4.457710

Original file name:

Updater.exe

File type:

Executable application (Win32 EXE)

Language:

English (United States)

Common path:

C:\Program Files\ask.com\updater\updater.exe

Digital Signature

Signed by:

Ask.com

Authority:

VeriSign, Inc.

Valid from:

1/22/2014 7:00:00 PM

Valid to:

6/18/2014 7:59:59 PM

Subject:

CN=Ask.com, OU=Distribution, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=Ask.com, L=Oakland, S=California, C=US

Issuer:

CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:

0E92120309E5E292CD4FFE132C48D3D8

File PE Metadata

Compilation timestamp:

1/31/2014 2:13:09 PM

OS version:

5.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

9.0

Entry address:

0xAF3D1

Entry point:

E8, F3, DA, 00, 00, E9, 79, FE, FF, FF, CC, CC, CC, CC, CC, 55, 8B, EC, 57, 56, 8B, 75, 0C, 8B, 4D, 10, 8B, 7D, 08, 8B, C1, 8B, D1, 03, C6, 3B, FE, 76, 08, 3B, F8, 0F, 82, A4, 01, 00, 00, 81, F9, 00, 01, 00, 00, 72, 1F, 83, 3D, C0, D7, 4F, 00, 00, 74, 16, 57, 56, 83, E7, 0F, 83, E6, 0F, 3B, FE, 5E, 5F, 75, 08, 5E, 5F, 5D, E9, BE, 82, 00, 00, F7, C7, 03, 00, 00, 00, 75, 15, C1, E9, 02, 83, E2, 03, 83, F9, 08, 72, 2A, F3, A5, FF, 24, 95, 54, F5, 4A, 00, 90, 8B, C7, BA, 03, 00, 00, 00, 83, E9, 04, 72, 0C, 83... 
[+]

Entropy:

6.1064

Code size:

817 KB (836,608 bytes)

Startup File (All Users Run)

Registry location:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:

ApnUpdater

Command:

"C:\Program Files\ask.com\updater\updater.exe"

The file Updater.exe has been discovered within the following program.

Ask Toolbar by Ask.com

The Ask Toolbar is a web-browser add-on that can appear as an extra bar added to the browser's window and/or menu. It is often installed (sometimes without warning) during the installation of other software. Ask.

help.ask.com/link/portal/30015/30018/Article/1/How-do-I-remove-the-Ask-com-Toolbar

81% remove it

Remove Updater.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.