ccleaner.exe

Covus Pro GmbH

The application ccleaner.exe by Covus Pro GmbH has been detected as adware by 4 anti-malware scanners. The program is a setup application that uses the Covus installer. With this installer, users are expecting to download the free Piriform CCleaner but before that occurs they may be presented with additional offers, mostly potentially unwanted software or adware.
Remove ccleaner.exe - Powered by Reason Core Security
Publisher:
Covus Pro GmbH  (signed and verified)

MD5:
0b9a781ccf0914c45742075b87f38b06

SHA-1:
9e7ec5069fa34538806a22012394eaa5693f0b60

SHA-256:
c68a483166af09699e14f89abf5c264481dc4b02e3caf61725ce4c606e27aebf

Scanner detections:
4 / 68

Status:
Adware

Explanation:
Includes bundled offers in the installer/download manager that include adware components such as Best-markit, and Search Protect (ClientConnect).

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
12/11/2016 1:22:21 AM UTC  (today)

Scan engine
Detection
Engine version

ESET NOD32
Win32/DownloadGuide.A potentially unwanted application
7.0.302.0

F-Secure
Adware:W32/Buzzrin
11.2014-10-06_3

Reason Heuristics
PUP.CovusProGmbH.I
14.6.10.10

VIPRE Antivirus
Threat.4890059
30086

Remove ccleaner.exe - Powered by Reason Core Security
File size:
458.4 KB (469,368 bytes)

File type:
Executable application (Win32 EXE)

Bundler/Installer:
Covus

Language:
English (United States)

Common path:
C:\users\{user}\downloads\ccleaner.exe

Digital Signature
Signed by:

Authority:
VeriSign, Inc.

Valid from:
1/23/2014 1:00:00 AM

Valid to:
1/24/2016 12:59:59 AM

Subject:
CN=Covus Pro GmbH, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=Covus Pro GmbH, L=Berlin, S=Berlin, C=DE

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
249E4122D3206380E8C5DB9AFC085C73

File PE Metadata
Compilation timestamp:
6/6/2014 9:59:28 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
6144:VqiYD1rcPt3QC/8Y5LUjUJIDaM+zTlztEtuKGdk8yF6GH8VPflPraKm33Bo0WtCf:VYcPtTX5RYX+zZ4vuVX1Hh0WtC7uM1vb

Entry address:
0x1C994

Entry point:
E8, A0, 48, 00, 00, E9, 89, FE, FF, FF, CC, CC, 8B, 44, 24, 08, 8B, 4C, 24, 10, 0B, C8, 8B, 4C, 24, 0C, 75, 09, 8B, 44, 24, 04, F7, E1, C2, 10, 00, 53, F7, E1, 8B, D8, 8B, 44, 24, 08, F7, 64, 24, 14, 03, D8, 8B, 44, 24, 08, F7, E1, 03, D3, 5B, C2, 10, 00, 8B, FF, 55, 8B, EC, 83, EC, 20, 8B, 45, 08, 56, 57, 6A, 08, 59, BE, 0C, DE, 42, 00, 8D, 7D, E0, F3, A5, 89, 45, F8, 8B, 45, 0C, 5F, 89, 45, FC, 5E, 85, C0, 74, 0C, F6, 00, 08, 74, 07, C7, 45, F4, 00, 40, 99, 01, 8D, 45, F4, 50, FF, 75, F0, FF, 75, E4, FF...
 
[+]

Code size:
170.5 KB (174,592 bytes)

Remove ccleaner.exe - Powered by Reason Core Security