home

guardbackgroundservice.exe

Fedorov Paul

The is the installer for the WebPick InstalleRex download manager which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed without consent. The application guardbackgroundservice.exe by Fedorov Paul has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. It runs as a separate (within the context of its own process) windows Service named “Active background guard service”.
Publisher:
Fedorov Paul  (signed and verified)

MD5:
d3699f603645debf545c41903031c2cc

SHA-1:
ab53afa1c6a89cfab9117ffb2f18613f9f23fafb

SHA-256:
b1ee12467cea503df2319c358c7ae4c7cfbb3d8c025c2c8b336f30cd5422a874

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Analysis date:
4/26/2024 11:53:17 PM UTC  (a few moments ago)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.Webpick.FedorovPaul (M)
16.2.4.17

File size:
761.5 KB (779,824 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\Program Files\gigabase\guard\guardbackgroundservice.exe

Digital Signature
Signed by:
Fedorov Paul

Authority:
Thawte, Inc.

Valid from:
8/28/2012 4:00:00 AM

Valid to:
8/29/2013 3:59:59 AM

Subject:
CN=Fedorov Paul, OU=Individual Developer, O=No Organization Affiliation, L=Saint-Petersburg, S=Saint-Petersburg, C=RU

Issuer:
CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:
702D4055EE5CC734192DCBDFFE7AE8E1

File PE Metadata
Compilation timestamp:
4/22/2013 11:38:56 AM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
12288:2jsNHIyTxMJ28Uq4oPRN2niuPr4YAiZaR9I7DpZPGdwgEYEJc:2jsNoyTmEYPD2iuPrJsRuDpZPTVJc

Entry address:
0x7C41C

Entry point:
E8, 7C, B0, 00, 00, E9, 79, FE, FF, FF, 8B, FF, 55, 8B, EC, 6A, 0A, 6A, 00, FF, 75, 08, E8, 6B, B3, 00, 00, 83, C4, 0C, 5D, C3, 8B, FF, 55, 8B, EC, 5D, E9, DF, FF, FF, FF, 8B, FF, 55, 8B, EC, 8B, 45, 08, 56, 8B, F1, C6, 46, 0C, 00, 85, C0, 75, 63, E8, ED, 93, 00, 00, 89, 46, 08, 8B, 48, 6C, 89, 0E, 8B, 48, 68, 89, 4E, 04, 8B, 0E, 3B, 0D, 00, AA, 4A, 00, 74, 12, 8B, 0D, 18, A9, 4A, 00, 85, 48, 70, 75, 07, E8, 45, 19, 00, 00, 89, 06, 8B, 46, 04, 3B, 05, 48, AE, 4A, 00, 74, 16, 8B, 46, 08, 8B, 0D, 18, A9, 4A...
 
[+]

Code size:
601.5 KB (615,936 bytes)

Service
Display name:
Active background guard service

Type:
Win32OwnProcess


Remove guardbackgroundservice.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.