» optimizerproinstaller.exe
Overview
Analysis
File Details
Downloads (1)
Network (3)

optimizerproinstaller.exe

Optimizer Pro

PC Utilities Software Limited

Part of the Optimizer Pro / Driver 'PC optimizer' product lines marketed by Adsology and distributed through various bundled software (PPI and commission) channels. The application optimizerproinstaller.exe, “Fix, clean, optimize your PC!” by PC Utilities Software Limited has been detected as a potentially unwanted program by 21 anti-malware scanners. This is a setup and installation application and has been known to bundle potentially unwanted software. It is also typically executed from the user's temporary directory. The file has been seen being downloaded from dl.softservers.net. While running, it connects to the Internet address dl.softservers.net on port 80 using the HTTP protocol.

File name:

Publisher:

PC Utilities Pro (signed by PC Utilities Software Limited)

Product:

Optimizer Pro

Description:

Fix, clean, optimize your PC!

Version:

3.0.1.0

MD5:

1ca73c8a62421925c7d27719d2a39c58

SHA-1:

a25e211cf4cbeb58901b63d6cad42c33916c4a9a

SHA-256:

3bc627ee8160139b4f3b117b0c623f27896216fe885ffc607e2a04dd7431517a

Scanner detections:

21 / 68

Status:

Potentially unwanted

Explanation:

Installed with the Optimizer Pro software which is bundled by 3rd-party monetization programs.

Analysis date:

4/26/2024 11:36:15 AM UTC (today)

Scan engine

Detection

Engine version

Agnitum Outpost

Trojan.Agent

7.1.1

AVG

MalSign.Generic

2015.0.3389

Bkav FE

W32.Clod4c3.Trojan

1.3.0.4613

Boost by Reason

Optional.PCUtilities.V

188838

Comodo Security

UnclassifiedMalware

16837

Dr.Web

riskware program Program.Unwanted.29

9.0.1.0220

ESET NOD32

Win32/SpeedingUpMyPC (variant)

7.8899

Fortinet FortiGate

W32/SpeedingUpMyPC.B

8/8/2014

F-Prot

W32/OptimizePro.A.gen

v6.4.7.1.166

G Data

Win32.Application.OptimizerPro

14.8.24

herdProtect (fuzzy)

variant of optimizerpro.exe (PUP)

2013.12.28.16

IKARUS anti.virus

PUA.SpeedingUpMyPC

t3scan.1.6.1.0

K7 AntiVirus

Trojan

13.176.11510

Kaspersky

not-a-virus:RiskTool.Win32.Agent

14.0.0.3439

Malwarebytes

PUP.Optional.OptimizePro.A

v2013.12.23.02

McAfee

Artemis!D84B92824CEE

5600.7271

NANO AntiVirus

Riskware.Win32.Unwanted.ccmwkx

0.26.0.55366

Qihoo 360 Security

Malware.QVM06.Gen

1.0.0.1015

Reason Heuristics

PUP.PCUtilities.V

14.8.8.3

Trend Micro House Call

TROJ_GEN.F47V0809

7.2.357

VIPRE Antivirus

Trojan.Win32.Generic

25654

File size:

3.8 MB (4,024,232 bytes)

Product version:

3.0.1.0

PC Utilities Pro

Trademarks:

PC Utilities Pro

Original file name:

OptimizerPro

File type:

Executable application (Win32 EXE)

Common path:

C:\users\{user}\appdata\local\temp\{random}.tmp\addons\optimizerproinstaller.exe

Digital Signature

Signed by:

PC Utilities Software Limited

Authority:

GoDaddy.com, Inc.

Valid from:

4/5/2013 9:29:35 PM

Valid to:

4/3/2015 5:23:14 PM

Subject:

CN=PC Utilities Software Limited, O=PC Utilities Software Limited, L=London, S=UK, C=GB

Issuer:

SERIALNUMBER=07969287, CN=Go Daddy Secure Certification Authority, OU=http://certificates.godaddy.com/repository, O="GoDaddy.com, Inc.", L=Scottsdale, S=Arizona, C=US

Serial number:

2B239BABC97410

File PE Metadata

Compilation timestamp:

6/20/1992 1:22:17 AM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.25

CTPH (ssdeep):

98304:WOh0m6ZKJNLF1pxmY4XmRXPk8O9dSy/8C4n:3h0mNLFJD4XmRXs/94o4n

Entry address:

0x13768

Entry point:

55, 8B, EC, 83, C4, F0, B8, D0, 36, 41, 00, E8, 94, 24, FF, FF, E8, FF, 05, FF, FF, 8D, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00... 
[+]

Entropy:

7.9829

Developed / compiled with:

Microsoft Visual C++

Code size:

74 KB (75,776 bytes)

The file optimizerproinstaller.exe has been seen being distributed by the following URL.

http://dl.softservers.net/.../optimizerpro.exe

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):

Connects to domore.pcutilitiespro.revenuewire.net (199.83.128.157:80)

http://domore.pcutilitiespro.revenuewire.net/optimizerpro/register?408165-US-002_D7D0704A-070B-8070-BD80-437042E5

TCP (HTTP):

Connects to dl.softservers.net (198.20.70.67:80)

TCP (HTTP):

Connects to bi.softservers.net (184.154.38.36:80)

Remove optimizerproinstaller.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.