PCFixTray.exe

PC Fix Speed

Crawler, LLC

The application PCFixTray.exe, “PC Fix Speed Tray” by Crawler has been detected as a potentially unwanted program by 12 anti-malware scanners. It is set to automatically execute when any user logs into Windows (through the local user run registry setting) with the name ‘PCFixSpeed’.
Remove PCFixTray.exe - Powered by Reason Core Security
Publisher:
Crawler.com  (signed by Crawler, LLC)

Product:
PC Fix Speed

Description:
PC Fix Speed Tray

Version:
1.2.0.14

MD5:
d3e708d52ef546933079ce902d922030

SHA-1:
ad17f471cff838df63d887df659cdfef2ebd310e

SHA-256:
968f6a93a18ac234d8a1a8790e74b68e6b0c4c6f2f54aa5cf1b05ce8a4cceac1

Scanner detections:
12 / 68

Status:
Potentially unwanted

Analysis date:
12/5/2016 3:36:59 AM UTC  (today)

Scan engine
Detection
Engine version

Baidu Antivirus
Adware.Win32.Crawler
4.0.3.1488

Boost by Reason
Optional.Startup.Crawler.J
188838

ByteHero BDV
Trojan-Downloader.win32.Agent.gen.123
6.10.2014.10

Dr.Web
riskware program Program.Unwanted.45
9.0.1.05190

Emsisoft Anti-Malware
Win32.Mamianune
8.14.06.10.02

McAfee
Artemis!605FDEBBCA19
5600.7045

McAfee Web Gateway
Artemis!605FDEBBCA19
7.7045

Reason Heuristics
PUP.Startup.Crawler.J
14.8.8.2

Sophos
PC Power Speed
4.98

Trend Micro House Call
TROJ_GEN.F47V0216
7.2.161

Vba32 AntiVirus
BScope.Trojan-Dropper.Injector
3.12.26.0

VIPRE Antivirus
Trojan.Win32.Generic
30956

Remove PCFixTray.exe - Powered by Reason Core Security
File size:
370.4 KB (379,240 bytes)

Product version:
1.2.0.14

Copyright:
© Crawler.com

Original file name:
PCFixTray.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\Program Files\pcfixspeed\pcfixtray.exe

Digital Signature
Signed by:

Authority:
VeriSign, Inc.

Valid from:
11/26/2013 4:00:00 PM

Valid to:
1/25/2017 3:59:59 PM

Subject:
CN="Crawler, LLC", OU=Digital ID Class 3 - Microsoft Software Validation v2, O="Crawler, LLC", L=Boca Raton, S=Florida, C=US

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
48E3A7F6CBA47D0C3FCD17CF81AB3F76

File PE Metadata
Compilation timestamp:
8/16/2013 1:32:15 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
6144:D1VVxP3bADBgF3GCeXR6C3tR8T7FzFc35BcFq9ZsYsv0IAFfWe:D/P38DBiQXRv3tR8T79Fc3sq9hsvt

Entry address:
0x45904

Entry point:
55, 8B, EC, 83, C4, F0, B8, B0, 40, 44, 00, E8, 9C, 12, FC, FF, E8, 9B, E5, FF, FF, E8, EA, ED, FB, FF, 8B, C0, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Entropy:
6.6366

Developed / compiled with:
Microsoft Visual C++

Code size:
272 KB (278,528 bytes)

Startup File (All Users Run)
Registry location:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
PCFixSpeed

Command:
"C:\Program Files\pcfixspeed\pcfixtray.exe" \startup


Remove PCFixTray.exe - Powered by Reason Core Security