productsremovaltool.exe

Smartbar.Resources.ProductsRemovalTool

PINWID LTD

The application productsremovaltool.exe by PINWID has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. Additionally, the file is typically installed by a number of programs including SavePass Smartbar by Pinwid Ltd. and SavePass Smartbar Engine by PinWid Ltd., both potentially unwanted software.
Publisher:
PINWID LTD  (signed and verified)

Product:
Smartbar.Resources.ProductsRemovalTool

Version:
1.0.0.0

MD5:
d25841e264c86c17ec4b1e591de45b85

SHA-1:
38b310d6d7ab2c1368b74992d396b324a497ea71

SHA-256:
c0158a878b310833c91786e6c79e689576867c4629c7a507f31255ffaf28cd9e

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Analysis date:
3/20/2014 5:49:29 PM UTC  (eight months ago)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.PINWID.T
14.3.20.13

File size:
120 KB (122,912 bytes)

Product version:
1.0.0.0

Copyright:
Copyright © 2012

Original file name:
Smartbar.Resources.ProductsRemovalTool.exe

File type:
Executable application (Win32 EXE)

Language:
Language Neutral

Common path:
C:\users\user\appdata\local\smartbar\application\productsremovaltool.exe

Digital Signature
Signed by:

Authority:
COMODO CA Limited

Valid from:
2/4/2014 4:00:00 PM

Valid to:
2/5/2015 3:59:59 PM

Subject:
CN=PINWID LTD, O=PINWID LTD, STREET=14 Shenkar Arie, L=HERZLIYA, S=NA, PostalCode=46733, C=IL

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
00D9AC9FC9A1B1E8FD63013E3CCE7B0578

File PE Metadata
Compilation timestamp:
3/2/2014 4:21:07 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
1536:ogPRVqcC3pbFbYvvxUknnGmv/lF0YBh04yN4WwtPMFDq+Q5KnJ7XJhzGDsNb47r5:9ycChFsnpaYBh034WGMECLJhzWsHk3Z

Entry address:
0x1D74E

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Entropy:
7.7600

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
110 KB (112,640 bytes)

The file productsremovaltool.exe has been discovered within the following programs.

SavePass Smartbar  by Pinwid Ltd.
From the EULA: "The Toolbar interacts with your computer by: Displaying advertisements, including without limitation by inserting into web pages or displaying over parts of such web pages advertisements, banners or coupons that would not otherwise appear; Converting words on pages you view into hyperlinks that are linked to advertisements; Communicating with our servers to check for new offers, the placement of offers, the date and time you install and uninstall the Toolbar, and whether an updated version of the Toolbar is available; Monitoring and recording the domain name of each page you view, the advertisements that appear on these pages, and the advertisements that you click.
www.browse-search.com
82% remove it
SavePass Smartbar Engine  by PinWid Ltd.
This adware program injects advertisements with its affiliate ad providers in order to serve a number of ad types including banner, inline text links and popups.
80% remove it
 
Powered by Should I Remove It?

There are 10 known versions of productsremovaltool.exe.

6 / 68      (Adware)
productsremovaltool.exe  1.0.0.0  (9a202520b90b9e511fa9c76cad8719bf0b5c5a18)

6 / 68      (Adware)
productsremovaltool.exe  1.0.0.0  (0633e57ce810a59d07a956ca524a038dc0107b10)

6 / 68      (Adware)
productsremovaltool.exe  1.0.0.0  (3c8875ad0c06a6ff777da3b87284b61129c7e209)

6 / 68      (Adware)
productsremovaltool.exe  1.0.0.0  (ee7e0b9ffe3770c19e8fe12b6ad549d7e88416be)

6 / 68      (Adware)
productsremovaltool.exe  1.0.0.0  (90d812a1625281f946b7a895458bf2f348430cea)

5 / 68      (Adware)
productsremovaltool.exe  1.0.0.0  (525c0179b8e35b8a8d33329fd2a4d11dc10c2a98)

4 / 68      (Adware)
productsremovaltool.exe  1.0.0.0  (560c6e94bb6c0c06bf15d70fc75cf765bcfd6db9)

3 / 68      (Adware)
productsremovaltool.exe  1.0.0.0  (de61226b55f3b12ccaeb40449523e6417be1df93)

3 / 68      (Adware)
productsremovaltool.exe  1.0.0.0  (c40bc06b5708bcbf605e519f5e56b575070ec760)

3 / 68      (Adware)
productsremovaltool.exe  1.0.0.0  (c04c275e944f18f448e9d6144b433644ff85bb7b)

11 / 68    (Adware)
smartbarfirefoxremoteplugin_27.dll  (4daaf48aabce45e5033c7a5172ced0360e6eb2f2)

9 / 68      (Adware)
installer.exe  (2ecfac6c3fc4e13f894d89a3cfa89c57bb1039ce)

3 / 68      (Adware)
srpts.exe  (50c1ec642a5a5258c17db267c6ff3768449106cc)

3 / 68      (Adware)
srpt.dll  (65fcd4cb2f73a97e38c0a7e93fd45328a5e301e9)

2 / 68      (Adware)
Smartbar.Communication.NamedPipe.dll  (778f38ae4a151a337b6a846cd551dce2759cde0c)

2 / 68      (Adware)
Smartbar.Communication.dll  (0c756d33ed8662a26c11c862adfbcfb705a6928b)

3 / 68      (Adware)
srptc.dll  (8ddc81202b07814c5f01d582b8491b17149a12c3)

2 / 68      (Adware)
Smartbar.Common.dll  (53776c68d7f2bb104aa35585dab3d15cf6a0b208)

2 / 68      (Adware)
srptm.exe  (bd4dc01cc4472486b8c6ba87eb9a8eb2a991d708)

3 / 68      (Adware)
srut.dll  (559656c5c50d651482f0697368373652b1828394)

3 / 68      (Adware)
sppsm.dll  (c145eafae7afd3e087a726fdac42520952363021)

3 / 68      (Adware)
spusm.dll  (50afa9026144ed5316773e055f7a056f392b530d)

3 / 68      (Adware)
Smartbar.Resources.HistoryAndStatsWrapper.dll  (bd0f6d1e02f99c56d0a386a4eeffdf18dacb8952)

2 / 68      (Adware)
Smartbar.Personalization.Common.dll  (2254806f1e6bfe4030e5e63b342af4bbaff1a5e1)

2 / 68      (Adware)
Smartbar.Infrastructure.Utilities.dll  (da628bf41c53488a6146dc50aa94a0796a3c624f)

3 / 68      (Adware)
srbs.dll  (aeaa3beebed0f09e9c43a254665f4400dc04019b)

Detection Incidence by Country