home

selectrebatesuninstall.exe

ShopAtHome.com

The application selectrebatesuninstall.exe by ShopAtHome.com has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. This is the uninstaller utility registered in the Windows Control Panel for the program ShopAtHome SelectRebates. This file is typically installed with the program ShopAtHome SelectRebates by Select Rebates which is a potentially unwanted software program.
Publisher:
ShopAtHome.com  (signed and verified)

Version:
5, 0, 3, 0

MD5:
a1d1fffc78360bf0b6c8d6969b7e35d9

SHA-1:
0b27a9937ca4437039a1c25b5a1854838931f3c7

SHA-256:
79015e9bcd1210d2c830e1ebd5ec90beb66362b52fd64a6a3f6386d60c651017

Scanner detections:
1 / 68

Status:
Potentially unwanted

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Analysis date:
4/25/2024 12:21:31 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.ShopAtHome (M)
16.1.5.22

File size:
277 KB (283,616 bytes)

Product version:
5, 0, 3, 0

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\Program Files\selectrebates\selectrebatesuninstall.exe

Digital Signature
Signed by:
ShopAtHome.com

Authority:
VeriSign, Inc.

Valid from:
5/27/2009 8:00:00 PM

Valid to:
6/22/2010 7:59:59 PM

Subject:
CN=ShopAtHome.com, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=ShopAtHome.com, L=Greenwood Village, S=Colorado, C=US

Issuer:
CN=VeriSign Class 3 Code Signing 2009-2 CA, OU=Terms of use at https://www.verisign.com/rpa (c)09, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
1A4D3B540302A2CE1A763E9D8769BBF8

File PE Metadata
Compilation timestamp:
1/28/2010 5:53:56 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
3072:s35rZPT6tZ9NpRbSE4y/xEJ/jBRmqq8cOjF36bSgk9tRGJfRj+:s35rZPTQZ5RH4y/xeNRfq8rlh9tIfV+

Entry address:
0xE94F

Entry point:
55, 8B, EC, 6A, FF, 68, E8, 0D, 41, 00, 68, D6, EA, 40, 00, 64, A1, 00, 00, 00, 00, 50, 64, 89, 25, 00, 00, 00, 00, 83, EC, 68, 53, 56, 57, 89, 65, E8, 33, DB, 89, 5D, FC, 6A, 02, FF, 15, BC, 03, 41, 00, 59, 83, 0D, A8, 73, 41, 00, FF, 83, 0D, AC, 73, 41, 00, FF, FF, 15, C0, 03, 41, 00, 8B, 0D, 9C, 73, 41, 00, 89, 08, FF, 15, C4, 03, 41, 00, 8B, 0D, 98, 73, 41, 00, 89, 08, A1, C8, 03, 41, 00, 8B, 00, A3, A4, 73, 41, 00, E8, 17, 01, 00, 00, 39, 1D, 80, 5E, 41, 00, 75, 0C, 68, D2, EA, 40, 00, FF, 15, CC, 03...
 
[+]

Entropy:
4.9491

Developed / compiled with:
Microsoft Visual C++ v6.0

Code size:
58 KB (59,392 bytes)

Program Uninstaller
Program name:
ShopAtHome SelectRebates

Uninstall string:
C:\Program Files (x86)\SelectRebates\SelectRebatesUninstall.exe


The file selectrebatesuninstall.exe has been discovered within the following program.

ShopAtHome SelectRebates  by Select Rebates
ShopAtHome SelectRebates is a potentially unwanted browser hijacker that runs in the web browser as a toolbar and web extension.
81% remove it
 
Powered by Should I Remove It?

Remove selectrebatesuninstall.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.