home

setsearchm.exe

SetSearch

Prof-IT

The application setsearchm.exe by Prof-IT has been detected as adware by 19 anti-malware scanners.
Publisher:
Prof-IT  (signed and verified)

Product:
SetSearch

Version:
1.0.0.61

MD5:
cd6a4ac2f608b46657a178f5d2ab6027

SHA-1:
b71c071a6e7222d8a65309e4eb864a2cbc6453a4

SHA-256:
6cc68d2c0915cd0add7a0b317e4f6c7d5ef626cee0cb4dc6f706388421214b1b

Scanner detections:
19 / 68

Status:
Adware

Analysis date:
7/30/2025 2:50:44 PM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Trojan.GenericKD.2260606
675

Avira AntiVirus
PUA/LoadMoney.qoabb
3.6.1.96

avast!
Win32:Agent-AYBN [PUP]
2014.9-150331

AVG
Win32/DH{gRKBEw8uE2V8gQ4gJCI}
2016.0.3153

Bitdefender
Trojan.GenericKD.2260606
1.0.20.450

Emsisoft Anti-Malware
Trojan.GenericKD.2260606
8.15.03.31.03

ESET NOD32
Win32/RuKometa.B potentially unwanted (variant)
9.11401

Fortinet FortiGate
Riskware/LMN
3/31/2015

G Data
Trojan.GenericKD.2260606
15.3.25

IKARUS anti.virus
PUA.RuKometa
t3scan.1.8.9.0

Kaspersky
not-a-virus:Downloader.Win32.LMN
14.0.0.2262

McAfee
Artemis!CD6A4AC2F608
5600.6809

MicroWorld eScan
Trojan.GenericKD.2260606
16.0.0.270

Panda Antivirus
Generic Suspicious
15.03.31.03

Qihoo 360 Security
HEUR/QVM10.1.Malware.Gen
1.0.0.1015

Reason Heuristics
PUP.Startup.ProfIT
15.3.31.15

Sophos
Generic PUA LH
4.98

Trend Micro House Call
Suspicious_GEN.F47V0330
7.2.90

VIPRE Antivirus
Trojan.Win32.Generic
38918

File size:
2.5 MB (2,657,760 bytes)

Product version:
1.0.0.61

File type:
Executable application (Win32 EXE)

Language:
Russian (Russia)

Common path:
C:\users\{user}\appdata\local\systemdir\setsearchm.exe

Digital Signature
Signed by:
Prof-IT

Authority:
COMODO CA Limited

Valid from:
10/22/2014 4:00:00 AM

Valid to:
10/23/2015 3:59:59 AM

Subject:
CN=Prof-IT, O=Prof-IT, STREET="Pervomajskaja, 47, 75", L=Irbit, S=Sverdlovsk region, PostalCode=623856, C=RU

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
00BA9220E1BEF0519921922B933C27DFDD

File PE Metadata
Compilation timestamp:
3/27/2015 9:23:08 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
49152:jS2p2xV9zHZFJvyXL+60YNgFq5NeWldt0TTAitTjFrB:mhxMXLaYNgROr

Entry address:
0x118A7B

Entry point:
E8, 15, B3, 00, 00, E9, 89, FE, FF, FF, 8B, FF, 55, 8B, EC, 8B, 45, 08, 56, 8B, F1, C6, 46, 0C, 00, 85, C0, 75, 63, E8, 89, 94, 00, 00, 89, 46, 08, 8B, 48, 6C, 89, 0E, 8B, 48, 68, 89, 4E, 04, 8B, 0E, 3B, 0D, A8, 29, 20, 20, 74, 12, 8B, 0D, 60, 27, 20, 20, 85, 48, 70, 75, 07, E8, FB, 91, 00, 00, 89, 06, 8B, 46, 04, 3B, 05, 30, 2E, 20, 20, 74, 16, 8B, 46, 08, 8B, 0D, 60, 27, 20, 20, 85, 48, 70, 75, 08, E8, 6E, B5, 00, 00, 89, 46, 04, 8B, 46, 08, F6, 40, 70, 02, 75, 14, 83, 48, 70, 02, C6, 46, 0C, 01, EB, 0A...
 
[+]

Entropy:
6.0468

Code size:
1.7 MB (1,745,408 bytes)

Startup File (User Run Once)
Registry location:
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce

Name:
setsearch_delete_self

Command:
"C:\users\{user}\appdata\local\system~1\setsea~1.exe" --selfdelete


Remove setsearchm.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.