Fedorov Paul

Publisher Information

Fedorov Paul is a brand of publishers/developers run by WebPick Internet Holdings Ltd. located in Ramat Ha'Chayal Tel Aviv, Israel. The company is a primary distributor of unwanted software. Fedorov Paul is a developer of WebPick Internet Holdings and publishes a number of adware web browser plugins designed to monitor web browser behavior and inject advertisements (banner, popups, text-links, etc.) in the browser by using the WebPick InstalleRex monetization delivery platform. These programs from Fedorov Paul are typiclaly installed on a variety of names and misspellings and are very difficult to remove. According to WebPick, they use developers to sign their adware in order to "throw off competitors". Thre are 2 additional code signing certificates issued to this publisher.
Remove Fedorov Paul Malware - Powered by Reason Core Security
Authority:
Thawte, Inc.

Valid from:
9/30/2013 3:00:00 AM

Valid to:
10/17/2014 2:59:59 AM

Subject:
CN=Fedorov Paul, OU=Individual Developer, O=No Organization Affiliation, L=Saint-Petersburg, S=Saint-Petersburg, C=RU

Issuer:
CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:
4775a986f383176992fd70c1405b2dea

Scanner detections:
Detections  (100% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.WebPick, PUP.Service.WebPick, PUP.BHO.WebPick, PUP.Bundler.WebPick, PUP.Webpick.FedorovPaul.Bundler (M), PUP.Webpick.FedorovPaul (M)
100.00%

Dr.Web
Adware.Downware.9673, Adware.Downware.10713, Adware.Downware.9365, Adware.BGuard.31
14.00%

VIPRE Antivirus
Trojan.Win32.Generic
10.00%

IKARUS anti.virus
PUA.Toolbar.Neobar
10.00%

AVG
Generic
10.00%

ESET NOD32
Win32/Toolbar.Neobar.C potentially unwanted (variant), Win64/Toolbar.Neobar.A potentially unwanted, Win32/Toolbar.Neobar.B potentially unwanted
8.00%

McAfee Web Gateway
BehavesLike.Win32.Downloader.tc, BehavesLike.Win32.PWSZbot.tc, Artemis
8.00%

NANO AntiVirus
Riskware.Win32.Downware.dmwyzk, Riskware.Win32.Downware.dpgkfo
6.00%

Agnitum Outpost
PUA.Toolbar.Neobar
6.00%

avast!
Rootkit-gen [Rtk]
6.00%

1 / 68      (Adware)
toolbar32.dll  (dd7a6c47eac25f595b66196b12d1bbe2)

1 / 68      (Adware)
extensionupdaterservice.exe  (ceb96d0987652b61dbdfd734b3c44cd1)

1 / 68      (Adware)
[torrents3d.ru]_1370.exe  (935ba51018d74fa6ee19cb4df2ea0f22)

1 / 68      (Adware)
[torrents3d.ru]_1370.exe  (945c9fb77dc07c615802f2e4e433706d)

1 / 68      (Adware)
extensionupdaterservice.exe  (4af66a914d8b0dcd1d05c2994280d1d3)

1 / 68      (Adware)
installerhelperlowsupport.dll  (438b0806ed790fd7f8dd92f68c22d0a3)

1 / 68      (Adware)
uninstaller.exe  (2bc0764ca26bf546a6d84bab2c5f85b7)

1 / 68      (Adware)
uninstall.exe (Currency calc)  (01415c3d807c5c3dc2d5c6a7522b1ea6)

1 / 68      (Adware)
toolbar64.dll  (5dfe3d6b466a8a6a1be962c9545c4618)

1 / 68      (Adware)
loader.exe  (2820fc66076bbd009d5275d278b6a672)

1 / 68      (Adware)
interfaces64.dll  (0e7e0c4a3f11a4220c8fa9b7e09fa5d4)

1 / 68      (Adware)
interfaces32.dll  (fd5ce3d947df847a3ee3570f1db0b152)

1 / 68      (Adware)
backgroundsingleton.exe  (133034c8d7d38b91a78eda06c1f8a263)

1 / 68      (Adware)
toolbar32.dll  (0faf74b2b646be617d84a37abaeaa29b)

1 / 68      (Adware)
extensionupdaterservice.exe  (1a210e0703eb7d37cf6747c715179180)

1 / 68      (Adware)
installerhelper.dll  (b247d91b4a96ca5622e6748c6fb58a62)

1 / 68      (Adware)
extension64.dll  (670b235e1879d8880644151ff52a6e10)

2 / 68      (Adware)
BackgroundEngine.exe (Background Engine Script)  (1cc4043d12b1c3ba79fee2a52c234fdd)

1 / 68      (Adware)
uninstall.exe (Gigabase by Kurs.ru)  (da5ace4a54ea5e4d8a61af441e849e0f)

1 / 68      (Adware)
extension32.dll  (755a80f7e6c8bc8d7879af275030b5d0)

1 / 68      (Adware)
kompexsqlitewrapper.dll  (bf8570cf588db91d58d9788c36ea69ac)

1 / 68      (Adware)
installerhelper.dll  (8e58c29ebb1ad9667b5a92369eef2952)

1 / 68      (Adware)
chromium.dll  (d0f7e065837fb0ac056d6e85953f433f)

15 / 68    (Adware)
qmnpilo4n26a.exe (Currency calc)  (e607164ed985f1132f0670e2285a8628)

1 / 68      (Adware)
extensionupdaterservice.exe  (bf84b960f484c83b74b0d039319a2116)

2 / 68      (Adware)
guardbackgroundservice.exe  (473155113dfb0a65fbf60b590d3f71bb)

2 / 68      (Adware)
[torrents3d.ru]_3516.exe (Loader)  (0bdd2fa1f6ec4fa86ab842634c1a608f)

4 / 68      (Adware)
nsprocess.dll  (5447a4564be5ecd7cde0c2d01fe79cf0)

1 / 68      (Adware)
kompexsqlitewrapper.dll  (126b626ec0cbc899bbc30107181677f5)

2 / 68      (Adware)
installerhelper.dll  (84df102bc79bbbf098a11f6d5c094f30)

 
Latest 30 of 57 files

The certificates below are also signed by Fedorov Paul.

1F1C6CD90A38CE2585B8E44D4C5B4372  (Nov 07, 2014 to Nov 05, 2015)

702D4055EE5CC734192DCBDFFE7AE8E1  (Aug 28, 2012 to Aug 29, 2013)

The following publishers (by Authenticode signature organization name) are related.

Remove Fedorov Paul Malware - Powered by Reason Core Security
* Note, the details and description above are based on the code signing digital signature issued to Fedorov Paul by Thawte, Inc. on September 30, 2013 with the serial number '4775a986f383176992fd70c1405b2dea'.