Fedorov Paul is a brand of publishers/developers run by WebPick Internet Holdings Ltd. located in Ramat Ha'Chayal Tel Aviv, Israel. The company is a primary distributor of unwanted software. Fedorov Paul is a developer of WebPick Internet Holdings and publishes a number of adware web browser plugins designed to monitor web browser behavior and inject advertisements (banner, popups, text-links, etc.) in the browser by using the WebPick InstalleRex monetization delivery platform. These programs from Fedorov Paul are typiclaly installed on a variety of names and misspellings and are very difficult to remove. According to WebPick, they use developers to sign their adware in order to "throw off competitors". Thre are 2 additional code signing certificates issued to this publisher.
9/30/2013 3:00:00 AM
10/17/2014 2:59:59 AM
CN=Fedorov Paul, OU=Individual Developer, O=No Organization Affiliation, L=Saint-Petersburg, S=Saint-Petersburg, C=RU
CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US
Detections (100% detected)
PUP.WebPick, PUP.Service.WebPick, PUP.BHO.WebPick, PUP.Bundler.WebPick, PUP.Webpick.FedorovPaul.Bundler (M), PUP.Webpick.FedorovPaul (M)
Adware.Downware.9673, Adware.Downware.10713, Adware.Downware.9365, Adware.BGuard.31
Win32/Toolbar.Neobar.C potentially unwanted (variant), Win64/Toolbar.Neobar.A potentially unwanted, Win32/Toolbar.Neobar.B potentially unwanted
McAfee Web Gateway
BehavesLike.Win32.Downloader.tc, BehavesLike.Win32.PWSZbot.tc, Artemis
The certificates below are also signed by Fedorov Paul.
The following publishers (by Authenticode signature organization name) are related.
* Note, the details and description above are based on the code signing digital signature issued to Fedorov Paul by Thawte, Inc. on September 30, 2013 with the serial number '4775a986f383176992fd70c1405b2dea'.