home

Pay-by-Ads Ltd

Publisher Information

Pay-by-Ads Ltd is a software publisher located in Tel aviv, Israel*. The company is a primary distributor of unwanted software.
Authority:
GoDaddy.com, Inc.

Valid from:
12/18/2013 1:45:20 PM

Valid to:
12/16/2014 3:54:24 PM

Subject:
CN=Pay-by-Ads Ltd, O=Pay-by-Ads Ltd, L=Tel aviv, C=IL

Issuer:
SERIALNUMBER=07969287, CN=Go Daddy Secure Certification Authority, OU=http://certificates.godaddy.com/repository, O="GoDaddy.com, Inc.", L=Scottsdale, S=Arizona, C=US

Serial number:
2b0fff59fb803e

Scanner detections:
Detections  (100% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.PaybyAds.Y, PUP.PaybyAds.R, PUP.Montiera.PaybyAds, PUP.PaybyAds.C, PUP.Task.Montiera, PUP.PaybyAds.L, PUP.PaybyAds.P, PUP.PaybyAds.T, PUP.Montiera.PaybyAds (M), PUP.Montiera (M)
100.00%

AVG
Paybyads
38.46%

Baidu Antivirus
PUA.Win32.Montiera, Hacktool.Win32.Montiera
30.77%

VIPRE Antivirus
Trojan.Win32.Generic, Montiera, Threat.4150696
30.77%

Malwarebytes
PUP.Optional.PayByAds.A, PUP.Optional.Buenosearch.A
23.08%

G Data
Adware.Agent.OGO, Win32.Adware.PayByAds
23.08%

McAfee
Artemis!BA73D8DC5DD1, Artemis!FE1BB2A4132A, Artemis!C044BC31F675, Artemis!A5A597FABD84, Artemis!D2E311C16125
23.08%

Bkav FE
W32.PaybyAds.Adware, W32.HfsAdware
19.23%

Sophos
PayByAds
19.23%

K7 AntiVirus
Trojan , Unwanted-Program , Riskware
19.23%

1 / 68      (Adware)
dsrlte.exe (by Pay By Ads)  (fc4beca2c82625cc91161fdffe31078b)

1 / 68      (Adware)
softonic_chr_1-8-29-3_cn.exe  (4eeaa7fc7cca43809437a4a677e05870)

1 / 68      (Adware)
dsrlte.exe (by Pay By Ads)  (67e97c6d615bad2a0869795fe0f7d009)

1 / 68      (Adware)
dsrlte.exe (by Pay By Ads)  (de6e6856cb53a220598d38738f9db3ad)

1 / 68      (Adware)
buenosearch.exe (by Pay By Ads)  (dc3c909bc620a28a93bc5ab15f7a8f80)

1 / 68      (Adware)
dsrlte.exe (by Pay By Ads)  (d0867382b201773ea9e52d36258cd047)

1 / 68      (Adware)
spcon_1-2-1-0_row.exe (spcon by conduit)  (f256183e020168a017d537b6c2b26e5e)

1 / 68      (Adware)
uddownload.tmp  (e91570e6123550f7ae679a41d64fbc24)

1 / 68      (Adware)
dsrlte.exe  (2af3b5d641ecbd057ff0461a5ba3ffa8)

1 / 68      (Adware)
buenosearch.exe (by Pay By Ads)  (546e6cae73259dcf214c9bc0706cd87a)

1 / 68      (Adware)
dsrlte.exe250513fc (by Pay By Ads)  (67ecc2898867daf48c2614d846cfaf36)

1 / 68      (Adware)
dsrlte.exe (by Pay By Ads)  (efad27f10f4a5e4e0467827ad67b2ef3)

1 / 68      (Adware)
dsrlte.exe (by Pay By Ads)  (ba73d8dc5dd1cf3e558c2152c3d969ad)

12 / 68    (Adware)
gophotoitkms.exe (by Pay By Ads)  (d2e311c16125d6f6748f0841c12fdb3c)

18 / 68    (Adware)
dsrlte.exe (by Pay By Ads)  (4932b700dc8899151e96419005156269)

16 / 68    (Adware)
onlysearch_1.3.8.11_cn.exe  (bb3992f7a641db37790fd1b2c21a1734)

3 / 68      (Adware)
surftastic.ofsvc.exe  (4b96672d2f990d07435b796e3411e8c5)

2 / 68      (Adware)
kms_1.3.8.2_cn.exe  (deb636b1d50c69ffcdc74a3bbfb28c71)

16 / 68    (Adware)
pm.exe  (387349c18fe7710a8e5b42d12f7fdb5a)

13 / 68    (Adware)
gophotoitkms.exe (by Pay By Ads)  (c044bc31f675c743191ea468b0564c61)

10 / 68    (Adware)
onlysearch.exe (by Pay By Ads)  (ec36e327558c6d48bd926b79e19e405b)

9 / 68      (Adware)
buenosearch.exe (by Pay By Ads)  (fe1bb2a4132a20d353a14cb7a3c648d9)

1 / 68      (Adware)
pm.exe  (79c07718443aadd02ba1c85cec625534)

22 / 68    (Adware)
dsrlte.exe (by Pay By Ads)  (ba73d8dc5dd1cf3e558c2152c3d969ad)

1 / 68      (Adware)
playmrmd_1.3.6.11_cn.exe  (2b13b63aff757426cb47f9c69be6d1bc)

1 / 68      (Adware)
softonic_chr_1-8-29-3_cn.exe  (9c62c647fef0f4e6b8e0b7e5af337118)

Downloads URLs for files signed by Pay-by-Ads Ltd.

1 / 68      (Adware)
http://global-shared-files-l3.softonic.com/e73/327/.../file?nvb=20140101163814&nva=20140102043914&token=012d1c6ff5d69ba647115&id_file=69673744&channel=WEB_SD&instance=softonic_es&type=RECOFFER&fdh=no&SD_used=1&filename=Softonic_chr_1-8-29-3_cn.exe  (9c62c647fef0f4e6b8e0b7e5af337118)

The following websites host and distribute files published by Pay-by-Ads Ltd.

global-shared-files-l3.softonic.com

* Note, the details and description above are based on the code signing digital signature issued to Pay-by-Ads Ltd by GoDaddy.com, Inc. on December 18, 2013 with the serial number '2b0fff59fb803e'.
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.