home

uninst1.exe

Uninstaller

Woolik technologies ltd

The application uninst1.exe, “Uninstaller Application” by Woolik technologies ltd has been detected as adware by 3 anti-malware scanners. This is a self-extracting archive and installer and has been known to bundle potentially unwanted software. Additionally, the file is typically installed by a number of programs including dalesearch toolbar by Montera Technologeis LTD and Tika toolbar by Montiera Technologies Ltd., both potentially unwanted software. It is also typically executed from the user's temporary directory. While running, it connects to the Internet address DedLoadLM2200.babylon.com on port 80 using the HTTP protocol.
Publisher:
Babylon Ltd.  (signed by Woolik technologies ltd)

Product:
Uninstaller

Description:
Uninstaller Application

Version:
9.1.2.11

MD5:
25e5512a65b55d216c58769e29c016ba

SHA-1:
923b52701ae03abe891dac84954a27cf0427703b

SHA-256:
6f85d8c5385e62c19ed14e93324f9495409bdcff022c040127c2ab5b169d0ce4

Scanner detections:
3 / 68

Status:
Adware

Analysis date:
4/26/2024 10:04:56 PM UTC  (today)

Scan engine
Detection
Engine version

herdProtect (fuzzy)
variant of guninstaller.exe (Adware)
2013.12.22.20

Reason Heuristics
PUP.Installer.Wooliktechnologiesltd.H
14.8.7.21

Trend Micro House Call
TROJ_GEN.F47V0726
7.2.356

File size:
333.4 KB (341,360 bytes)

Product version:
9.1.2.11

Copyright:
Copyright © Babylon Ltd. 1997-2013

Original file name:
Uninstaller.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\appdata\local\temp\uninst1.exe

Digital Signature
Signed by:
Woolik technologies ltd

Authority:
VeriSign, Inc.

Valid from:
7/24/2013 9:00:00 PM

Valid to:
7/25/2014 8:59:59 PM

Subject:
CN=Woolik technologies ltd, OU=Digital ID Class 3 - Microsoft Software Validation v2, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=Woolik technologies ltd, L=Or Yeuda, S=israel, C=IL

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
233D2998915945A85914A5071B609336

File PE Metadata
Compilation timestamp:
8/26/2013 10:27:51 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

CTPH (ssdeep):
6144:33UBSA6VHoUdBgDZUlN0qFxBZMjxyLiyFlgeyn7zAb:HUBSJVH1zWZWh7Z6AK7zAb

Entry address:
0x1BF7B

Entry point:
E8, 57, A3, 00, 00, E9, 7F, FE, FF, FF, 55, 8B, EC, 8B, 45, 08, 56, 8B, F1, 83, 66, 04, 00, C7, 06, D0, 3F, 43, 00, C6, 46, 08, 00, FF, 30, E8, A8, 00, 00, 00, 8B, C6, 5E, 5D, C2, 04, 00, 55, 8B, EC, 8B, 45, 08, C7, 01, D0, 3F, 43, 00, 8B, 00, 89, 41, 04, C6, 41, 08, 00, 8B, C1, 5D, C2, 08, 00, 55, 8B, EC, 56, FF, 75, 08, 8B, F1, 83, 66, 04, 00, C7, 06, D0, 3F, 43, 00, C6, 46, 08, 00, E8, 12, 00, 00, 00, 8B, C6, 5E, 5D, C2, 04, 00, C7, 01, D0, 3F, 43, 00, E9, 96, 00, 00, 00, 55, 8B, EC, 56, 57, 8B, 7D, 08...
 
[+]

Code size:
185.5 KB (189,952 bytes)

The file uninst1.exe has been discovered within the following programs.

Bueno Chrome Toolbar  by Babylon Ltd
Bueno Chrome Toolbar is an adware web browser extension that will display various popup and banner ads as well as modify the user's web browser search and home page settings.
info.buenosearch.com
82% remove it
dalesearch toolbar  by Montera Technologeis LTD
Uses the SearchGol Toolbar Platform. As part of the installation process of the Software, publisher may offer changes to your Internet Browser settings.
info.dalesearch.com
80% remove it
Delta Chrome Toolbar  by Visual Tools
Delta Chrome Toolbar is part of the babylon toolbar system, a potentially unwanted program. It has alos been detected as malware by a few antivirus programs. TrendMicro-HouseCall detects it as TROJ_GEN.RCBH1C6 and Norman detects it as Babylon.A.
83% remove it
Delta toolbar  by Babylon Ltd
The Delta Toolbar is a web browser plugin that supports Internet Explorer, Firefox and Chrome. It is typically bundled with various third party software. When installed, it will modify the user's home page and search settings to redirect to delta-search.com.
info.delta-search.com
81% remove it
Doko Chrome Toolbar  by Babylon Ltd
Doko Chrome Toolbar is a potentially unwanted web browser extension designed to take control of the user's browser in order to redirect web searches and inject advertising. In Internet Explorer the program run as a Browser Helper Object.
82% remove it
Doko toolbar  by Babylon Ltd
Doko toolbar is a potentially unwanted application that runs in the web browser as a toolbar and web extension.
70% remove it
holasearch toolbar  by Babylon Ltd
HolaSearch (Hola Software) which is stealth distributed from Babylon, is a web browser search toolbar that is installed with various pay per install co-bundles and is designed to inject itself as a web toolbar into Internet Explorer, Chrome and Firefox.
www.holasearch.com
78% remove it
MixiDJ chrome Toolbar  by Conduit Ltd.
MixiDJ chrome Toolbar is a Conduit web browser plugin for Chrome that collects and stores information about a user's web browsing habits and sends this information to Conduit in order to provide advertising.
MixiDJV30.OurToolbar.com
66% remove it
Only Chrome Toolbar  by Woolik technologies ltd
This toolbar/web browser extension is ad/search-supported that is typically installed as an optional offer, users generally have this bundled with 3rd party software.
85% remove it
Opti Chrome Toolbar  by Babylon Ltd
This is a potentially unwanted web browser extension that is designed to deliver search-based hijacking as well as contextual advertising. The program does this by modifying the user's home and search page in order to monetize a user's search activities.
57% remove it
 
Latest 20 of 15 programs
Powered by Should I Remove It?

The executing file has been seen to make the following network communication in live environments.

TCP (HTTP):
Connects to DedLoadLM2200.babylon.com  (184.154.27.232:80)

Remove uninst1.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.