» uninstall.exe
Overview
Analysis
File Details
Behaviors (1)
Programs (1)

uninstall.exe

Setup Factory Runtime

Media Codecs Interactive LLC

The application uninstall.exe, “Setup Application” by Media Codecs Interactive has been detected as a potentially unwanted program by 6 anti-malware scanners. The program is a setup application that uses the Setup Factory installer. This is the uninstaller utility registered in the Windows Control Panel for the program Worldwide Web Research by Media Codecs Interactive LLC. This file is typically installed with the program Worldwide Web Research by Media Codecs Interactive. This version of the installer will bundle a Mindspark/MyWebSearch Toolbar, a potentially unwanted web browser extension.

File name:

uninstall.exe

Publisher:

Indigo Rose Corporation (signed by Media Codecs Interactive LLC)

Product:

Setup Factory Runtime

Description:

Setup Application

Version:

9.0.4.0

MD5:

934d41e6663d8405208874363832d03e

SHA-1:

2f0f38dd079215c103975a0ccf78b9131fab71ec

SHA-256:

436e3c6669eca9fc4e3e8adf3dd63f49e398f77b3f3191ff7ae9fdf588746ccc

Scanner detections:

6 / 68

Status:

Potentially unwanted

Explanation:

Bundles the Mindspark (MyWebSearch/Ask) toolbar, a web browser extension that will modify a user's search and home pages.

Analysis date:

4/25/2024 7:36:37 PM UTC (today)

Scan engine

Detection

Engine version

avast!

Win32:Mindspark-A [PUP]

2014.9-151201

AVG

Zango

2016.0.2909

Bkav FE

HW32.CDB

1.3.0.4246

Reason Heuristics

PUP.MediaCodecsInteractive.Installer (M)

15.12.1.3

Trend Micro House Call

TROJ_GEN.F47V1001

7.2.335

VIPRE Antivirus

MyWebSearch.J

24656

File size:

1.3 MB (1,351,776 bytes)

Product version:

9.0.4.0

Trademarks:

Setup Factory is a trademark of Indigo Rose Corporation

Original file name:

suf_rt.exe

File type:

Executable application (Win32 EXE)

Installer:

Setup Factory

Language:

English (United States)

Common path:

C:\Program Files\worldwide web research\uninstall.exe

Digital Signature

Signed by:

Media Codecs Interactive LLC

Authority:

COMODO CA Limited

Valid from:

2/16/2014 4:00:00 PM

Valid to:

2/17/2016 3:59:59 PM

Subject:

CN=Media Codecs Interactive LLC, O=Media Codecs Interactive LLC, STREET="2711 Centerville Road, Suite 400", L=Wilmington, S=Delaware, PostalCode=19808, C=US

Issuer:

CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:

63947F076DDE97DF55EEFBFED004A037

File PE Metadata

Compilation timestamp:

12/16/2011 10:23:46 AM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

10.0

CTPH (ssdeep):

24576:rB/s9XkrGUtabZRNM5vnRCnofkCuDVw4miJV5AX+ec999treoEUXLYydFsoked/R:lsY+7u5ZCn0kDb14A9hCk0ydWeH

Entry address:

0x3C2C80

Entry point:

60, BE, 00, 30, 68, 00, 8D, BE, 00, E0, D7, FF, 57, EB, 0B, 90, 8A, 06, 46, 88, 07, 47, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 72, ED, B8, 01, 00, 00, 00, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, 01, DB, 73, 0B, 75, 28, 8B, 1E, 83, EE, FC, 11, DB, 72, 1F, 48, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, EB, D4, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C9, EB, 52, 31, C9, 83, E8, 03, 72, 11, C1, E0, 08, 8A, 06, 46, 83, F0, FF, 74, 75, D1, F8, 89, C5, EB, 0B, 01, DB, 75, 07, 8B... 
[+]

Entropy:

7.9202

Packer / compiler:

UPX v0.89.6 - v1.02 / v1.05 -v1.24

Code size:

1.3 MB (1,310,720 bytes)

Program Uninstaller

Program name:

Worldwide Web Research

Display publisher:

Media Codecs Interactive LLC

Display version:

11.041.44

Uninstall string:

"C:\Program Files (x86)\Worldwide Web Research\uninstall.exe" "/U:C:\Program Files (x86)\Worldwide Web Research\Uninstall\uninstall.xml"

The file uninstall.exe has been discovered within the following program.

Worldwide Web Research by Media Codecs Interactive

worldwidewebresearch.com

About 6% of users remove it

Remove uninstall.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.