» uninstall.exe
Overview
Analysis
File Details
Programs (1)

uninstall.exe

Toolbar Uninstaller

Visicom Media Inc.

This is part of the Visicom VMN web browser toolbar and extension that will modify the browser's default search provider, DNS, and home page functions. The application uninstall.exe by Visicom Media has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. This file is typically installed with the program VMN Toolbar by Visicom Media Inc. which is a potentially unwanted software program.

File name:

uninstall.exe

Publisher:

Visicom Media Inc. (signed and verified)

Product:

Toolbar Uninstaller

Version:

1.0.1.2

MD5:

cb0bae40b3482586155fa5af3e3b836f

SHA-1:

60ab76844b907b0b63556adca575a599305a4eb7

SHA-256:

fd455888e6c44902aed4d1369e7bb580d962d14849ca910506770d6c7c379925

Scanner detections:

1 / 68

Status:

Potentially unwanted

Note:

Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Analysis date:

4/18/2024 4:48:03 PM UTC (today)

Scan engine

Detection

Engine version

Reason Heuristics

PUP.ToolbarUninstaller.VisicomMedia.J

14.10.1.11

File size:

67.5 KB (69,080 bytes)

Trademarks:

File type:

Executable application (Win32 EXE)

Installer:

NSIS (Nullsoft Scriptable Install System)

Language:

English (United States)

Common path:

C:\Program Files\egamestoolbar\uninstall.exe

Digital Signature

Signed by:

Visicom Media Inc.

Authority:

Thawte Consulting (Pty) Ltd.

Valid from:

5/30/2006 5:00:00 PM

Valid to:

6/21/2007 4:59:59 PM

Subject:

CN=Visicom Media Inc., OU=SECURE APPLICATION DEVELOPMENT, O=Visicom Media Inc., L=Brossard, S=Quebec, C=CA

Issuer:

CN=Thawte Code Signing CA, O=Thawte Consulting (Pty) Ltd., C=ZA

Serial number:

46009F112341EB9E47AD9A71D868DC95

File PE Metadata

Compilation timestamp:

2/17/2007 4:48:44 AM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

6.0

CTPH (ssdeep):

768:d2gF2QptPs4BBNsZZ1x/mWX6Vz5FiqeWkJ/5JWmtHqOonXgmUpbbUgdfRSsxC4GS:w42cPHBg5mVXkJ/jHtKJ8bb1x+v9nof9

Entry address:

0x32CE

Entry point:

81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 14, 70, 91, 40, 00, 33, F6, C6, 44, 24, 10, 20, FF, 15, 30, 70, 40, 00, 53, FF, 15, 74, 72, 40, 00, A3, 10, 48, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 20, FD, 41, 00, FF, 15, 5C, 71, 40, 00, 68, 94, 92, 40, 00, 68, 60, 3F, 42, 00, E8, 49, 28, 00, 00, FF, 15, B8, 70, 40, 00, BF, 00, A0, 42, 00, 50, 57, E8, 37, 28, 00, 00, 53, FF, 15, 0C, 71, 40, 00, 80, 3D, 00, A0, 42, 00, 22, A3, 60, 47, 42, 00, 8B, C7, 75, 0A... 
[+]

Entropy:

7.1911

Packer / compiler:

Nullsoft install system v2.x

Code size:

23 KB (23,552 bytes)

The file uninstall.exe has been discovered within the following program.

VMN Toolbar by Visicom Media Inc.

The VMN Toolbar is a Visicom toolbar installed in your Web browser that collects and stores information about your web browsing habits and sends this information to Visicom so they can suggest services or provide ads via the toolbar.

software.visicommedia.com

78% remove it

Remove uninstall.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.