home

uninstall.exe

Railroad Party Apps

This adware is a web browser extension that will inject advertising in the browser in the form of unwanted banners and text-links which may link to malware sites and install unwanted software. The application uninstall.exe by Railroad Party Apps has been detected as adware by 10 anti-malware scanners. This is a self-extracting archive and installer and has been known to bundle potentially unwanted software. This is the uninstaller utility registered in the Windows Control Panel for the program videosMediaPlayersversion2.1 by enter. It is built using the Crossrider cross-browser extension toolkit. While the file utilizes the Crossrider framework and delivery services, it is not owned by Crossrider. It is part of the Brightcircle group of web-extensions that inject advertisements in the browser.
Publisher:
Railroad Party Apps  (signed and verified)

MD5:
be434f82dbea3b8ce6f13ee71a0f169b

SHA-1:
a54896a96694e54466b553bd5b8ffb8d32315c1d

SHA-256:
ddd9e4ad1ca3ff38ccb636457948a353d620c21701e9806de217dadfaa156cd0

Scanner detections:
10 / 68

Status:
Adware

Explanation:
The software may change the browser's home page and search provider settings as well as display advertisements.

Analysis date:
4/25/2024 12:47:53 PM UTC  (today)

Scan engine
Detection
Engine version

AhnLab V3 Security
Win-PUP/CrossRider
2014.11.02

Avira AntiVirus
ADWARE/CrossRider.Gen7
7.11.182.116

avast!
Win32:Malware-gen
141025-0

AVG
Generic
2015.0.3291

Baidu Antivirus
PUA.Win32.CrossRider
4.0.3.141113

Dr.Web
Trojan.Crossrider.29967
9.0.1.0317

ESET NOD32
Win32/Toolbar.CrossRider.AW (variant)
8.10646

Kaspersky
Trojan.NSIS.GoogUpdate
14.0.0.3021

Qihoo 360 Security
HEUR/QVM10.1.Malware.Gen
1.0.0.1015

Reason Heuristics
PUP.RailroadPartyApps.J
14.11.3.21

File size:
85.4 KB (87,456 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\Program Files\videosmediaplayersversion2.1\uninstall.exe

Digital Signature
Signed by:
Railroad Party Apps

Authority:
COMODO CA Limited

Valid from:
10/20/2014 2:00:00 AM

Valid to:
10/21/2015 1:59:59 AM

Subject:
CN=Railroad Party Apps, O=Railroad Party Apps, STREET=Athinodorou 3, STREET=Dasoupoli Strovolos, L=Nicosia, S=Cyprus, PostalCode=2025, C=CY

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
066FE8567876E15A3F87AB41B136D294

File PE Metadata
Compilation timestamp:
10/26/2014 9:34:56 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

CTPH (ssdeep):
1536:WlWZKpskQdw9hY6TsRp3tcF6jsWjcdTqdljB:GWTkkihYYswDTqdlF

Entry address:
0x4D2D

Entry point:
E8, 1E, 59, 00, 00, E9, 00, 00, 00, 00, 6A, 14, 68, 38, 2E, 41, 00, E8, 2D, 0A, 00, 00, E8, 8C, 24, 00, 00, 0F, B7, F0, 6A, 02, E8, B1, 58, 00, 00, 59, B8, 4D, 5A, 00, 00, 66, 39, 05, 00, 00, 40, 00, 74, 04, 33, DB, EB, 33, A1, 3C, 00, 40, 00, 81, B8, 00, 00, 40, 00, 50, 45, 00, 00, 75, EB, B9, 0B, 01, 00, 00, 66, 39, 88, 18, 00, 40, 00, 75, DD, 33, DB, 83, B8, 74, 00, 40, 00, 0E, 76, 09, 39, 98, E8, 00, 40, 00, 0F, 95, C3, 89, 5D, E4, E8, 92, 52, 00, 00, 85, C0, 75, 08, 6A, 1C, E8, DC, 00, 00, 00, 59, E8...
 
[+]

Code size:
51.5 KB (52,736 bytes)

Program Uninstaller
Program name:
videosMediaPlayersversion2.1

Display publisher:
enter

Display version:
1.35.9.29

Uninstall string:
C:\Program Files (x86)\videosMediaPlayersversion2.1\Uninstall.exe /fcp=1


Remove uninstall.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.