home

uninstall.exe

wincheck

The application uninstall.exe has been detected as a potentially unwanted program by 7 anti-malware scanners. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer, however the file is not signed with an authenticode signature from a trusted source. This is the uninstaller utility registered in the Windows Control Panel for the program WinCheck by WinCheck. This file is typically installed with the program WinCheck which is a potentially unwanted software program.
Publisher:
wincheck

Product:
wincheck

Version:
1.0.0.0

MD5:
0763b35afa2d9ce5b9d35e48c154b4d5

SHA-1:
f3de6c860f8bea849d243c53de13b452aac820bf

SHA-256:
d310b8038279ad00b83002fee3c44ef140e04f7cd24325a5950eaae8df8eb571

Scanner detections:
7 / 68

Status:
Potentially unwanted

Analysis date:
4/26/2024 7:50:21 PM UTC  (today)

Scan engine
Detection
Engine version

Baidu Antivirus
Adware.Win32.ConvertAd
4.0.3.15418

ESET NOD32
Win32/Adware.ConvertAd.AQ
9.11370

herdProtect (fuzzy)
variant of Du_.exe (PUP)
2015.7.19.22

K7 AntiVirus
Adware
13.202.15364

SUPERAntiSpyware
Trojan.Agent/Gen-Dropper
9928

Trend Micro House Call
Suspicious_GEN.F47V0210
7.2.108

VIPRE Antivirus
Trojan.Win32.Generic
38729

File size:
89.3 KB (91,484 bytes)

Product version:
1.0.0.0

Copyright:
Copyright 2013

Trademarks:
wincheck

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\wincheck\uninstall.exe

File PE Metadata
Compilation timestamp:
12/5/2009 11:50:52 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
1536:CpgpHzb9dZVX9fHMvG0D3XJ2gdLeAyNlqCf29o41ahfBp8hoheYFuPbLIVS:AgXdZt9P6D3XJ2ceAxCO9o4swohVozMo

Entry address:
0x30FA

Entry point:
81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 60, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B0, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 18, EC, 42, 00, E8, F1, 2B, 00, 00, A3, 64, EB, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 98, 8F, 42, 00, FF, 15, 58, 71, 40, 00, 68, 54, 91, 40, 00, 68, 60, E3, 42, 00, E8, A4, 28, 00, 00, FF, 15, AC, 70, 40, 00, BF, 00, 40, 43, 00, 50, 57, E8, 92, 28, 00, 00...
 
[+]

Packer / compiler:
Nullsoft install system v2.x

Code size:
23.5 KB (24,064 bytes)

Program Uninstaller
Program name:
WinCheck

Display publisher:
WinCheck

Display version:
1.0.0.0

Uninstall string:
"C:\users\{user}\appdata\local\wincheck\uninstall.exe"


The file uninstall.exe has been discovered within the following program.

WinCheck  by WinCheck
This is adware that displays several types of advertising in the user's web browser, including but not limited to: - Sponsored links - Video targeted ads (which are displayed when you view a video).
81% remove it
 
Powered by Should I Remove It?

Remove uninstall.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.