Monthly Archives: August 2015

Malware Protection Live and MalwareProtectionClient.exe Bundled With CNET’s Download.com Installer

Uncategorized,

Hello there and welcome to the FreeFixer blog. Today I wanted to talk about a bundled program called Malware Protection Live. If you have Malware Protection Live software installed on your machine, you will notice Malware Protection Live in the Remove programs list and MalwareProtectionClient.exe running in the Windows Task Manager:

MalwareProtectionClient.exe task manager Malware Protection Live uninstall

 

Malware Protection Live is configured to run on startup. This is done by adding MalwareProtectionClient.exe as a startup in the Windows Registry:

MalwareProtectionClient.exe startup

So, how did Malware Protection Live install on your machine? Unless you downloaded it directly from their web site, it was probably bundled with some other download that you installed recently. Bundling means that software is included in other software’s installers. When I first found Malware Protection Live, it was bundled with CNET’s Download.com installer. Here’s how it appeared in the CNET’s Download.com installer where I found it:

Malware Protection Live CNET download.com installer

According to the embedded certificate, Malware Protection Live is located in Florida, US:

Malware Protection Live cert

So, what does the anti-virus programs over at VirusTotal say about the bundled MalwareProtectionClient.exe file? Detection rate is 0%, so hopefully the software is safe.

MalwareProtectionClient.exe anti-virus report

What do you think?

I’ll rescan it in a few days to see if detection ratio remain the same. Please check below for updates.

Did you also find Malware Protection Live on your machine? Any idea how it was installed? Was is also bundled in a download from Download.com? Please share your story the comments below. Thanks a bunch!

Thanks for reading. Welcome back!

Update Oct 11 2015: I checked out the MalwareProtectionClient.exe download again, and now it is detected by a few of the scanners over at VirusTotal. The detection ratio is 4/56:

MalwareProtectionClient.exe anti-virus report

Simon Leshchuk – 39% Detection – MPlug / MultiPlug says VirusTotal

Uncategorized,

Hello readers! Just a short note on a publisher called Simon Leshchuk.

Simon Leshchuk publisher

It is also possible to check a digital signature by looking at a file’s properties. Here’s a screenshot of the Simon Leshchuk certificate. Simon is located in Ukraine.

Simon Leshchuk cert

The Certum CA has issued the certificate to mr Leshchuk as you can see in the certification path below:

Simon Leshchuk path

The reason for posting about Simon Leshchuk is that the file is detected by many of the anti-virus programs. Arcabit detects Download.exe as Trojan.Adware.MPlug.65, Avira detects it as TR/Crypt.XPACK.Gen, F-Secure calls it Gen:Variant.Adware.MPlug, K7AntiVirus calls it Unwanted-Program ( 004c5f5e1 ) and Malwarebytes detects it as PUP.Optional.Multiplug.

Simon Leshchuk anti-virus report

Did you also find a Simon Leshchuk file? What kind of download was it? If you remember the download link, please post it in the comments below.

Thanks for reading.