Files digitally signed by Sergey Petrov – Be careful!

Long time no see! Found a file that looked very suspicious while helping friend today. The digital signature said Sergey Petrov. Well, check out what the anti-virus programs say about it:

  • Avast Win32:InstalleRex-BI [PUP] 20140328
  • Kingsoft Win32.Troj.AntiFW.b.(kcloud) 20140328
  • GData Win32.Application.InstalleRex.E 20140328
  • K7GW Unwanted-Program ( 0049574e1 ) 20140326
  • Kaspersky Trojan.Win32.AntiFW.b 20140328
  • DrWeb Trojan.WebPick.29 20140328
  • Malwarebytes PUP.Optional.Installrex 20140328
  • McAfee PUP-FHQ!6AB5BB009BA7 20140328
  • Rising PE:PUF.InstallRex!1.9E4C 20140327
  • Qihoo-360 Malware.QVM20.Gen 20140328
  • AVG MalSign.Generic.256 20140328
  • Sophos InstallRex 20140327
  • VIPRE Installerex/WebPick (fs) 20140328
  • VBA32 Downloader.AdLoad 20140327
  • Comodo Application.Win32.InstalleRex.KG 20140328
  • AntiVir ADWARE/InstallRex.Gen7 20140328
  • ESET-NOD32 a variant of Win32/InstalleRex.P 20140328

So, if you see a file digitally signed by Sergey Petrov, stay away from it!

I asked my buddy if he knew how this Sergey Petrov file had been installed on his computer, but he had no idea. Do you know how these files are distributed?

Advertisements

4 thoughts on “Files digitally signed by Sergey Petrov – Be careful!

  1. I was looking at downloading a PDF book from the site ” http://www.vfrbooks.com/ ” they would give me the PDF if I gave over my credit card details or I downloaded ‘Their PDF reader” Obviously I’m not going to hand out my CC details so easily, so I downloaded knowing I get to check before I install it. So when the authorization to install or not came up, I found your site warning me against! So I am very grateful, Thank you.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s