Perfect Uninstaller Rogue Software

I installed prefect uninstaller the other day and a few minutes later was hit by a virus. I scanned the installer file and low and behold I found a virus. Just a heads up if anyone tries to install this software.

 

Where did you download it from??

 

Strange but possible. Just tried to d\l it from their home page. Avast webshield jumped up and flagged it as "Win32:Trojan-gen {Other}". Possible FP? Would suggest you submit it for analysis.

 

Interesting.Just downloaded from it's home site and virus total gave a 7/36.

 

Quick peek around their site, and several things caught my eye: no contact information provided, Whois check confirms this (privacy protection service) - what are they hiding? - and affiliate program promising 75% commission

I tend to severely distrust anyone offering commercial software who choose to hide who they are. There's absolutely no reason at all for a legitimate company to hide their identity!

Not to mention the rather high sales commission which tends to attract more unsavory methods ...

 

Downloaded it there website (perfectuninstaller.com). AntiVir picked up the same virus you get ThunderZ.
I agree lordpake very suspicious website.

 

Funny that McAfee and Norton both give it a green light while WOT says red.

http://www.siteadvisor.com/sites/perfectuninstaller.com

https://safeweb.norton.com/report/show?name=perfectuninstaller.com

http://www.mywot.com/en/scorecard/perfectuninstaller.com

Anubis-

http://anubis.iseclab.org/?action=result&task_id=1adb6e6b0806364c499ffedd4b31ce66a&format=txt

 

ThreatExpert-

http://www.threatexpert.com/report.aspx?md5=81655eaf314c5c098ae0a482103d90f4

 

CWS
http://www.cwsandbox.org/?page=report&analysisid=756628&password=ohiig

CAMAS
http://camas.comodo.com/cgi-bin/sub...6c2642ffddcab6c8f334208dccf060e5e477a534d4cdf

 

Download.com had a brief software publisher profile for Perfect Uninstaller:

"Qiwang Computer LTD come into existence at 2006 focus on Windows system App develop. We produce the best windows utilities software and service on the net. User love us software, and we do our best to help them happy"

Ah so, grasshopper. If you Google search for Qiwang Computer LTD, you will see they have many websites with a few products, but their physical address, email address and telephone number are missing. Only way to contact them is through a webpage form which I suppose does (If anything) a HTML mailto. Caveat Emptor. Let the buyer beware.

I ran Norton, Webroot (Sophos) and SystemSuite (Sunbelt Vipre) scans on the latest installation file. No viruses reported.

 

It's getting sickening how these products and others are more and more being embedded with foulware.

I have run into this myself more in the past 2 months then ever before. I don't think these distribution server download sites are either not using the best AV's or else these guys are getting more clever then ever in bypassing detection.

 

If you google on perfect uninstaller, you will see that their product, under various names and websites, are the only results returned. Plus the advertising on the right side of the page is only their product. Google is making lots of yen off of Qiwang LTD. Qiwang is making lots of money from unsuspecting customers. (I should have known better). The product locked up while running. And they charged me for 3 years of license instead of one which I requested.

Once I realized that I'd been had, I restored my disk with an Acronis disk image from 2 days ago. and changed all my passwords (including Pay Pal).

I was in a hurry to uninstall F-Secure Anti-Virus trial version (which wouldn't uninstall from Vista control panel). F-Secure uninstall program did get rid of the entry in ctrl panel, but the product kept running. I disabled their entries using services.msc, but I wanted F-Secure entries out of my registry and their product off of my machine. Following advice from a forum, I reinstalled F-Secure and then uninstalled it successfully through control panel. I wish I had checked here before purchasing Perfect Installer.

 

Re: Perfect Uninstaller Rogue Software BEWARE

Now I realize after installing Perfect Uninstaller and subsequently uninstalling f-secure, I was unable to update any of my security software or go to Microsoft update. Sounds like the conflicker virus. Acronis image restore from a previous backup covered my rear on this one. BEWARE!!!

 

I am running windows XP right now. Everything seems to
be fine with the perfect uninstaller.Thank you!

 

For me, the bad English would give it away. And the WHOIS info, of course.
I'm always very, very careful about what I install.

 

That's strange because when I tested just now, neither the installer nor the program executable yielded any results. However, I don't go by VT results alone.