Should I block it?

98%

Yes, 98% block recommendation.

Possible reasons:

Multiple malware detections

Performance resource utilization

Additional versions

1, 0, 0, 4	5.75%
1, 0, 0, 4	1.15%
1, 0, 0, 3	47.13%
1.0.0.1	44.83%
1.0.0.1	1.15%

Relationships

PE file structure

Show functions

Import table

advapi32.dll

DuplicateTokenEx, GetTokenInformation, CreateProcessAsUserW, OpenProcessToken, ConvertSidToStringSidW

htmlayout.dll

HTMLayoutGetElementLocation, HTMLayoutWindowAttachEventHandler, HTMLayoutGetRootElement, HTMLayoutLoadHtml, HTMLayoutSetAttributeByName, HTMLayoutVisitElements, HTMLayoutSetCallback, HTMLayout_UseElement, HTMLayoutGetMinWidth, HTMLayoutProcND, HTMLayoutGetMinHeight, HTMLayout_UnuseElement, HTMLayoutUpdateElement, HTMLayoutDataReady, HTMLayoutSetElementHtml

kernel32.dll

LoadLibraryW, SetStdHandle, FlushFileBuffers, GetStringTypeW, WriteConsoleW, HeapReAlloc, GetConsoleMode, GetConsoleCP, QueryPerformanceCounter, HeapCreate, GetFileType, SetHandleCount, GetEnvironmentStringsW, FreeEnvironmentStringsW, GetModuleFileNameA, GetStdHandle, LCMapStringW, SetLastError, TlsSetValue, TlsGetValue, TlsAlloc, IsValidCodePage, GetOEMCP, GetACP, InterlockedIncrement, GetCPInfo, RtlUnwind, InitializeCriticalSectionAndSpinCount, IsProcessorFeaturePresent, HeapAlloc, HeapFree, GetCurrentProcess, Sleep, GetLastError, Process32FirstW, ProcessIdToSessionId, Process32NextW, CreateToolhelp32Snapshot, CloseHandle, GetTickCount, GetTempPathW, InitializeCriticalSection, LeaveCriticalSection, VirtualAlloc, EnterCriticalSection, DeleteCriticalSection, CreateMutexW, VirtualFree, OpenProcess, SetFilePointer, VirtualQuery, WriteFile, WideCharToMultiByte, CreateFileW, DecodePointer, GetCurrentProcessId, InterlockedDecrement, GetModuleFileNameW, GetVersion, ExitProcess, DeleteFileW, CreateThread, FindResourceW, LoadResource, SizeofResource, LockResource, GetCurrentThreadId, LocalFree, GetSystemTimeAsFileTime, GetCommandLineA, HeapSetInformation, TlsFree, MultiByteToWideChar, GetModuleHandleW, GetProcAddress, HeapSize, IsDebuggerPresent, SetUnhandledExceptionFilter, UnhandledExceptionFilter, TerminateProcess, RaiseException, EncodePointer, GetStartupInfoW

ole32.dll

CoInitializeSecurity, CoUninitialize, CoInitializeEx

shell32.dll

ShellExecuteW

shlwapi.dll

SHGetValueW, PathFindFileNameW

user32.dll

PostMessageW, LoadCursorW, RegisterClassExW, LoadIconW, SetWindowLongW, CreateWindowExW, GetSystemMetrics, SetTimer, GetWindowRect, KillTimer, SetForegroundWindow, PtInRect, GetWindowLongW, SetWindowPos, ShowWindow, FindWindowExW, SendMessageW, MapWindowPoints, DefWindowProcW, GetWindowThreadProcessId, DispatchMessageW, SetProcessWindowStation, GetMessageW, CloseWindowStation, OpenDesktopW, CloseDesktop, TranslateMessage, SetThreadDesktop, OpenWindowStationW, GetShellWindow

userenv.dll

DestroyEnvironmentBlock, CreateEnvironmentBlock

wininet.dll

HttpOpenRequestW, HttpSendRequestW, InternetConnectW, InternetReadFile, InternetCrackUrlW, InternetOpenW, InternetCloseHandle, HttpQueryInfoW

wtsapi32.dll

WTSQuerySessionInformationW, WTSQueryUserToken

yourfileupdater.exe

YourFile Downloader by Via Advertising Group Limited (Signed)

Remove yourfileupdater.exe

Version:	1, 0, 0, 4
MD5:	0f9ba32eba814bf475b9d6298d36b18d
SHA1:	876788200f5cedc0cc9a6e339679bf875fa20776
SHA256:	29f78ab5b4890a7edd92818d28b918cdcd965d1dcc13e61e0b85be8f2628f8c6

Warning 5 antivirus scanners has detected malware.

What is yourfileupdater.exe?

The YourFile Downloader auto updater is a program which runs in the background of Windows and automatically starts up when your PC boots. It checks for software udpates and automatically downloads and installs them if found.

About yourfileupdater.exe (from Via Advertising Group Limited)

“YourFileDownloader is designed to make your download experience easier and quicker than ever. Now you don’t have to spend your valuable time and energy for finding desired programs and get forwarded a”

Details

File name:	yourfileupdater.exe
Publisher:	http://yourfiledownloader.com
Product name:	YourFile Downloader
Typical file path:	C:\Program Files\yourfiledownloader\yourfileupdater.exe
Original name:	YourFile.exe
File version:	1, 0, 0, 4
Product version:	1.0.0.1
Size:	390.11 KB (399,472 bytes)
Certificate
Issued to:	Via Advertising Group Limited
Authority (CA):	VeriSign
Effective date:	Monday, April 30, 2012
Expiration date:	Wednesday, May 1, 2013
Digital DNA
File packed:	No
.NET CLR:	No

More details

Programs

The following program will install this file

YourFileDownloader

YourFile Downloader

65% remove

YourFileDownloader provides the ability to download various software applications locally. It provides a list and search interface to locate and download appliations. The program does however automatically add itself to the Windows built-in Firewall.

Behaviors

Scheduled tasks

The job 'YourFile Update' runs on logon in the path '\YourFile Update'
The task 'Your File Updater' runs in the path '\Your File Updater'
The task 'YourFile DownloaderUpdate' runs on logon in the path '\YourFile DownloaderUpdate'
Entry path 'C:\WINDOWS\Tasks\Your File Updater.job'
Entry path 'C:\windows\Tasks\YourFile DownloaderUpdate.job'
Entry path '\YourFile DownloaderUpdate'
Entry path 'C:\WINDOWS\Tasks\YourFile Update.job'
Entry path '\YourFile Update'
Entry path '\Your File Updater'

Scheduled tasks startups

Set to load on user login (bypasses Windows UAC if enabled)

Windows firewall allowed programs

Exceptions allow programs to access to the Internet through an outbound connections

Firewall exception for 'C:\Program Files\YourFileDownloader\YourFileUpdater.exe'

Malware detections

Based on 40+ industry antivirus scanners, 5 of them detected the following malware.

Antivirus engine	Engine version	Detection
avast!	8.0.1489.320	Win32:Downloader-UEO [PUP]
ESET NOD32	7.8859	a variant of Win32/YourFileDownloader.B
Kingsoft	2013.4.9.267	Win32.Troj.Generic.a.(kcloud)
Trend Micro HouseCall	9.700.0.1001	TROJ_GEN.F47V0621
VIPRE Antivirus	21966	Via Advertising (fs)

Resource utilization

(Note: statistics below are averages based on a minimum sample size of 200 unique participants)

Averages

CPU
Total CPU:	0.02602096%	0.028634%
Kernel CPU:	0.01522980%	0.013761%
User CPU:	0.01079117%	0.014873%
Kernel CPU time:	3,744,024 ms/min	100,923,805ms/min
Memory
Private memory:	8.97 MB	21.59 MB
Private (maximum):	16.58 MB
Private (minimum):	1.77 MB
Non-paged memory:	8.97 MB	21.59 MB
Virtual memory:	80.65 MB	140.96 MB
Virtual memory (peak):	87.18 MB	169.69 MB
Working set:	1.85 MB	18.61 MB
Working set (peak):	16.91 MB	37.95 MB
Resource allocations
Threads:	3	12
Handles:	239	600
GUI GDI count:	22	103
GUI GDI peak:	27	142
GUI USER count:	4	49
GUI USER peak:	5	71

Process properties

Integrety level:	High
Platform:	32-bit
Command line:	"C:\Program Files\yourfiledownloader\yourfileupdater.exe"
Owner:	User
Parent process:	taskeng.exe (Task Scheduler Engine by Microsoft)

Distribution by Windows OS

OS version	distribution
Windows 7 Ultimate	36.78%
Windows 7 Home Premium	24.14%
Microsoft Windows XP	21.84%
Windows 8 Pro	6.90%
Windows 7 Professional	3.45%
Windows 7 Home Basic	3.45%
Windows 8	2.30%
Windows 8 Enterprise	1.15%

Distribution by country

United States installs about 28.74% of YourFile Downloader.

Distribution by PC manufacturer

PC Manufacturer	distribution
Hewlett-Packard	29.27%
Acer	21.95%
Dell	19.51%
Sony	14.63%
GIGABYTE	4.88%
Toshiba	4.88%
Alienware	2.44%
American Megatrends	2.44%

Remove Adware and Spyware Programs, FREE Download!