Adware/OpenCandyBundledWinzipInstaller Adware/OpenCandyBundledWinzipInstaller is a generic detection for an unwanted application. Since this is a generic detection, Grayware samples that are detected as Adware/OpenCandyBundledWinzipInstaller may have varying behaviour. Below are some of its observed characteristics/behaviours: This detection is for an installer observed to have bundled applications.
For this particular detection the main application being bundled along with is an archiving utility called Winzip.
This installer was known to make use of a packaging/bundling known as OpenCandy. The installation would oftentimes involve affecting changes on the user's settings, albeit in some cases these are presented as optional but are defaulted to enabled: installation of third party security vendor installation of toolbar for user browser modification of current user default search engine modification of current user default home page additional installation of related products to main application, in this case referred to as Winzip Courier Samples were observed as well to connect to a certain ct3106777.ourtoolba[Removed].com
Users are generally advised to use an unbundled version of the application whenever possible, or should find/download them on the main publisher's website.
Below are some illustration of the Installation: Figure 1: Application main installed. Figure 2: User settings modifications. Figure 3: Installation of a third party security vendor. Figure 4: another component installation. Following are some of the near/exact IOCs/file hash associated with this detection: 33fc0832b2f2f127fe350b824d9f07d5 55de67c95c36bead40e1f0b1dc795cfe b101a1ccd85f0f3c1b942837a86db2db
Make sure that your FortiGate/FortiClient system is using the latest AV database.
Quarantine/delete files that are detected and replace infected files with clean backup copies.
