EXevalidAtor

ExeValidator is a web browser extension developed by JustPlug.It and distributed through the WebPick InstalleRex download and install manager. This cross-browser extension is commonly packaged with various adware offer bundles and consists of multiple components, including a Windows service, an auto-starting component, and a browser toolbar/plugin. Its primary function is to inject advertisements in the form of banner ads, hyper-text links, and popups, and may also hijack existing advertising on web pages and inject affiliate codes as coupon offers. Upon installation, ExeValidator will create a folder with a random name in Program Files or ProgramData, and each file will have a shared randomly generated name. The Windows Service installed with ExeValidator runs with full administrator rights under the Services control app and connects to remote servers for updates. The program also creates a server that listens for TCP network requests locally. The advertisements displayed by ExeValidator may include deceptive malvertising ads and unwanted pop-ups, and downloading the programs associated with it may install bundled adware utilities and additional browser extensions. Additionally, some versions of ExeValidator may modify the browser's default security levels. It is also worth noting that some versions of ExeValidator may include a setup file signed by WEB PICK - INTERNET HOLDINGS LTD, which is the partner installer/distributor.