» ButtonSite.dll
Overview
Analysis
File Details
Programs (1)

ButtonSite.dll

Add-ons Framework

We Code Good Inc.

This is the Performersoft setup installer. The module ButtonSite.dll by We Code Good has been detected as adware by 6 anti-malware scanners. The program is a setup application that uses the InstallBrain installer. This file is typically installed with the program Smiley Bar for Facebook by Status Winks which is a potentially unwanted software program.

File name:

ButtonSite.dll

Publisher:

We Code Good Inc. (signed and verified)

Product:

Add-ons Framework

Description:

ButtonSite

Version:

0.9.3.25

MD5:

6717007f29a9efdedad418f14fcd43db

SHA-1:

96ee5ff7026dcb5ef49c559f906c2f2e75b8c3e6

SHA-256:

49b301f3079f06a47f1f6ea13a6096b9009eef4e087d9a831bbf50cea1275035

Scanner detections:

6 / 68

Status:

Adware

Explanation:

Part of the Besttoolbars Add-on framework for Internet Explorer, Chrome and Firefox.

Description:

This is an installer which may bundle legitimate applications with offers for additional 3rd-party applications that may be unwanted by the user. While the installer contains an 'opt-out' feature this is not set be defult and is usually overlooked.

Analysis date:

2/7/2026 7:32:59 AM UTC (today)

Scan engine

Detection

Engine version

ESET NOD32

Win32/Toolbar.Besttoolbars (variant)

10.9188

McAfee

Artemis!1EB235449464

5600.6485

Reason Heuristics

PUP.Besttoolbars.Performersoft.Bundler (M)

16.2.18.22

Trend Micro House Call

TROJ_GEN.F47V1216

7.2.49

VIPRE Antivirus

Besttoolbars

24494

XVirus List

Win.Detected

2.3.31

File size:

338.3 KB (346,424 bytes)

Product version:

0.9.3.25

Original file name:

ButtonSite.dll

File type:

Dynamic link library (Win32 DLL)

Bundler/Installer:

InstallBrain

Language:

English (United States)

Common path:

C:\Program Files\smiley bar for facebook\buttonsite.dll

Digital Signature

Signed by:

We Code Good Inc.

Authority:

GoDaddy.com, Inc.

Valid from:

11/1/2012 5:20:37 PM

Valid to:

11/1/2015 5:20:37 PM

Subject:

CN=We Code Good Inc., O=We Code Good Inc., L=Beaverton, S=OR, C=US

Issuer:

SERIALNUMBER=07969287, CN=Go Daddy Secure Certification Authority, OU=http://certificates.godaddy.com/repository, O="GoDaddy.com, Inc.", L=Scottsdale, S=Arizona, C=US

Serial number:

4EEF3A85620395

File PE Metadata

Compilation timestamp:

4/19/2013 4:46:39 AM

OS version:

5.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

9.0

CTPH (ssdeep):

6144:vK6RWjvkBzSdmYQImDSXjxStaPyvHIN7PYW8tF:vKvjcBzrYQImDSTxSRgNjYpH

Entry address:

0x21DE8

Entry point:

8B, FF, 55, 8B, EC, 83, 7D, 0C, 01, 75, 05, E8, E8, 76, 00, 00, FF, 75, 08, 8B, 4D, 10, 8B, 55, 0C, E8, EC, FE, FF, FF, 59, 5D, C2, 0C, 00, CC, 68, 70, 1E, 02, 10, 64, FF, 35, 00, 00, 00, 00, 8B, 44, 24, 10, 89, 6C, 24, 10, 8D, 6C, 24, 10, 2B, E0, 53, 56, 57, A1, 14, C1, 03, 10, 31, 45, FC, 33, C5, 50, 89, 65, E8, FF, 75, F8, 8B, 45, FC, C7, 45, FC, FE, FF, FF, FF, 89, 45, F8, 8D, 45, F0, 64, A3, 00, 00, 00, 00, C3, 8B, 4D, F0, 64, 89, 0D, 00, 00, 00, 00, 59, 5F, 5F, 5E, 5B, 8B, E5, 5D, 51, C3, CC, CC, CC... 
[+]

Code size:

199.5 KB (204,288 bytes)

The file ButtonSite.dll has been discovered within the following program.

Smiley Bar for Facebook by Status Winks

Smiley Bar for Facebook installs the "Monetization Platform", which is designed to show context based advertisements in your web browsers.

www.statuswinks.com

79% remove it

Remove ButtonSite.dll - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.