» common.dll
Overview
Analysis
File Details
Behaviors (1)
Programs (1)

common.dll

Websteroids

Creative Island Media, LLC

This is part of an adware program designed to inject advertising in the web browser (banners, text-links) as well as modify the normal behavior of the browser. Part of the Injekt brand of unwanted programs. The module common.dll by Creative Island Media has been detected as adware by 18 anti-malware scanners. It is installed within the context of Internet Explore as a BHO (Browser Helper Object) under the name ‘Websteroids’. This file is typically installed with the program Websteroids by Creative Island Media, LLC which is a potentially unwanted software program.

File name:

common.dll

Publisher:

Creative Island Media, LLC (signed and verified)

Product:

Websteroids

Version:

2.6.53

MD5:

01ced262e2ba3a4ec7f63908c106ad3e

SHA-1:

255f4091d142bba39ebac8f789c12961ed3ae500

SHA-256:

22b4a43d36b7f86507d94dfbbf2ca7262074c6a4084e45fb61c1859244a8def0

Scanner detections:

18 / 68

Status:

Adware

Explanation:

Injects display ads (banner ads), in-text ads, interstitial ads, or other types of ads in the web browser as well as alters the browsers settings (home page, search, DNS, and security protocols).

Analysis date:

4/26/2024 11:26:39 AM UTC (today)

Scan engine

Detection

Engine version

Lavasoft Ad-Aware

Adware.Agent.NUR

1034

avast!

Win32:BHO-AMO [PUP]

2014.9-140407

Bitdefender

Adware.Agent.NUR

1.0.20.485

Dr.Web

Adware.Plugin.128

9.0.1.097

Emsisoft Anti-Malware

Adware.Agent.NUR

8.14.04.07.03

ESET NOD32

Win32/ExFriendAlert (variant)

8.9618

Fortinet FortiGate

Riskware/ExFriendAlert

4/7/2014

F-Secure

Adware.Agent.NUR

11.2014-07-04_2

G Data

Adware.Agent.NUR

14.4.24

IKARUS anti.virus

AdWare.Agent

t3scan.2.2.29

K7 AntiVirus

Unwanted-Program

13.176.11613

McAfee

Artemis!01CED262E2BA

5600.7168

MicroWorld eScan

Adware.Agent.NUR

15.0.0.291

NANO AntiVirus

Trojan.Win32.Plugin.ctuood

0.28.0.58720

nProtect

Adware.Agent.NUR

14.03.31.01

Reason Heuristics

PUP.BHO.CreativeIslandMedia.G

14.8.7.20

Sophos

Search Donkey

4.98

VIPRE Antivirus

SearchDonkey

27902

File size:

399.9 KB (409,464 bytes)

Product version:

2.6.53

Original file name:

common.dll

File type:

Dynamic link library (Win32 DLL)

Language:

English (United States)

Common path:

C:\ProgramData\websteroids\ie\common.dll

Digital Signature

Signed by:

Creative Island Media, LLC

Authority:

VeriSign, Inc.

Valid from:

5/21/2013 10:00:00 AM

Valid to:

5/22/2014 9:59:59 AM

Subject:

CN="Creative Island Media, LLC", OU=Digital ID Class 3 - Microsoft Software Validation v2, O="Creative Island Media, LLC", L=San Diego, S=California, C=US

Issuer:

CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:

68F23F4D2767F6491DEA9186F2E5CB89

File PE Metadata

Compilation timestamp:

12/19/2013 8:54:19 AM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

10.0

CTPH (ssdeep):

6144:+v0n4PCCWLGrloWs1qSnes/xkmNQc7PXh5zsfS1qBUWVoM3aitA:BUrXs1nn//9NbPXXzsKitA

Entry address:

0x15A0C

Entry point:

8B, FF, 55, 8B, EC, 83, 7D, 0C, 01, 75, 05, E8, 14, 5D, 00, 00, FF, 75, 08, 8B, 4D, 10, 8B, 55, 0C, E8, EC, FE, FF, FF, 59, 5D, C2, 0C, 00, CC, 8B, FF, 55, 8B, EC, 83, EC, 18, 53, 8B, 5D, 0C, 56, 8B, 73, 08, 33, 35, A0, 9C, 04, 10, 57, 8B, 06, C6, 45, FF, 00, C7, 45, F4, 01, 00, 00, 00, 8D, 7B, 10, 83, F8, FE, 74, 0D, 8B, 4E, 04, 03, CF, 33, 0C, 38, E8, EE, C1, FF, FF, 8B, 4E, 0C, 8B, 46, 08, 03, CF, 33, 0C, 38, E8, DE, C1, FF, FF, 8B, 45, 08, F6, 40, 04, 66, 0F, 85, 19, 01, 00, 00, 8B, 4D, 10, 8D, 55, E8... 
[+]

Entropy:

6.4211

Code size:

232.5 KB (238,080 bytes)

Internet Explorer BHO

Display name:

Websteroids

CLSID:

{44ed99e2-16a6-4b89-80d6-5b21cf42e78b}

The file common.dll has been discovered within the following program.

Websteroids by Creative Island Media, LLC

This is ad-supported (adware) software, part of Injekt, that is very difficult to remove as the publisher will ignore the Windows Add/Remove feature and re-install it after the user reboot their PC.

www.websteroidsapp.com

83% remove it

Remove common.dll - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.