» focusbasebho.dll
Overview
Analysis
File Details
Behaviors (1)
Programs (1)

focusbasebho.dll

focusbase

Part of the Yontoo adware component, a web browser plugin that injects unwanted ads in the browser. The module focusbasebho.dll by focusbase has been detected as adware by 31 anti-malware scanners. It is installed within the context of Internet Explore as a BHO (Browser Helper Object) under the name ‘focusbase’. This file is typically installed with the program focusbase by Yontoo Technology, Inc. which is a potentially unwanted software program. It will plug into the web browser and display context-based advertisements by overwriting existing ads or by inserting new ones on various web pages.

File name:

focusbasebho.dll

Publisher:

focusbase (signed and verified)

Product:

focusbase

Version:

1.0.0.3

MD5:

3513c821acc5244b04916563f5202460

SHA-1:

51937f7d07505f9656c9fa5637e3c7f09a81ed65

SHA-256:

30405f5cbf6db0dd6fe28c8dded8e0a67cd85fdd520c7f248b902972495cc04f

Scanner detections:

31 / 68

Status:

Adware

Explanation:

Injects advertising in the web browser in various formats.

Analysis date:

4/19/2024 1:37:47 PM UTC (today)

Scan engine

Detection

Engine version

Lavasoft Ad-Aware

Gen:Variant.Adware.BHO.Agent.4

927

Agnitum Outpost

PUA.Agent

7.1.1

AhnLab V3 Security

Adware/Win32.Agent

2014.07.16

Avira AntiVirus

APPL/BrowseFox.Gen2

7.11.156.32

AVG

Adware BrowseFox.F

2014.0.3986

Baidu Antivirus

Adware.Win32.Agent

4.0.3.14723

Bitdefender

Gen:Variant.Adware.BHO.Agent.4

1.0.20.1020

Comodo Security

Application.Win32.Altbrowse.AK

18636

Dr.Web

Trojan.BPlug.17

9.0.1.05190

Emsisoft Anti-Malware

Gen:Variant.Adware.BHO.Agent

8.14.07.23.11

ESET NOD32

Win32/BrowseFox.F potentially unwanted application

7.0.302.0

Fortinet FortiGate

Adware/Agent

7/23/2014

F-Secure

Gen:Variant.Adware.BHO.Agent.4

11.2014-23-07_4

G Data

Gen:Variant.Adware.BHO.Agent

14.7.24

IKARUS anti.virus

not-a-virus:AdWare.Win32.Agent

t3scan.1.6.1.0

K7 AntiVirus

Unwanted-Program

13.180.12626

Kaspersky

not-a-virus:AdWare.Win32.Agent

15.0.0.494

Malwarebytes

PUP.Optional.FocusBase.A

v2014.07.23.11

McAfee

Artemis!76D05886FD97

5600.7061

MicroWorld eScan

Gen:Variant.Adware.BHO.Agent.4

15.0.0.612

NANO AntiVirus

Riskware.Win32.Agent.crkvek

0.28.0.60253

nProtect

Trojan-Clicker/W32.Agent.249632.B

14.07.06.01

Panda Antivirus

Trj/CI.A

14.07.23.11

Qihoo 360 Security

HEUR/Malware.QVM30.Gen

1.0.0.1015

Quick Heal

AdWare.Agent.r5 (Not a Virus)

7.14.14.00

Reason Heuristics

Adware.Yontoo.focusbase.M

14.7.23.11

Sophos

Generic PUA MB

4.98

SUPERAntiSpyware

Adware.BrowseFox/Variant

10466

Trend Micro House Call

Suspicious_GEN.F47V0621

7.2.204

VIPRE Antivirus

Yontoo

30562

Zillya! Antivirus

Adware.Agent.Win32.9068

2.0.0.1835

File size:

243.8 KB (249,632 bytes)

Product version:

1.0.0.3

Original file name:

focusbaseIEClient.dll

File type:

Dynamic link library (Win32 DLL)

Language:

English (United States)

Common path:

C:\Program Files\focusbase\focusbasebho.dll

Digital Signature

Signed by:

focusbase

Authority:

VeriSign, Inc.

Valid from:

4/22/2014 2:00:00 AM

Valid to:

4/23/2015 1:59:59 AM

Subject:

CN=focusbase, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=focusbase, L=Santa Monica, S=California, C=US

Issuer:

CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:

229BE95AFAF17766126629CC0A897C5F

Registration

CLSID:

{8fda85d4-b14a-49f5-9de6-f91c4ec5aaf4}

COM registered:

Yes

File PE Metadata

Compilation timestamp:

7/23/2014 2:06:36 AM

OS version:

6.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

11.0

CTPH (ssdeep):

3072:Y3zAFVxVbC/hm4w9uRil2D/IDoHedRpjP+61IaIsQPfoayS:Y3zeK92ukDxdHL91I1njyS

Entry address:

0x12844

Entry point:

55, 8B, EC, 83, 7D, 0C, 01, 75, 05, E8, 41, 8D, 00, 00, FF, 75, 10, FF, 75, 0C, FF, 75, 08, E8, 07, 00, 00, 00, 83, C4, 0C, 5D, C2, 0C, 00, 6A, 0C, 68, 30, 2D, 03, 10, E8, BD, 01, 00, 00, 33, C0, 40, 8B, 75, 0C, 85, F6, 75, 0C, 39, 35, 24, 68, 03, 10, 0F, 84, E4, 00, 00, 00, 83, 65, FC, 00, 83, FE, 01, 74, 05, 83, FE, 02, 75, 35, 8B, 0D, 8C, A1, 02, 10, 85, C9, 74, 0C, FF, 75, 10, 56, FF, 75, 08, FF, D1, 89, 45, E4, 85, C0, 0F, 84, B1, 00, 00, 00, FF, 75, 10, 56, FF, 75, 08, E8, 11, FE, FF, FF, 89, 45, E4... 
[+]

Developed / compiled with:

Microsoft Visual C++

Code size:

159 KB (162,816 bytes)

Internet Explorer BHO

Display name:

focusbase

CLSID:

{8fda85d4-b14a-49f5-9de6-f91c4ec5aaf4}

The file focusbasebho.dll has been discovered within the following programs.

focusbase by Yontoo Technology, Inc.

focusbase is an adware web browser extension that is display banners ads as well as contextual link ads . The ads are injected by the web browser plugin (IE, FF and Chrome) and will display on any web site, even those not associated or affiliated with the publisher.

focusbase.info/support

87% remove it

Remove focusbasebho.dll - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.