home

ge-force-buttonutil.dll

Sailor Project

This potentially unwanted Internet browser extension is built upon and distributed using the free Crossrider platform and will deliver advertisements to the web browser in various formats such as banner, text hyper-links, inline text and transitional ads. The module ge-force-buttonutil.dll by Sailor Project has been detected as adware by 13 anti-malware scanners. This file is typically installed with the program Ge-Force by Sailor Project which is a potentially unwanted software program. The ButtonUtil module (32-bit version) uses the Crossrider web extension monetization toolkit and will perform a number of helper integration activities on the user's web browser's as well as the Window's Shell in order to install the addon. It is distributed as part of the Brightcircle group of browser-extensions.
Publisher:
Sailor Project  (signed and verified)

MD5:
0f27fd52bc8ed36789d428b2e8365f93

SHA-1:
2635bd40df072449b5420217ce755bffc28aecf1

SHA-256:
a3e93218635a537f6aee794bcf1d074be2a4cef7cf39f7126e861e1a7b9df535

Scanner detections:
13 / 68

Status:
Adware

Explanation:
Part of the Crossrider toolbar platform. Distributed through the Brightcircle investments brand.

Note:
Crossrider is the owner of a platform that enables the creation of cross-browser extensions by developers but is not the owner of this detected application. The owner/publisher of this file is Sailor Project.

Analysis date:
5/3/2024 7:54:35 AM UTC  (today)

Scan engine
Detection
Engine version

avast!
Win32:Crossrider-N [PUP]
2014.9-141103

AVG
Generic
2015.0.3355

Baidu Antivirus
Trojan.Win32.GoogUpdate
4.0.3.14911

Dr.Web
DLOADER.Trojan
9.0.1.0254

ESET NOD32
Win32/Toolbar.CrossRider.AA potentially unwanted application
8.7.0.302.0

herdProtect (fuzzy)
variant of thetorntv v10-buttonutil.dll (Adware)
2014.11.3.17

IKARUS anti.virus
PUA.CrossRider
t3scan.1.7.5.0

Kaspersky
Trojan.NSIS.GoogUpdate
14.0.0.3269

Panda Antivirus
Trj/Chgt.B
14.09.11.02

Qihoo 360 Security
Win32/Trojan.3b1
1.0.0.1015

Reason Heuristics
PUP.Crossrider.SailorProject.T
14.9.11.2

Rising Antivirus
PE:Malware.Obscure!1.9C59
23.00.65.14909

Sophos
AppRider
4.98

File size:
369.9 KB (378,728 bytes)

File type:
Dynamic link library (Win32 DLL)

Common path:
C:\Program Files\ge-force\ge-force-buttonutil.dll

Digital Signature
Signed by:
Sailor Project

Authority:
COMODO CA Limited

Valid from:
7/18/2014 3:00:00 AM

Valid to:
7/19/2015 2:59:59 AM

Subject:
CN=Sailor Project, O=Sailor Project, STREET=Athinodorou 3, STREET=Dasoupoli Strovolos, L=Nicosia, S=Cyprus, PostalCode=2025, C=CY

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
47C5F145C734CD3D086C0A102176F0A1

File PE Metadata
Compilation timestamp:
8/11/2014 4:59:46 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

CTPH (ssdeep):
6144:Hxhsx53yksAcsykYvnhznJZ16Dz3TBVXN61ail/xr7+BT:HDsxEXjhr31Uz3Tz9y7Vl7+BT

Entry address:
0x25C13

Entry point:
55, 8B, EC, 83, 7D, 0C, 01, 75, 05, E8, 41, 9C, 00, 00, FF, 75, 10, FF, 75, 0C, FF, 75, 08, E8, 07, 00, 00, 00, 83, C4, 0C, 5D, C2, 0C, 00, 6A, 0C, 68, 98, 92, 04, 10, E8, 0E, 36, 00, 00, 33, C0, 40, 8B, 75, 0C, 85, F6, 75, 0C, 39, 35, 28, 11, 05, 10, 0F, 84, E4, 00, 00, 00, 83, 65, FC, 00, 83, FE, 01, 74, 05, 83, FE, 02, 75, 35, 8B, 0D, 10, 27, 04, 10, 85, C9, 74, 0C, FF, 75, 10, 56, FF, 75, 08, FF, D1, 89, 45, E4, 85, C0, 0F, 84, B1, 00, 00, 00, FF, 75, 10, 56, FF, 75, 08, E8, 11, FE, FF, FF, 89, 45, E4...
 
[+]

Entropy:
6.3018

Developed / compiled with:
Microsoft Visual C++

Code size:
243.5 KB (249,344 bytes)

The file ge-force-buttonutil.dll has been discovered within the following program.

Ge-Force  by Sailor Project
Ge-Force/iWebbar is an advertising supported (adware) extension that runs in the context of the user's web browser as well as a process in the background.
crossrider.com/install/61911-ge-forces
80% remove it
 
Powered by Should I Remove It?

Remove ge-force-buttonutil.dll - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.