» PCGizmosBHO.dll
Overview
Analysis
File Details
Behaviors (1)
Programs (1)

PCGizmosBHO.dll

PC Gizmos BHO

PC-Gizmos LTD

The module PCGizmosBHO.dll by PC-Gizmos has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. It is installed within the context of Internet Explore as a BHO (Browser Helper Object) under the name ‘PCGizmosBHO’. This file is typically installed with the program Facebook Emoticons by PC Gizmos LTD.

File name:

PCGizmosBHO.dll

Publisher:

PC Gizmos (signed by PC-Gizmos LTD)

Product:

PC Gizmos BHO

Version:

1.0.0.6

MD5:

b14191cada7547bc3d1b4f46c2ccfd05

SHA-1:

e270d52a33d3c010aa7c1a8be66aef08c6be3e35

SHA-256:

49b94526e014a30d017e65135f701944618886a5d1ab61192c5baa49e67eb873

Scanner detections:

1 / 68

Status:

Potentially unwanted

Note:

Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Analysis date:

4/19/2024 9:23:15 PM UTC (today)

Scan engine

Detection

Engine version

Reason Heuristics

PUP.BHO.PCGizmos.L

14.3.2.17

File size:

101.6 KB (104,000 bytes)

Product version:

1.0.0.6

Original file name:

PCGizmosBHO.dll

File type:

Dynamic link library (Win32 DLL)

Language:

English (United States)

Common path:

C:\users\{user}\appdata\roaming\pc-gizmos\pcgizmosbho.dll

Digital Signature

Signed by:

PC-Gizmos LTD

Authority:

COMODO CA Limited

Valid from:

5/17/2012 3:00:00 AM

Valid to:

5/18/2013 2:59:59 AM

Subject:

CN=PC-Gizmos LTD, OU=Web, O=PC-Gizmos LTD, STREET=1 Azrieli Center, STREET=19 floor, STREET=C/O BAS Law, L=Tel Aviv, S=Israel, PostalCode=67021, C=IL

Issuer:

CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:

008ED22FA36113DA901306BF9F7C731477

Registration

CLSID:

{A817C286-3D6B-4ECD-A99C-E44E50DBC523}

ProgID:

PCGizmosBHO.PCGizmosObj.1

COM registered:

Yes

File PE Metadata

Compilation timestamp:

4/19/2012 11:47:14 PM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

10.0

CTPH (ssdeep):

1536:qJlcdWIQLHegQtoAndMHO12ukWW6FtYnyf/KrjL3EYhB:SnDegQtoedMHO2gWQtm+/KrjzZ

Entry address:

0xA416

Entry point:

8B, FF, 55, 8B, EC, 83, 7D, 0C, 01, 75, 05, E8, 81, 35, 00, 00, FF, 75, 08, 8B, 4D, 10, 8B, 55, 0C, E8, EC, FE, FF, FF, 59, 5D, C2, 0C, 00, 6A, 0C, 68, 28, 42, 01, 10, E8, 8B, 01, 00, 00, 6A, 0E, E8, 70, 37, 00, 00, 59, 83, 65, FC, 00, 8B, 75, 08, 8B, 4E, 04, 85, C9, 74, 2F, A1, A8, 63, 01, 10, BA, A4, 63, 01, 10, 89, 45, E4, 85, C0, 74, 11, 39, 08, 75, 2C, 8B, 48, 04, 89, 4A, 04, 50, E8, 49, E6, FF, FF, 59, FF, 76, 04, E8, 40, E6, FF, FF, 59, 83, 66, 04, 00, C7, 45, FC, FE, FF, FF, FF, E8, 0A, 00, 00, 00... 
[+]

Entropy:

6.3002

Code size:

58.5 KB (59,904 bytes)

Internet Explorer BHO

Display name:

PCGizmosBHO

CLSID:

{A817C286-3D6B-4ECD-A99C-E44E50DBC523}

CLSID name:

PC Gizmos BHO

The file PCGizmosBHO.dll has been discovered within the following program.

Facebook Emoticons by PC Gizmos LTD

Publisher's description - “Facebook Emoticons gives you many emoticons, smiley and icons. It is a simple add-on to your Facebook page. It adds a wide variety of emoticons, smileys and icons for you to choose from.”

www.pc-gizmos.com

47% remove it

Remove PCGizmosBHO.dll - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.