home

rightsurf.ieupdate.dll

RightSurf

This is the Internet Explorer add-on for the Yontoo RightSurf branded web browser plugin (injects banner, text-link and popup ads). The component is responisble for registering the Browser Helper Object into IE and keeping it registered. The module rightsurf.ieupdate.dll by RightSurf has been detected as adware by 21 anti-malware scanners. It will plug into the web browser and display context-based advertisements by overwriting existing ads or by inserting new ones on various web pages.
Publisher:
RightSurf  (signed and verified)

Version:
1.0.5501.18958

MD5:
5c808b92f85ae2c90fe0d3dbb5ad5f82

SHA-1:
f736a142123de3487197cfdaddf06f32def22c35

SHA-256:
395ce7f562e94b3f645a50cce09cc19bf3e9a4f7d52a7aebb423c2af34b9f3c8

Scanner detections:
21 / 68

Status:
Adware

Explanation:
Part of the Yontoo distributed ad-supported web browser add-on for Internet Explorer.

Analysis date:
4/25/2024 6:26:39 PM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Adware.BrowseFox.AU
6435775

AhnLab V3 Security
Win-PUP/BrowseFox.Gen
2015.01.25

Avira AntiVirus
ADWARE/BrowseFox.Gen7
7.11.204.248

avast!
Win32:BrowseFox-Z [PUP]
150101-1

AVG
Generic
2016.0.3219

Baidu Antivirus
Adware.MSIL.BrowseFox
4.0.3.15125

Bitdefender
Adware.BrowseFox.AU
1.0.20.125

Bkav FE
W32.HfsAdware
1.3.0.6379

Emsisoft Anti-Malware
Adware.BrowseFox.AU
9.0.0.4799

ESET NOD32
MSIL/BrowseFox.L potentially unwanted application
7.0.302.0

F-Prot
W32/S-7aa9c30a
v6.4.7.1.166

F-Secure
Adware.BrowseFox.AU
5.13.68

G Data
Adware.BrowseFox.AU
15.1.24

IKARUS anti.virus
PUA.MSIL.BrowseFox
t3scan.1.8.6.0

K7 AntiVirus
Adware
13.192.14746

McAfee
Artemis!5C808B92F85A
5600.6875

MicroWorld eScan
Adware.BrowseFox.AU
16.0.0.75

nProtect
Adware.BrowseFox.AU
15.01.23.01

Qihoo 360 Security
Win32/Virus.Adware.708
1.0.0.1015

Reason Heuristics
Adware.Yontoo.RightSurf
15.1.25.1

VIPRE Antivirus
Yontoo
36956

File size:
657.2 KB (673,008 bytes)

Product version:
1.0.5501.18958

Original file name:
RightSurf.IEUpdate2015012318.dll

File type:
Dynamic link library (Win32 DLL)

Language:
Language Neutral

Common path:
C:\Program Files\rightsurf\bin\plugins\rightsurf.ieupdate.dll

Digital Signature
Signed by:
RightSurf

Authority:
VeriSign, Inc.

Valid from:
11/4/2014 5:30:00 AM

Valid to:
1/4/2016 5:29:59 AM

Subject:
CN=RightSurf, O=RightSurf, L=San Diego, S=California, C=US

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
1E8F736F9D4CC702BAD040A691E0353D

File PE Metadata
Compilation timestamp:
1/24/2015 12:02:00 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows Console

Linker version:
6.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
12288:oSs31rDAsvcuZFLet9FaPEX6eXg9ZbPjhRGiDMkCHb2v36FgV:hErZcuZFqHtX6Ig9ZbrhRQb2fmgV

Entry address:
0xA431A

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Entropy:
7.8218

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
649 KB (664,576 bytes)

Remove rightsurf.ieupdate.dll - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.