» Smartbar.Infrastructure.EventManager.dll
Overview
Analysis
File Details
Programs (1)

Smartbar.Infrastructure.EventManager.dll

Linkury

This is part of the Linkury monetization software, a web browser toolbar used to 'hijack' a user's search in order to collect revenues. The Linkury SmartBar is a a potentially unwanted toolbar and Windows Gadget that is advertising supported. The module Smartbar.Infrastructure.EventManager.dll by Linkury has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. This file is typically installed with the program Messenger Plus! Community Smartbar by Messenger Plus! which is a potentially unwanted software program.

File name:

Publisher:

Linkury (signed and verified)

Version:

0.0.0.0

MD5:

7aea8ff9585cc31adb4db25996f9b37a

SHA-1:

1d9b97040bd4965fe7e8ccaa8a5a742b17fd90cf

SHA-256:

ec8232336064b31d36a1e68e614bc2948afd2245a6e94d24bfaa10b541c59187

Scanner detections:

1 / 68

Status:

Adware

Note:

Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Analysis date:

4/24/2024 11:48:39 AM UTC (today)

Scan engine

Detection

Engine version

Reason Heuristics

PUP.Smartbar.Linkury (M)

16.2.11.12

File size:

11.8 KB (12,120 bytes)

Product version:

0.0.0.0

Original file name:

Smartbar.Infrastructure.EventManager.dll

File type:

Dynamic link library (Win32 DLL)

Language:

Language Neutral

Common path:

C:\users\{user}\appdata\local\smartbar\application\smartbar.infrastructure.eventmanager.dll

Digital Signature

Signed by:

Linkury

Authority:

VeriSign, Inc.

Valid from:

4/12/2012 2:00:00 AM

Valid to:

5/12/2015 1:59:59 AM

Subject:

CN=Linkury, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=Linkury, L=Ramat Gan, S=Israel, C=IL

Issuer:

CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:

77A9B89A06B99100955A838E8BB46FF8

File PE Metadata

Compilation timestamp:

10/10/2012 6:28:15 PM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows Console

Linker version:

8.0

.NET CLR dependent:

Yes

CTPH (ssdeep):

192:Pwf7JZwDJvd5amBYIFnE335/wJirNmL/nrVs48s+vO+5zr9ZCspE+TMIruZQXo:PME15tBYIFnE3mirILxs41eMBZr

Entry address:

0x2E8E

Entry point:

FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00... 
[+]

Developed / compiled with:

Microsoft Visual C# / Basic .NET

Code size:

4 KB (4,096 bytes)

The file Smartbar.Infrastructure.EventManager.dll has been discovered within the following program.

Messenger Plus! Community Smartbar by Messenger Plus!

The Toolbar installs into your Internet browser and allows you to search the Internet with MyWebSearch, a known potentially unwanted program that changes and redircts all of your search results as well as DNS errors, and modifies your home page to mywebsearch.

pages.msgplus.net/toolbar/faq.html

62% remove it

Remove Smartbar.Infrastructure.EventManager.dll - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.