home

Smartbar.Personalization.ServicesPlugins.WordPlugin.dll

WordPlugin

Yuna Software Limited

This is part of the Linkury/SnapDo monetization software, a web browser toolbar used to hijack a user's search in order to collect revenues. The SmartBar is a a potentially unwanted toolbar and Windows Gadget that is advertising supported (adware). The module Smartbar.Personalization.ServicesPlugins.WordPlugin.dll by Yuna Software Limited has been detected as a potentially unwanted program by 4 anti-malware scanners. This file is typically installed with the program Messenger Plus! Community Smartbar by Messenger Plus! which is a potentially unwanted software program.
Publisher:
xxx  (signed by Yuna Software Limited)

Product:
WordPlugin

Version:
1.2.0.0

MD5:
3a276f2560991ecbfcf1af5d1bfabdae

SHA-1:
b50f3f81e02228c60f6ecd5e67955f82f6dcce3b

SHA-256:
66e3d2d26671d8e46f6782beffaf0945b08cedd40cf09b3db92386dfb5e9f270

Scanner detections:
4 / 68

Status:
Potentially unwanted

Analysis date:
4/26/2024 2:13:03 PM UTC  (today)

Scan engine
Detection
Engine version

Avira AntiVirus
APPL/Linkury.Gen2
7.11.197.38

AVG
Resoft
2017.0.2834

Dr.Web
Trojan.Lyrics.844
9.0.1.044

Reason Heuristics
Win32.Generic
16.2.13.12

File size:
12.3 KB (12,616 bytes)

Product version:
1.2.0.0

Copyright:
Copyright © xxx 2010

Original file name:
Smartbar.Personalization.ServicesPlugins.WordPlugin.dll

File type:
Dynamic link library (Win32 DLL)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\smartbar\common\servicesplugins\smartbar.personalization.servicesplugins.wordplugin.dll

Digital Signature
Signed by:
Yuna Software Limited

Authority:
VeriSign, Inc.

Valid from:
10/19/2009 10:00:00 PM

Valid to:
10/19/2012 8:59:59 PM

Subject:
CN=Yuna Software Limited, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=Yuna Software Limited, L=St. Helier, S=Jersey, C=GB

Issuer:
CN=VeriSign Class 3 Code Signing 2009-2 CA, OU=Terms of use at https://www.verisign.com/rpa (c)09, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
6DF4318F9EA4EEB8E01F4B0B02CDF983

File PE Metadata
Compilation timestamp:
3/20/2012 11:01:54 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows Console

Linker version:
8.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
192:96PskmVPzmmtCH91hUCC1SfIVHOpTMtyowJL/8to+ebCfKQpkqs1IRV:MtQC4+zkwfIVmTMtYJLI+bCw1e

Entry address:
0x326E

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
5 KB (5,120 bytes)

The file Smartbar.Personalization.ServicesPlugins.WordPlugin.dll has been discovered within the following program.

Messenger Plus! Community Smartbar  by Messenger Plus!
The Toolbar installs into your Internet browser and allows you to search the Internet with MyWebSearch, a known potentially unwanted program that changes and redircts all of your search results as well as DNS errors, and modifies your home page to mywebsearch.
pages.msgplus.net/toolbar/faq.html
62% remove it
 
Powered by Should I Remove It?

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.