» SmartbarInternetExplorerBHO.dll
Overview
Analysis
File Details
Programs (2)

SmartbarInternetExplorerBHO.dll

SmartbarInternetExplorerBHO

PINWID LTD

The module SmartbarInternetExplorerBHO.dll by PINWID has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. Additionally, the file is typically installed by a number of programs including SavePass Smartbar by Pinwid Ltd. and SavePass Smartbar Engine by PinWid Ltd., both potentially unwanted software.

File name:

Publisher:

PINWID LTD (signed and verified)

Product:

SmartbarInternetExplorerBHO

Version:

1.0.0.0

MD5:

4df27c157f10da433bde264cefe4513e

SHA-1:

e352943344b2d758f591ee84b518eee2bcc36418

SHA-256:

424310d9c69b03b456a6d4939642859c4b0d2c31111464bafaf849a7f16f1a11

Scanner detections:

1 / 68

Status:

Adware

Note:

Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Analysis date:

4/25/2024 2:29:52 PM UTC (today)

Scan engine

Detection

Engine version

Reason Heuristics

PUP.PINWID.BB

14.3.20.12

File size:

145.5 KB (149,024 bytes)

Product version:

1.0.0.0

Original file name:

SmartbarInternetExplorerBHO.dll

File type:

Dynamic link library (Win32 DLL)

Language:

Language Neutral

Common path:

C:\users\{user}\appdata\local\smartbar\application\smartbarinternetexplorerbho.dll

Digital Signature

Signed by:

PINWID LTD

Authority:

COMODO CA Limited

Valid from:

2/4/2014 6:00:00 PM

Valid to:

2/5/2015 5:59:59 PM

Subject:

CN=PINWID LTD, O=PINWID LTD, STREET=14 Shenkar Arie, L=HERZLIYA, S=NA, PostalCode=46733, C=IL

Issuer:

CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:

00D9AC9FC9A1B1E8FD63013E3CCE7B0578

File PE Metadata

Compilation timestamp:

3/2/2014 6:20:28 AM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows Console

Linker version:

6.0

.NET CLR dependent:

Yes

CTPH (ssdeep):

3072:sw5dOl9Ub6GvCi09s2o2skAieiu4U+Jy:FElSTvCD8kAiel+

Entry address:

0x241EE

Entry point:

FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 40, 02, 00, 0C, 00, 00, 00, F0, 31, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00... 
[+]

Entropy:

6.1329

Developed / compiled with:

Microsoft Visual C# / Basic .NET

Code size:

136.5 KB (139,776 bytes)

The file SmartbarInternetExplorerBHO.dll has been discovered within the following programs.

SavePass Smartbar by Pinwid Ltd.

From the EULA: "The Toolbar interacts with your computer by: Displaying advertisements, including without limitation by inserting into web pages or displaying over parts of such web pages advertisements, banners or coupons that would not otherwise appear; Converting words on pages you view into hyperlinks that are linked to advertisements; Communicating with our servers to check for new offers, the placement of offers, the date and time you install and uninstall the Toolbar, and whether an updated version of the Toolbar is available; Monitoring and recording the domain name of each page you view, the advertisements that appear on these pages, and the advertisements that you click.

www.browse-search.com

82% remove it

SavePass Smartbar Engine by PinWid Ltd.

This adware program injects advertisements with its affiliate ad providers in order to serve a number of ad types including banner, inline text links and popups.

80% remove it

Remove SmartbarInternetExplorerBHO.dll - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.