» TBNotifier.exe
Overview
Analysis
File Details
Programs (1)
Network (4)

TBNotifier.exe

Ask TBNotifier

APN LLC

This is a component of the Ask.com toolbar, a browser extension that will modify the default web browser's search provider, home page and various other settings. The application TBNotifier.exe, “Ask Toolbar Notifier” by APN has been detected as a potentially unwanted program by 10 anti-malware scanners. This file is typically installed with the program Ask Shopping Toolbar by Ask.com which is a potentially unwanted software program. This version of the file will bundle the Ask.com Toolbar, a potentially unwanted web browser extension.

File name:

TBNotifier.exe

Publisher:

APN (signed by APN LLC)

Product:

Ask TBNotifier

Description:

Ask Toolbar Notifier

Version:

2.0.0.0

MD5:

756486fd3c4d77ea8c31a6e042962662

SHA-1:

56490cc78844da8f497838f38049b74a97a2660a

SHA-256:

4f0ac7331ea4ecf29ab115eef08fc0660778a11b06ff9cfcb729bde0118e0a7d

Scanner detections:

10 / 68

Status:

Potentially unwanted

Analysis date:

4/27/2024 3:05:28 AM UTC (today)

Scan engine

Detection

Engine version

AhnLab V3 Security

PUP/Win32.IECore

2013.11.27

Avira AntiVirus

TR/Trash.Gen

7.11.30.172

Baidu Antivirus

PUA.Win32.AskToolbar

4.0.3.16211

Bkav FE

W32.HfsAdware

1.3.0.6379

ESET NOD32

Win32/Bundled.Toolbar.Ask (variant)

10.9573

IKARUS anti.virus

Trojan.Trash

t3scan.1.9.2.0

Qihoo 360 Security

Malware.QVM20.Gen

1.0.0.1015

Reason Heuristics

PUP.Ask.APN.Toolbar (M)

16.2.11.17

Trend Micro House Call

TROJ_GEN.F47V0218

7.2.42

Vba32 AntiVirus

Malware-Cryptor.Hlux.2

3.12.26.3

File size:

891.2 KB (912,584 bytes)

Product version:

2.0.0.25001

Original file name:

TBNotifier.exe

File type:

Executable application (Win32 EXE)

Language:

English (United States)

Common path:

C:\Program Files\hp\hp laserjet p1000_p1500 series\Program Files\askpartnernetwork\toolbar\updater\tbnotifier.exe

Digital Signature

Signed by:

APN LLC

Authority:

VeriSign, Inc.

Valid from:

4/16/2012 7:00:00 AM

Valid to:

4/9/2015 6:59:59 AM

Subject:

CN=APN LLC, OU=Distribution, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=APN LLC, L=Oakland, S=California, C=US

Issuer:

CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:

27EAB3DE0B03D88D5C4A2AE477B84DFA

File PE Metadata

Compilation timestamp:

7/30/2012 4:43:50 PM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

10.0

CTPH (ssdeep):

24576:2RLwq5NWIWG1wvykrsSH377SpwQ7oEl2wPREEEEEEEEEEdlhJEJEEEEEEEEEE9EY:2RfNtWzrl77SpwQ7oENPREEEEEEEEEEE

Entry address:

0x80294

Entry point:

E8, E4, C3, 00, 00, E9, 89, FE, FF, FF, 8B, FF, 55, 8B, EC, 83, EC, 10, A1, F4, 26, 4C, 00, 33, C5, 89, 45, FC, 8B, 55, 18, 53, 33, DB, 56, 57, 3B, D3, 7E, 1F, 8B, 45, 14, 8B, CA, 49, 38, 18, 74, 08, 40, 3B, CB, 75, F6, 83, C9, FF, 8B, C2, 2B, C1, 48, 3B, C2, 7D, 01, 40, 89, 45, 18, 89, 5D, F8, 39, 5D, 24, 75, 0B, 8B, 45, 08, 8B, 00, 8B, 40, 04, 89, 45, 24, 8B, 35, A4, C2, 49, 00, 33, C0, 39, 5D, 28, 53, 53, FF, 75, 18, 0F, 95, C0, FF, 75, 14, 8D, 04, C5, 01, 00, 00, 00, 50, FF, 75, 24, FF, D6, 8B, F8, 89... 
[+]

Entropy:

6.5965

Code size:

616.5 KB (631,296 bytes)

The file TBNotifier.exe has been discovered within the following program.

Ask Shopping Toolbar by Ask.com

Ask Shopping Toolbar is a web-browser add-on that can appear as an extra bar added to the browser's window and/or menu. It is often installed (sometimes without warning) during the installation of other software. Ask.

help.ask.com/link/portal/30015/30018/Article/1/How-do-I-remove-the-Ask-com-Toolbar

81% remove it

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):

Connects to www.search-results.com (66.235.120.111:80)

TCP (HTTP):

Connects to www.search.ask.com (23.76.222.3:80)

TCP (HTTP):

Connects to websearch.search-results.com (199.36.100.106:80)

 http://websearch.search-results.com/redirect?client=ff&src=kw&tb=GET-SRS&o=65937837&locale=us_ZZ&apn_uid=197829213&apn_ptnrs=2R&apn_sauid=131886142&apn_dtid=get001YYPT&q=

TCP (HTTP):

Connects to ss.websearch.ask.com (174.129.25.170:80)

Remove TBNotifier.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.