home

utilrightsurf.exe

RightSurf

Part of the Yontoo adware component, a web browser plugin that injects unwanted ads in the browser. The application utilrightsurf.exe by RightSurf has been detected as adware by 20 anti-malware scanners. It runs as a separate (within the context of its own process) windows Service named “Update RightSurf”. Additionally, the file is typically installed by a number of programs including RightSurf by Yontoo Technology, Inc. and Buzzdock by Alactro LLC, both potentially unwanted software. It will plug into the web browser and display context-based advertisements by overwriting existing ads or by inserting new ones on various web pages.
Publisher:
RightSurf  (signed and verified)

Version:
1.0.5353.27274

MD5:
82f522cc9197863e9a4441d2eaac1589

SHA-1:
aa8c4928a54a579ac2e19d77ea3f67a6263fd15f

SHA-256:
dae3de56732ae3cdf00002eac8a2cd9751d53b2a9a8adde2783b9f0e3210106b

Scanner detections:
20 / 68

Status:
Adware

Explanation:
Injects advertising in the web browser in various formats.

Analysis date:
5/4/2024 2:06:11 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Adware.SwiftBrowse.V
889

Avira AntiVirus
APPL/BrowseFox.Gen
7.11.169.248

avast!
Win32:Adware-BTU [PUP]
140813-1

AVG
Generic
2015.0.3367

Baidu Antivirus
Adware.Win32.BrowseFox
4.0.3.14829

Bitdefender
Adware.SwiftBrowse.V
1.0.20.1205

Emsisoft Anti-Malware
Adware.SwiftBrowse.V
9.0.0.4324

ESET NOD32
Win32/BrowseFox.H potentially unwanted application
7.0.302.0

F-Secure
Adware.SwiftBrowse.V
11.2014-29-08_6

G Data
Adware.SwiftBrowse
14.8.24

IKARUS anti.virus
PUA.BrowseFox
t3scan.1.7.5.0

Kaspersky
not-a-virus:HEUR:AdWare.MSIL.Kranet
14.0.0.3331

Malwarebytes
PUP.Optional.RightSurf.A
v2014.08.29.04

MicroWorld eScan
Adware.SwiftBrowse.V
15.0.0.723

nProtect
Adware.SwiftBrowse.V
14.08.29.01

Panda Antivirus
Trj/CI.A
14.08.29.04

Qihoo 360 Security
Win32/Virus.Adware.e4c
1.0.0.1015

Reason Heuristics
PUP.Service.RightSurf.N
14.8.29.13

Sophos
RightSurf
4.98

VIPRE Antivirus
Threat.4741131
32210

File size:
315.8 KB (323,360 bytes)

Product version:
1.0.5353.27274

Original file name:
RightSurf.exe

File type:
Executable application (Win32 EXE)

Language:
Language Neutral

Common path:
C:\Program Files\rightsurf\bin\utilrightsurf.exe

Digital Signature
Signed by:
RightSurf

Authority:
VeriSign, Inc.

Valid from:
11/27/2013 1:00:00 AM

Valid to:
11/28/2014 12:59:59 AM

Subject:
CN=RightSurf, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=RightSurf, L=San Diego, S=California, C=US

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
1E2DA13430E7E93CEF3759B2E4F7A34B

File PE Metadata
Compilation timestamp:
8/28/2014 6:09:24 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows Console

Linker version:
8.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
6144:MHofAzV8rGSK7j2247Krgd7ozEhAFPL2dcL9XbKNSv:MHofMqWRLVhe

Entry address:
0x4EBBA

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 02, 00, 10, 00, 00, 00, 20, 00, 00, 80, 18, 00, 00, 00, D8, 02, 00, 80, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 01, 00, 01, 00, 00, 00, 38, 00, 00, 80, 00, 00...
 
[+]

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
307 KB (314,368 bytes)

Service
Display name:
Update RightSurf

Type:
Win32OwnProcess


The file utilrightsurf.exe has been discovered within the following programs.

Buzzdock  by Alactro LLC
This is a web browser extension that injects advertising. From the EULA: "Buzzdock is free to download and use. Buzzdock is supported by advertising, and users will see additional ads on websites where Buzzdock features operate.
www.buzzdock.com/faq-support
79% remove it
RightSurf  by Yontoo Technology, Inc.
RightSurf is an adware web browser extension that will display various popup and banner ads as well as modify the user's web browser search and home page settings in order to serve a number of ad types including banner, inline text links and popups.
rightsurf.info/support
80% remove it
 
Powered by Should I Remove It?

Remove utilrightsurf.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.