WebConnect.IEUpdate.dll

Super Web LLC

This is the Internet Explorer add-on for the Yontoo Super Web LLC branded web browser plugin (injects banner, text-link and popup ads). The component is responisble for registering the Browser Helper Object into IE and keeping it registered. The module WebConnect.IEUpdate.dll by Super Web has been detected as adware by 7 anti-malware scanners. It will plug into the web browser and display context-based advertisements by overwriting existing ads or by inserting new ones on various web pages.
Remove WebConnect.IEUpdate.dll - Powered by Reason Core Security
Publisher:
Super Web LLC  (signed and verified)

Version:
1.0.5197.30403

MD5:
f9e90695b4459d65741428d19b975263

SHA-1:
35978c569f3463b0b623ed6cdbbeae91ec773fb4

SHA-256:
acdad71fce275f207580fdcdd62621e7faf67058449143cf382979dde459bad0

Scanner detections:
7 / 68

Status:
Adware

Explanation:
Part of the Yontoo distributed ad-supported web browser add-on for Internet Explorer.

Analysis date:
12/10/2016 11:35:24 PM UTC  (today)

Scan engine
Detection
Engine version

AVG
Adware Agent.U
2014.0.3955

Baidu Antivirus
Adware.MSIL.BrowseFox
4.0.3.14610

ESET NOD32
MSIL/BrowseFox.G potentially unwanted application
7.0.302.0

Qihoo 360 Security
Win32/Trojan.Adware.37e
1.0.0.1015

Reason Heuristics
Adware.Yontoo.SuperWeb.S
14.8.7.20

Sophos
SuperWeb
4.98

VIPRE Antivirus
Threat.4741131
30086

Remove WebConnect.IEUpdate.dll - Powered by Reason Core Security
File size:
531.8 KB (544,552 bytes)

Product version:
1.0.5197.30403

Original file name:
WebConnect.IEUpdate.dll

File type:
Dynamic link library (Win32 DLL)

Language:
Language Neutral

Common path:
C:\Program Files\webconnect\bin\plugins\webconnect.ieupdate.dll

Digital Signature
Signed by:

Authority:
VeriSign, Inc.

Valid from:
1/3/2014 8:00:00 AM

Valid to:
1/4/2015 7:59:59 AM

Subject:
CN=Super Web LLC, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=Super Web LLC, L=Los Angeles, S=California, C=US

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
27033EAA9AFF39A69AA31E701AC9D731

File PE Metadata
Compilation timestamp:
3/26/2014 1:53:34 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows Console

Linker version:
8.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
12288:qF/AUySMF3RVTfn+kTBrfkIAMPpOra8C56Hd4ui3Ezk:qF/6SkVTf+kThpBOrWAuLEzk

Entry address:
0x84C46

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Entropy:
7.8703

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
523.5 KB (536,064 bytes)

Remove WebConnect.IEUpdate.dll - Powered by Reason Core Security