home

whitesmoketlbr.dll

WhiteSmoke Toolbar

Montera Technologeis LTDD

This is part of the Montera web browser toolbar and extension that will modify the browser's default search provider, DNS, and home page functions. The module whitesmoketlbr.dll by Montera TechnologeisD has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. It is installed as a toolbar in Internet Explore as ‘WhiteSmoke Toolbar’.
Publisher:
WhiteSmoke.com  (signed by Montera Technologeis LTDD)

Product:
WhiteSmoke Toolbar

Version:
1.5.3.0

MD5:
2186b80445a90bf7cb4b988a0c1a2d97

SHA-1:
dffc1d48508dbf4915f7660128b9f1bfaf9ce45e

SHA-256:
34a343aff39ef3de10672b77ddd8b6bf65bf3ce42d118b37a646ee67e6055292

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Analysis date:
4/24/2024 10:56:46 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.Montiera (M)
16.12.23.3

File size:
243.7 KB (249,552 bytes)

Product version:
1.5.3.0

Copyright:
(c) WhiteSmoke.com. All rights reserved.

File type:
Dynamic link library (Win32 DLL)

Language:
Hebrew (Israel)

Common path:
C:\Program Files\whitesmoketoolbar\whitesmoke\1.5.3.6\whitesmoketlbr.dll

Digital Signature
Signed by:
Montera Technologeis LTDD

Authority:
The USERTRUST Network

Valid from:
5/15/2011 8:00:00 PM

Valid to:
5/15/2012 7:59:59 PM

Subject:
CN=Montera Technologeis LTDD, O=Montera Technologeis LTDD, STREET="18, Amammi st", L=Even Yehuda, S=Hasharon, PostalCode=40500, C=IL

Issuer:
CN=UTN-USERFirst-Object, OU=http://www.usertrust.com, O=The USERTRUST Network, L=Salt Lake City, S=UT, C=US

Serial number:
0095D386F202E0248D39723608F340A6E5

File PE Metadata
Compilation timestamp:
11/8/2011 3:01:51 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

Entry address:
0x1849B

Entry point:
8B, FF, 55, 8B, EC, 83, 7D, 0C, 01, 75, 05, E8, D3, 4E, 00, 00, FF, 75, 08, 8B, 4D, 10, 8B, 55, 0C, E8, EC, FE, FF, FF, 59, 5D, C2, 0C, 00, 8B, FF, 55, 8B, EC, 83, EC, 10, 57, FF, 75, 10, 8D, 4D, F0, E8, 68, F5, FF, FF, 8B, 7D, 08, 85, FF, 75, 27, E8, BB, 0D, 00, 00, C7, 00, 16, 00, 00, 00, E8, 36, 23, 00, 00, 80, 7D, FC, 00, 74, 07, 8B, 45, F8, 83, 60, 70, FD, B8, FF, FF, FF, 7F, E9, A5, 00, 00, 00, 56, 8B, 75, 0C, 85, F6, 75, 24, E8, 8C, 0D, 00, 00, C7, 00, 16, 00, 00, 00, E8, 07, 23, 00, 00, 80, 7D, FC...
 
[+]

Code size:
154.5 KB (158,208 bytes)

Internet Explorer Toolbar
Display name:
WhiteSmoke Toolbar

CLSID:
{E443139E-3828-402A-9765-DAEE418B30CB}


Remove whitesmoketlbr.dll - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.