wisenwizardbho.dll

wisen wizard

The module wisenwizardbho.dll by wisen wizard has been detected as adware by 16 anti-malware scanners. It is installed within the context of Internet Explore as a BHO (Browser Helper Object) under the name ‘wisen wizard’. This file is typically installed with the program wisen wizard by Yontoo Technology, Inc. which is a potentially unwanted software program. It will plug into the web browser and display context-based advertisements by overwriting existing ads or by inserting new ones on various web pages.
Publisher:
wisen wizard  (signed and verified)

Product:
wisen wizard

Version:
1.0.0.3

MD5:
d23f3daa5e3b5fd36690eaa9a39a410e

SHA-1:
291149c6127f92d407cc6fa17928b5e7c092e288

SHA-256:
3e8272b64a783e8cc592f63b0bb1c4233ecc2e7d0dae33825f72efc194891aeb

Scanner detections:
16 / 68

Status:
Adware

Explanation:
Injects advertising in the web browser in various formats.

Analysis date:
3/12/2014 8:05:19 AM UTC  (seven months ago)

Scan engine
Detection
Engine version

Antiy Labs AVL
AdWare/Win32.Agent
2.0.3.7

Comodo Security
Application.Win32.Altbrowse.AK
17672

Dr.Web
Adware.Plugin.100
9.0.1.071

ESET NOD32
Win32/BrowseFox (variant)
8.9337

IKARUS anti.virus
not-a-virus:AdWare.Win32.Agent
t3scan.2.2.29

Jiangmin
Adware/Agent.jaw
KV140312

Kaspersky
not-a-virus:AdWare.Win32.Agent
14.0.0.4184

Kingsoft AntiVirus
Win32.Troj.Agent.ah.(kcloud)
331020.49267

Malwarebytes
PUP.Optional.Wisenwizard.A
v2014.03.12.04

McAfee
Artemis!3F19AF31AF69
5600.7194

McAfee Web Gateway
Artemis!3F19AF31AF69
7.7194

NANO AntiVirus
Riskware.Win32.Agent.cqvnby
0.28.0.57380

Reason Heuristics
PUP.wisenwizard.O
14.3.12.4

Sophos
Generic PUA JO
4.97

Trend Micro House Call
TROJ_GEN.F47V0303
7.2.71

Vba32 AntiVirus
AdWare.Agent
3.12.24.3

File size:
243.8 KB (249,632 bytes)

Product version:
1.0.0.3

Copyright:
(c) wisen wizard. All rights reserved.

Original file name:
wisen wizardIEClient.dll

File type:
Dynamic link library (Win32 DLL)

Language:
English (United States)

Common path:
C:\Program Files\wisen wizard\wisenwizardbho.dll

Digital Signature
Signed by:

Authority:
VeriSign, Inc.

Valid from:
11/27/2013 3:00:00 AM

Valid to:
11/28/2014 2:59:59 AM

Subject:
CN=wisen wizard, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=wisen wizard, L=San Diego, S=California, C=US

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
60C10E74C549776A696451A95399F2D5

File PE Metadata
Compilation timestamp:
3/11/2014 7:31:05 PM

OS version:
6.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

CTPH (ssdeep):
3072:ELhUFcv+lh0pAvAqehClBWBZds8vP543+XEIaI51CaQB/VK:ELhT7pzqejsSg8EIP10/VK

Entry address:
0x12844

Entry point:
55, 8B, EC, 83, 7D, 0C, 01, 75, 05, E8, 41, 8D, 00, 00, FF, 75, 10, FF, 75, 0C, FF, 75, 08, E8, 07, 00, 00, 00, 83, C4, 0C, 5D, C2, 0C, 00, 6A, 0C, 68, 40, 2D, 03, 10, E8, BD, 01, 00, 00, 33, C0, 40, 8B, 75, 0C, 85, F6, 75, 0C, 39, 35, 44, 68, 03, 10, 0F, 84, E4, 00, 00, 00, 83, 65, FC, 00, 83, FE, 01, 74, 05, 83, FE, 02, 75, 35, 8B, 0D, 9C, A1, 02, 10, 85, C9, 74, 0C, FF, 75, 10, 56, FF, 75, 08, FF, D1, 89, 45, E4, 85, C0, 0F, 84, B1, 00, 00, 00, FF, 75, 10, 56, FF, 75, 08, E8, 11, FE, FF, FF, 89, 45, E4...
 
[+]

Entropy:
6.3690

Developed / compiled with:
Microsoft Visual C++

Code size:
159 KB (162,816 bytes)

Internet Explorer BHO
Display name:
wisen wizard

CLSID:
{d7bbe586-f42a-454b-9794-776b57483a40}


The file wisenwizardbho.dll has been discovered within the following program.

wisen wizard  by Yontoo Technology, Inc.
WisenWizard is an adware web browser extension that will display various popup and banner ads as well as modify the user's web browser search and home page settings.
wisenwizard.net/support
88% remove it
 
Powered by Should I Remove It?

There are numerous known versions of wisenwizardbho.dll by wisen wizard.

36 / 68    (Adware)
wisenwizardbho.dll  1.0.0.3  (5ea08201f28867c84d1dd9ecee77016c7ba526ec)

36 / 68    (Adware)
wisenwizardbho.dll  1.0.0.3  (9b8680f9a0e3e0b252f67ea5feeefc2bf865ce26)

33 / 68    (Adware)
wisenwizardbho.dll  1.0.0.3  (56baf6a11464b4383ed661ae5b36cf03f7f1cdee)

33 / 68    (Adware)
wisenwizardbho.dll  1.0.0.3  (44234ca8696ba5c180b67af96a9acc9d195918c3)

33 / 68    (Adware)
wisenwizardbho.dll  1.0.0.3  (fe4da8efda5ee236fc7a9758d0419de83c8a9363)

34 / 68    (Adware)
wisenwizardbho.dll  1.0.0.3  (29ac489df1c2d350c6bdeeda02669572fd7e49e2)

32 / 68    (Adware)
wisenwizardbho.dll  1.0.0.3  (cc69a6a3ff5f9572faefdd6b85d116b31da26b2c)

32 / 68    (Adware)
wisenwizardbho.dll  1.0.0.3  (501b989342ea125f323d4d7fc18aac9cbd154c54)

32 / 68    (Adware)
wisenwizardbho.dll  1.0.0.3  (2715245a6f4bab47849fe3c7d234e1f7cfbb4789)

40 / 68    (Adware)
wisenwizardbho.dll  1.0.0.3  (abebaa1c70c97677516406d675923759118916fc)

28 / 68    (Adware)
wisenwizardbho.dll  1.0.0.3  (09d1cb84a016307f8f14d5cdb575a87dd217a1b5)

28 / 68    (Adware)
wisenwizardbho.dll  1.0.0.3  (4d704ed5d13e2fbd507d1d9f2b4fb501dfd3171e)

28 / 68    (Adware)
wisenwizardbho.dll  1.0.0.3  (6bdca7656869cc8cd8069456b872926c5896c124)

28 / 68    (Adware)
wisenwizardbho.dll  1.0.0.3  (72d2ff692a826beb16932d29c8e5cefe360d200a)

28 / 68    (Adware)
wisenwizardbho.dll  1.0.0.3  (19dc596647fb003318a9d6dac34d2275c8ea4d73)

3 / 68      (Adware)
unt66ce.exe  (63fabe607529876dd229697ae5fe36a810ebebfd)

18 / 68    (Adware)
wisenwizard_setup.exe  (a6e7148fd45ca3f2ba8021cf5a7bb6b0977af20a)

3 / 68      (Adware)
updatewisenwizard.exe  (177bb49398f3c01de18e7fe68fa935537787bad6)

19 / 68    (Adware)
setup.exe  (8d9924a18d0ef02ede241d491d2dd65f5ad449de)

4 / 68      (Adware)
utilwisenwizard.exe  (3218e42ed690104d6233227930b326893ebfa941)

1 / 68      (Adware)
wisenwizard.browserfilter.helper.dll  (0e469ce7fd25ac248b4b8d2e7e6952de4f9f0008)

1 / 68      (Adware)
wisenwizard.FirstRun.exe  (006f4f8dd2414d84a7d82eb9a6c4665a30d4fb5f)

1 / 68      (Adware)
wisenwizardBrowserFilter.exe  (581858d09c5095505037de8f0021fa5c77c93997)

1 / 68      (Adware)
wisenwizard.BrowserFilterG.dll  (14f592b9fd7da99474f0e57a002e38c4d057da3a)

1 / 68      (Adware)
wisenwizard.FFUpdate.dll  (9204c2e751d869cd7bc21742280ee68aa8bf5f64)

1 / 68      (Adware)
wisenwizard.IEUpdate.dll  (b0dd1e7e2de96bb79be99b5e64c757856024570a)

Detection Incidence by Country