home

lt_updater.dll

Local Temperature Weather Filter

Core Systems

Part of an adware web browser extension that delivers advertisements such as coupons, price-comparisons, display media, affiliate links, banners, popups/popunders and other links. The module lt_updater.dll by Core Systems has been detected as adware by 3 anti-malware scanners. It is installed as a Winsock Layered Service Provider (LSP) named “NETCAPTLSP over [GambaliLSP over [LavasoftLSP over [MSAFD Tcpip [TCP/IP]]]]” as a layered chain entry (32). This file is typically installed with the program Local Temperature by Core Systems which is a potentially unwanted software program.
Publisher:
Local Temperature  (signed by Core Systems)

Product:
Local Temperature Weather Filter

Version:
1.0.0.2

MD5:
9fd2a2ade6987fee16d7349c55c5aabd

SHA-1:
8dc17ec3c82418f371613b1bc84c5f9a12f4ebc8

SHA-256:
a84458bfb0b39389b5320f469de0632fbd9805c8d57fda54a5a95894eeca40f8

Scanner detections:
3 / 68

Status:
Adware

Analysis date:
11/23/2024 8:03:35 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.Weather.CoreSystems (M)
15.10.10.19

Trend Micro House Call
Suspicious_GEN.F47V0402
7.2.283

VIPRE Antivirus
Bonzuna
39987

File size:
339.4 KB (347,560 bytes)

Product version:
1.0.0.2

Copyright:
Copyright (C) 2015

Original file name:
LT_Filter.dll

File type:
Dynamic link library (Win32 DLL)

Language:
English (United States)

Common path:
C:\users\{user}\appdata\local\localtemperature\lt_updater.dll

Digital Signature
Signed by:
Core Systems

Authority:
GoDaddy.com, Inc.

Valid from:
6/17/2014 3:26:02 PM

Valid to:
6/17/2015 3:26:02 PM

Subject:
CN=Core Systems, O=Core Systems, L=Austin, S=Texas, C=US

Issuer:
CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, S=Arizona, C=US

Serial number:
4B1F1B2C0AF57F

File PE Metadata
Compilation timestamp:
3/27/2015 9:43:02 PM

OS version:
6.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

CTPH (ssdeep):
3072:VwnU1IrnCboc8j6kIYH9FQWZRwFMYdmuTD6dBFHBj8tPpGWGNOiFuP3a+1SYdc/X:yU1Dcc8j6kIY/WGyTOnpWwlyPKbw9SJ

Entry address:
0x27739

Entry point:
55, 8B, EC, 83, 7D, 0C, 01, 75, 05, E8, 86, C8, 00, 00, FF, 75, 10, FF, 75, 0C, FF, 75, 08, E8, 07, 00, 00, 00, 83, C4, 0C, 5D, C2, 0C, 00, 6A, 0C, 68, 08, 7F, 04, 10, E8, 38, 3B, 00, 00, 33, C0, 40, 8B, 75, 0C, 85, F6, 75, 0C, 39, 35, 28, 5A, 05, 10, 0F, 84, E4, 00, 00, 00, 83, 65, FC, 00, 83, FE, 01, 74, 05, 83, FE, 02, 75, 35, 8B, 0D, A8, 07, 04, 10, 85, C9, 74, 0C, FF, 75, 10, 56, FF, 75, 08, FF, D1, 89, 45, E4, 85, C0, 0F, 84, B1, 00, 00, 00, FF, 75, 10, 56, FF, 75, 08, E8, 11, FE, FF, FF, 89, 45, E4...
 
[+]

Entropy:
6.4008

Developed / compiled with:
Microsoft Visual C++

Code size:
240 KB (245,760 bytes)

Winsock2 LSP
Name:
NETCAPTLSP over [GambaliLSP over [LavasoftLSP over [MSAFD Tcpip [TCP/IP]]]]

Type:
Layered Chain Entry (32)

Provider ID:
{EDA1A3A7-0DDF-40A3-A49A-12D182923697}

Service flags:
0x66


The file lt_updater.dll has been discovered within the following program.

Local Temperature  by Core Systems
Install advertising in the browser. From the EULA/Terms: "The free version of the Software is supported by advertising. Accordingly, the Site and the free version of the Software may provide third party content, advertising and services, and links thereto (e.g.
localtemperature.net
68% remove it
 
Powered by Should I Remove It?

Remove lt_updater.dll - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.