home

mystarttb_klcp.exe

MyStart Toolbar

Visicom Media Inc.

This is part of the Visicom VMN web browser toolbar and extension that will modify the browser's default search provider, DNS, and home page functions. The application mystarttb_klcp.exe, “MyStart Toolbar Installer” by Visicom Media has been detected as a potentially unwanted program by 15 anti-malware scanners. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The file has been seen being downloaded from 41.223.201.246 and multiple other hosts.
Publisher:
Visicom Media Inc.  (signed and verified)

Product:
MyStart Toolbar

Description:
MyStart Toolbar Installer

Version:
5.6

MD5:
1dfb30685017b87f562a3c115a6d7cd4

SHA-1:
edcfc0cd014b739807356a145ddf300ab4cdc59e

SHA-256:
077c0df0c1e2f9543d78c04c4621ce02effd233bab8dfb64dfae8db178d87c9b

Scanner detections:
15 / 68

Status:
Potentially unwanted

Explanation:
The setup program may install a variant of the Visicom Toolbar, a web browser extension that may modify the browser's home and search pages.

Analysis date:
11/15/2024 3:44:47 AM UTC  (today)

Scan engine
Detection
Engine version

Agnitum Outpost
PUA.Toolbar.Agent
7.1.1

Bkav FE
W32.HfsAdware
1.3.0.7383

Dr.Web
Tool.InstallToolbar.174
9.0.1.0321

ESET NOD32
Win32/Toolbar.Visicom.A potentially unwanted (variant)
9.12561

Fortinet FortiGate
Riskware/Agent
11/17/2015

G Data
Win32.Application.Agent.YHYW5Z
15.11.25

K7 AntiVirus
Unwanted-Program
13.212.17847

Kaspersky
not-a-virus:WebToolbar.Win32.Agent
14.0.0.1105

Malwarebytes
PUP.Optional.MyStartTB.ShrtCln
v2015.11.17.11

McAfee
Artemis!90BFF7B1BE4B
5600.6578

Reason Heuristics
PUP.Visicom.VisicomMedia.Installer (M)
15.11.17.23

Rising Antivirus
PE:Malware.Generic/QRS!1.9E2D [F]
23.00.65.151115

Sophos
Generic PUA GP (PUA)
4.98

VIPRE Antivirus
Trojan.Win32.Generic
45198

Zillya! Antivirus
Adware.AdLoad.Win32.6973
2.0.0.2507

File size:
4 MB (4,235,776 bytes)

Product version:
5.6.0.1

Copyright:
© Visicom Media Inc. (License)

Trademarks:
Visicom Media Inc., All Rights Reserved

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Common path:
C:\users\{user}\appdata\local\microsoft\windows\inetcache\content.ie5\wom1uxmt\mystarttb_klcp.exe

Digital Signature
Signed by:
Visicom Media Inc.

Authority:
Symantec Corporation

Valid from:
2/9/2015 1:00:00 AM

Valid to:
2/9/2017 12:59:59 AM

Subject:
CN=Visicom Media Inc., OU=Visicom Media Inc., O=Visicom Media Inc., L=Brossard, S=Quebec, C=CA

Issuer:
CN=Symantec Class 3 SHA256 Code Signing CA, OU=Symantec Trust Network, O=Symantec Corporation, C=US

Serial number:
0F7022688814C950B353E71B8D1C1D84

File PE Metadata
Compilation timestamp:
12/5/2009 11:50:46 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
98304:mwtu6J5M1TRCgCeFAIgmV6bZU+OkH0AdU+WYJEL+JBoptVrzM:mCu6J5MrCr4gmYb5P0AJfqqJipt

Entry address:
0x323C

Entry point:
81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 30, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B4, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 58, 3F, 42, 00, E8, 09, 2C, 00, 00, A3, A4, 3E, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 58, F4, 41, 00, FF, 15, 58, 71, 40, 00, 68, B8, 91, 40, 00, 68, A0, 36, 42, 00, E8, BC, 28, 00, 00, FF, 15, B0, 70, 40, 00, BF, 00, 90, 42, 00, 50, 57, E8, AA, 28, 00, 00...
 
[+]

Packer / compiler:
Nullsoft install system v2.x

Code size:
23 KB (23,552 bytes)

The file mystarttb_klcp.exe has been seen being distributed by the following 3 URLs.

http://41.223.201.246/.../mystartTb_klcp.exe

http://113.171.224.209/.../mystartTb_klcp.exe

http://mystart.toolbarstart.com/download/.../mystartTb_klcp.exe

Remove mystarttb_klcp.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.