home

podowebbho.dll

PodoWeb

Part of the Yontoo adware component, a web browser plugin that injects unwanted ads in the browser. The module podowebbho.dll by PodoWeb has been detected as adware by 27 anti-malware scanners. It is installed within the context of Internet Explore as a BHO (Browser Helper Object) under the name ‘PodoWeb’. This file is typically installed with the program PodoWeb by Yontoo Technology, Inc. which is a potentially unwanted software program. It will plug into the web browser and display context-based advertisements by overwriting existing ads or by inserting new ones on various web pages.
Publisher:
PodoWeb  (signed and verified)

Product:
PodoWeb

Version:
1.0.0.3

MD5:
2cc95d008e0a9d85bbf024ef6ee4935a

SHA-1:
1c250cb513afbccd393f6ea6b38dc2e3969546c3

SHA-256:
9d809fa1d32e4995806d89d8133077572fd19a33a9a25732c9febd076ab8361c

Scanner detections:
27 / 68

Status:
Adware

Explanation:
Injects advertising in the web browser in various formats.

Analysis date:
11/24/2024 2:11:44 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Gen:Variant.Adware.BHO.Agent.4
890

Agnitum Outpost
Trojan.BPlug
7.1.1

Avira AntiVirus
APPL/BrowseFox.Gen2
7.11.169.232

AVG
BrowseFox.F
2015.0.3368

Baidu Antivirus
Adware.Win32.BrowseFox
4.0.3.14829

Bitdefender
Gen:Variant.Adware.BHO.Agent.4
1.0.20.1205

Comodo Security
Application.Win32.Altbrowse.AK
19197

Dr.Web
Trojan.BPlug.144
9.0.1.0241

Emsisoft Anti-Malware
Gen:Variant.Adware.BHO.Agent
8.14.08.29.10

ESET NOD32
Win32/BrowseFox (variant)
8.10334

F-Prot
W32/BadBHO.AW.gen
v6.4.7.1.166

F-Secure
Gen:Variant.Adware.BHO.Agent.4
11.2014-29-08_6

G Data
Gen:Variant.Adware.BHO.Agent
14.8.24

IKARUS anti.virus
AdWare.BrowseFox
t3scan.1.7.5.0

Kaspersky
not-a-virus:AdWare.Win32.Agent
14.0.0.3333

Malwarebytes
PUP.Optional.PodoWeb.A
v2014.08.29.10

McAfee
Artemis!0FE84D4D573D
5600.7024

MicroWorld eScan
Gen:Variant.Adware.BHO.Agent.4
15.0.0.723

NANO AntiVirus
Riskware.Win32.Agent.cuenda
0.28.2.61519

nProtect
Trojan-Clicker/W32.Agent.249624
14.08.14.01

Panda Antivirus
Trj/CI.A
14.08.29.10

Qihoo 360 Security
HEUR/Malware.QVM30.Gen
1.0.0.1015

Reason Heuristics
Adware.Yontoo.PodoWeb.K
14.8.29.10

Sophos
Generic PUA DP
4.98

SUPERAntiSpyware
Adware.BrowseFox/Variant
10392

Trend Micro House Call
Suspicious_GEN.F47V0814
7.2.241

VIPRE Antivirus
Yontoo
32238

File size:
244.3 KB (250,136 bytes)

Product version:
1.0.0.3

Copyright:
(c) PodoWeb. All rights reserved.

Original file name:
PodoWebIEClient.dll

File type:
Dynamic link library (Win32 DLL)

Common path:
C:\Program Files\podoweb\podowebbho.dll

Digital Signature
Signed by:
PodoWeb

Authority:
DigiCert Inc

Valid from:
6/9/2014 3:00:00 AM

Valid to:
6/17/2015 3:00:00 PM

Subject:
CN=PodoWeb, O=PodoWeb, L=Santa Monica, S=California, C=US

Issuer:
CN=DigiCert Assured ID Code Signing CA-1, OU=www.digicert.com, O=DigiCert Inc, C=US

Serial number:
0A93446D6247875E905539F949588C94

File PE Metadata
Compilation timestamp:
8/27/2014 3:28:05 AM

OS version:
6.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

CTPH (ssdeep):
3072:dJxouBf6fEiKtkSiUFjIlBee9eAxjN+/IaIyaYWY5aC:dZBf6fGtdiNeGYI9fY5aC

Entry address:
0x12854

Entry point:
55, 8B, EC, 83, 7D, 0C, 01, 75, 05, E8, 41, 8D, 00, 00, FF, 75, 10, FF, 75, 0C, FF, 75, 08, E8, 07, 00, 00, 00, 83, C4, 0C, 5D, C2, 0C, 00, 6A, 0C, 68, 70, 30, 03, 10, E8, BD, 01, 00, 00, 33, C0, 40, 8B, 75, 0C, 85, F6, 75, 0C, 39, 35, 04, 78, 03, 10, 0F, 84, E4, 00, 00, 00, 83, 65, FC, 00, 83, FE, 01, 74, 05, 83, FE, 02, 75, 35, 8B, 0D, FC, A4, 02, 10, 85, C9, 74, 0C, FF, 75, 10, 56, FF, 75, 08, FF, D1, 89, 45, E4, 85, C0, 0F, 84, B1, 00, 00, 00, FF, 75, 10, 56, FF, 75, 08, E8, 11, FE, FF, FF, 89, 45, E4...
 
[+]

Developed / compiled with:
Microsoft Visual C++

Code size:
159 KB (162,816 bytes)

Internet Explorer BHO
Display name:
PodoWeb

CLSID:
{980b8a8f-ea0b-4c24-a2e9-70635e2502e9}


The file podowebbho.dll has been discovered within the following programs.

Buzzdock  by Alactro LLC
This is a web browser extension that injects advertising. From the EULA: "Buzzdock is free to download and use. Buzzdock is supported by advertising, and users will see additional ads on websites where Buzzdock features operate.
www.buzzdock.com/faq-support
79% remove it
PodoWeb  by Yontoo Technology, Inc.
PodoWeb is an adware program that runs within the user's web browser and will modify various browser settings such as changing the search provider.
podoweb.net/support
82% remove it
 
Powered by Should I Remove It?

The file podowebbho.dll has been seen being distributed by the following URL.

http://install-cdn.podoweb.net/bed?bet=3

Remove podowebbho.dll - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.