podowebbho.dll

PodoWeb

Part of the Yontoo adware component, a web browser plugin that injects unwanted ads in the browser. The module podowebbho.dll by PodoWeb has been detected as adware by 29 anti-malware scanners. It is installed within the context of Internet Explore as a BHO (Browser Helper Object) under the name ‘PodoWeb’. This file is typically installed with the program PodoWeb by Yontoo Technology, Inc. which is a potentially unwanted software program. It will plug into the web browser and display context-based advertisements by overwriting existing ads or by inserting new ones on various web pages.
Publisher:
PodoWeb  (signed and verified)

Product:
PodoWeb

Version:
1.0.0.3

MD5:
f214d0b2cfddccc071a837e805be02d8

SHA-1:
da71e8daa3fe272d6bf1208b1f6390678f1390b5

SHA-256:
02e015efcaaaaa076c715d2f53b4734fc6dfbdff19b6100178498eecbccbb14a

Scanner detections:
29 / 68

Status:
Adware

Explanation:
Injects advertising in the web browser in various formats.

Analysis date:
11/14/2024 9:02:47 PM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Gen:Variant.Adware.BHO.Agent.4
860

Agnitum Outpost
Trojan.BPlug
7.1.1

AhnLab V3 Security
Adware/Win32.BHO
2014.09.28

Avira AntiVirus
ADWARE/BrowseFox.Gen2
7.11.174.250

AVG
BrowseFox.F
2015.0.3338

Baidu Antivirus
Adware.Win32.BrowseFox
4.0.3.14927

Bitdefender
Gen:Variant.Adware.BHO.Agent.4
1.0.20.1350

Comodo Security
Application.Win32.BrowseFox.JM
19634

Dr.Web
Trojan.BPlug.144
9.0.1.0270

Emsisoft Anti-Malware
Gen:Variant.Adware.BHO.Agent
8.14.09.27.03

ESET NOD32
Win32/BrowseFox (variant)
8.10475

F-Prot
W32/BadBHO.AW.gen
v6.4.7.1.166

F-Secure
Gen:Variant.Adware.BHO.Agent.4
11.2014-27-09_7

G Data
Gen:Variant.Adware.BHO.Agent
14.9.24

IKARUS anti.virus
AdWare.BrowseFox
t3scan.1.7.5.0

K7 AntiVirus
Unwanted-Program
13.183.13504

Kaspersky
not-a-virus:AdWare.Win32.Agent
14.0.0.3187

Malwarebytes
PUP.Optional.PodoWeb.A
v2014.09.27.03

McAfee
Artemis!0FE84D4D573D
5600.6994

MicroWorld eScan
Gen:Variant.Adware.BHO.Agent.4
15.0.0.810

NANO AntiVirus
Trojan.Win32.BPlug.dfogbn
0.28.2.62286

nProtect
Trojan-Clicker/W32.Agent.249624
14.08.14.01

Panda Antivirus
Trj/CI.A
14.09.27.03

Qihoo 360 Security
HEUR/QVM30.1.Malware.Gen
1.0.0.1015

Reason Heuristics
Adware.Yontoo.BHO.K
14.9.27.15

Sophos
Generic PUA DP
4.98

SUPERAntiSpyware
Adware.BrowseFox/Variant
10334

Trend Micro House Call
Suspicious_GEN.F47V0814
7.2.270

VIPRE Antivirus
Yontoo
33474

File size:
244.3 KB (250,136 bytes)

Product version:
1.0.0.3

Copyright:
(c) PodoWeb. All rights reserved.

Original file name:
PodoWebIEClient.dll

File type:
Dynamic link library (Win32 DLL)

Language:
English (United States)

Common path:
C:\Program Files\podoweb\podowebbho.dll

Digital Signature
Signed by:

Authority:
DigiCert Inc

Valid from:
6/8/2014 9:00:00 PM

Valid to:
6/17/2015 9:00:00 AM

Subject:
CN=PodoWeb, O=PodoWeb, L=Santa Monica, S=California, C=US

Issuer:
CN=DigiCert Assured ID Code Signing CA-1, OU=www.digicert.com, O=DigiCert Inc, C=US

Serial number:
0A93446D6247875E905539F949588C94

Registration
CLSID:
{980b8a8f-ea0b-4c24-a2e9-70635e2502e9}

COM registered:
Yes

File PE Metadata
Compilation timestamp:
9/26/2014 5:51:27 PM

OS version:
6.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

CTPH (ssdeep):
3072:XJxouBf6fEiKtkSiUFjIlBee9eAxjN+/IaIwaYWt5as5:XZBf6fGtdiNeGYIDft5a+

Entry address:
0x12854

Entry point:
55, 8B, EC, 83, 7D, 0C, 01, 75, 05, E8, 41, 8D, 00, 00, FF, 75, 10, FF, 75, 0C, FF, 75, 08, E8, 07, 00, 00, 00, 83, C4, 0C, 5D, C2, 0C, 00, 6A, 0C, 68, 70, 30, 03, 10, E8, BD, 01, 00, 00, 33, C0, 40, 8B, 75, 0C, 85, F6, 75, 0C, 39, 35, 04, 78, 03, 10, 0F, 84, E4, 00, 00, 00, 83, 65, FC, 00, 83, FE, 01, 74, 05, 83, FE, 02, 75, 35, 8B, 0D, FC, A4, 02, 10, 85, C9, 74, 0C, FF, 75, 10, 56, FF, 75, 08, FF, D1, 89, 45, E4, 85, C0, 0F, 84, B1, 00, 00, 00, FF, 75, 10, 56, FF, 75, 08, E8, 11, FE, FF, FF, 89, 45, E4...
 
[+]

Developed / compiled with:
Microsoft Visual C++

Code size:
159 KB (162,816 bytes)

Internet Explorer BHO
Display name:
PodoWeb

CLSID:
{980b8a8f-ea0b-4c24-a2e9-70635e2502e9}


The file podowebbho.dll has been discovered within the following programs.

Buzzdock  by Alactro LLC
This is a web browser extension that injects advertising. From the EULA: "Buzzdock is free to download and use. Buzzdock is supported by advertising, and users will see additional ads on websites where Buzzdock features operate.
www.buzzdock.com/faq-support
79% remove it
PodoWeb  by Yontoo Technology, Inc.
PodoWeb is an adware program that runs within the user's web browser and will modify various browser settings such as changing the search provider.
podoweb.net/support
82% remove it
 
Powered by Should I Remove It?

The file podowebbho.dll has been seen being distributed by the following URL.

Remove podowebbho.dll - Powered by Reason Core Security