» podowebbho.dll
Overview
Analysis
File Details
Behaviors (1)
Programs (2)
Downloads (1)

podowebbho.dll

PodoWeb

Part of the Yontoo adware component, a web browser plugin that injects unwanted ads in the browser. The module podowebbho.dll by PodoWeb has been detected as adware by 29 anti-malware scanners. It is installed within the context of Internet Explore as a BHO (Browser Helper Object) under the name ‘PodoWeb’. This file is typically installed with the program PodoWeb by Yontoo Technology, Inc. which is a potentially unwanted software program. It will plug into the web browser and display context-based advertisements by overwriting existing ads or by inserting new ones on various web pages.

File name:

podowebbho.dll

Publisher:

PodoWeb (signed and verified)

Product:

PodoWeb

Version:

1.0.0.3

MD5:

f214d0b2cfddccc071a837e805be02d8

SHA-1:

da71e8daa3fe272d6bf1208b1f6390678f1390b5

SHA-256:

02e015efcaaaaa076c715d2f53b4734fc6dfbdff19b6100178498eecbccbb14a

Scanner detections:

29 / 68

Status:

Adware

Explanation:

Injects advertising in the web browser in various formats.

Analysis date:

11/24/2024 2:12:34 AM UTC (today)

Scan engine

Detection

Engine version

Lavasoft Ad-Aware

Gen:Variant.Adware.BHO.Agent.4

860

Agnitum Outpost

Trojan.BPlug

7.1.1

AhnLab V3 Security

Adware/Win32.BHO

2014.09.28

Avira AntiVirus

ADWARE/BrowseFox.Gen2

7.11.174.250

AVG

BrowseFox.F

2015.0.3338

Baidu Antivirus

Adware.Win32.BrowseFox

4.0.3.14927

Bitdefender

Gen:Variant.Adware.BHO.Agent.4

1.0.20.1350

Comodo Security

Application.Win32.BrowseFox.JM

19634

Dr.Web

Trojan.BPlug.144

9.0.1.0270

Emsisoft Anti-Malware

Gen:Variant.Adware.BHO.Agent

8.14.09.27.03

ESET NOD32

Win32/BrowseFox (variant)

8.10475

F-Prot

W32/BadBHO.AW.gen

v6.4.7.1.166

F-Secure

Gen:Variant.Adware.BHO.Agent.4

11.2014-27-09_7

G Data

Gen:Variant.Adware.BHO.Agent

14.9.24

IKARUS anti.virus

AdWare.BrowseFox

t3scan.1.7.5.0

K7 AntiVirus

Unwanted-Program

13.183.13504

Kaspersky

not-a-virus:AdWare.Win32.Agent

14.0.0.3187

Malwarebytes

PUP.Optional.PodoWeb.A

v2014.09.27.03

McAfee

Artemis!0FE84D4D573D

5600.6994

MicroWorld eScan

Gen:Variant.Adware.BHO.Agent.4

15.0.0.810

NANO AntiVirus

Trojan.Win32.BPlug.dfogbn

0.28.2.62286

nProtect

Trojan-Clicker/W32.Agent.249624

14.08.14.01

Panda Antivirus

Trj/CI.A

14.09.27.03

Qihoo 360 Security

HEUR/QVM30.1.Malware.Gen

1.0.0.1015

Reason Heuristics

Adware.Yontoo.BHO.K

14.9.27.15

Sophos

Generic PUA DP

4.98

SUPERAntiSpyware

Adware.BrowseFox/Variant

10334

Trend Micro House Call

Suspicious_GEN.F47V0814

7.2.270

VIPRE Antivirus

Yontoo

33474

File size:

244.3 KB (250,136 bytes)

Product version:

1.0.0.3

Original file name:

PodoWebIEClient.dll

File type:

Dynamic link library (Win32 DLL)

Language:

English (United States)

Common path:

C:\Program Files\podoweb\podowebbho.dll

Digital Signature

Signed by:

PodoWeb

Authority:

DigiCert Inc

Valid from:

6/8/2014 9:00:00 PM

Valid to:

6/17/2015 9:00:00 AM

Subject:

CN=PodoWeb, O=PodoWeb, L=Santa Monica, S=California, C=US

Issuer:

CN=DigiCert Assured ID Code Signing CA-1, OU=www.digicert.com, O=DigiCert Inc, C=US

Serial number:

0A93446D6247875E905539F949588C94

Registration

CLSID:

{980b8a8f-ea0b-4c24-a2e9-70635e2502e9}

COM registered:

Yes

File PE Metadata

Compilation timestamp:

9/26/2014 5:51:27 PM

OS version:

6.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

11.0

CTPH (ssdeep):

3072:XJxouBf6fEiKtkSiUFjIlBee9eAxjN+/IaIwaYWt5as5:XZBf6fGtdiNeGYIDft5a+

Entry address:

0x12854

Entry point:

55, 8B, EC, 83, 7D, 0C, 01, 75, 05, E8, 41, 8D, 00, 00, FF, 75, 10, FF, 75, 0C, FF, 75, 08, E8, 07, 00, 00, 00, 83, C4, 0C, 5D, C2, 0C, 00, 6A, 0C, 68, 70, 30, 03, 10, E8, BD, 01, 00, 00, 33, C0, 40, 8B, 75, 0C, 85, F6, 75, 0C, 39, 35, 04, 78, 03, 10, 0F, 84, E4, 00, 00, 00, 83, 65, FC, 00, 83, FE, 01, 74, 05, 83, FE, 02, 75, 35, 8B, 0D, FC, A4, 02, 10, 85, C9, 74, 0C, FF, 75, 10, 56, FF, 75, 08, FF, D1, 89, 45, E4, 85, C0, 0F, 84, B1, 00, 00, 00, FF, 75, 10, 56, FF, 75, 08, E8, 11, FE, FF, FF, 89, 45, E4... 
[+]

Developed / compiled with:

Microsoft Visual C++

Code size:

159 KB (162,816 bytes)

Internet Explorer BHO

Display name:

PodoWeb

CLSID:

{980b8a8f-ea0b-4c24-a2e9-70635e2502e9}

The file podowebbho.dll has been discovered within the following programs.

Buzzdock by Alactro LLC

This is a web browser extension that injects advertising. From the EULA: "Buzzdock is free to download and use. Buzzdock is supported by advertising, and users will see additional ads on websites where Buzzdock features operate.

www.buzzdock.com/faq-support

79% remove it

PodoWeb by Yontoo Technology, Inc.

PodoWeb is an adware program that runs within the user's web browser and will modify various browser settings such as changing the search provider.

podoweb.net/support

82% remove it

The file podowebbho.dll has been seen being distributed by the following URL.

http://install-cdn.podoweb.net/bed?bet=3

Remove podowebbho.dll - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.