» tbeaz0.dll
Overview
Analysis
File Details
Behaviors (2)
Programs (10)
Downloads (1)

tbeaz0.dll

Conduit Toolbar

Conduit Ltd.

The file is part of the Conduit Toolbar platform, a web browser monetization engine that is typiclaly distributed with third party programs through a bundled installation, this particular version is part of the Conduit Toolbar bundle. The module tbeaz0.dll by Conduit has been detected as a potentially unwanted program by 3 anti-malware scanners. It is installed within the context of Internet Explore as a BHO (Browser Helper Object) under the name ‘Eazel-IT Toolbar’. Additionally, the file is typically installed by a number of programs including IsoBuster Toolbar by Conduit Ltd. and 7screensavers Toolbar by Conduit Ltd., both potentially unwanted software.

File name:

tbeaz0.dll

Publisher:

Conduit Ltd. (signed and verified)

Product:

Conduit Toolbar

Version:

5, 5, 0, 10

MD5:

2833a262ca362ee3695cacd0580aa707

SHA-1:

297834c3ba7ddc4ed4662c56468655b25c7b0d62

SHA-256:

786d686a05edb50a9f8559c9675d68c3f74e8afb12aeee9636be046710b311a1

Scanner detections:

3 / 68

Status:

Potentially unwanted

Explanation:

This component is distributed and installed with the Conduit Toolbar platform.

Analysis date:

11/23/2024 8:11:12 AM UTC (today)

Scan engine

Detection

Engine version

ESET NOD32

Win32/Toolbar.Conduit (variant)

7.9190

Reason Heuristics

SearchPlugin.ConduitSearchBar.BHO.G

14.8.7.22

VIPRE Antivirus

Conduit

24612

File size:

2.4 MB (2,515,552 bytes)

Product version:

5, 5, 0, 10

Trademarks:

File type:

Dynamic link library (Win32 DLL)

Language:

English (United States)

Common path:

C:\Program Files\eazel-it\tbeaz0.dll

Digital Signature

Signed by:

Conduit Ltd.

Authority:

VeriSign, Inc.

Valid from:

2/17/2010 1:00:00 AM

Valid to:

3/30/2013 12:59:59 AM

Subject:

CN=Conduit Ltd., OU=Digital ID Class 3 - Microsoft Software Validation v2, O=Conduit Ltd., S=Israel, C=IL

Issuer:

CN=VeriSign Class 3 Code Signing 2009-2 CA, OU=Terms of use at https://www.verisign.com/rpa (c)09, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:

3736DA15AF647632CCE61CD41B6577DD

Registration

CLSIDs:

{34EA1C70-42CC-42C5-AA29-EC58B95A343E}, {8EB5FC2B-8414-40E1-B715-A51202D86EC3}

ProgID:

Toolbar.CT1460988

COM registered:

Yes

File PE Metadata

Compilation timestamp:

4/15/2010 11:33:41 AM

OS version:

5.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

9.0

CTPH (ssdeep):

49152:/QFIqHLT0LcY+8IWfYjp3NlKrWaX3bAhz/cvTVRkvzVQoQtkK96P:/urgIUImiKpX3bAhz/t

Entry address:

0x13291D

Entry point:

8B, FF, 55, 8B, EC, 83, 7D, 0C, 01, 75, 05, E8, 38, 92, 00, 00, FF, 75, 08, 8B, 4D, 10, 8B, 55, 0C, E8, EC, FE, FF, FF, 59, 5D, C2, 0C, 00, 8B, FF, 55, 8B, EC, 51, 51, 8D, 45, F8, 50, FF, 15, F8, 82, 16, 10, 8B, 45, F8, 8B, 4D, FC, 6A, 00, 05, 00, 80, C1, 2A, 68, 80, 96, 98, 00, 81, D1, 21, 4E, 62, FE, 51, 50, E8, 50, F9, FF, FF, 83, FA, 07, 7C, 0E, 7F, 07, 3D, FF, 6F, 40, 93, 76, 05, 83, C8, FF, 8B, D0, 8B, 4D, 08, 85, C9, 74, 05, 89, 01, 89, 51, 04, C9, C3, 8B, FF, 55, 8B, EC, 8B, 45, 08, 66, 8B, 55, 0C... 
[+]

Code size:

1.4 MB (1,467,904 bytes)

2 Internet Explorer BHOs

CLSID:

{ecdc465a-cf20-4b82-9a26-47c9dc52fa32}

CLSID name:

Eazel-IT Toolbar

CLSID:

{34ea1c70-42cc-42c5-aa29-ec58b95a343e}

CLSID name:

myBabylon English Toolbar

The file tbeaz0.dll has been discovered within the following programs.

7screensavers Toolbar by Conduit Ltd.

7screensavers Toolbar is a web browser extension that changes the browsers search and home pages as well as delivers.

www.ourtoolbar.com

68% remove it

Acoustic Alternative Toolbar by Acoustic Alternative

Acoustic Alternative Toolbar is a Conduit distributed toolbar built on the community toolbar platform which provides potentially unwanted web browser integration.

AcousticAlternative.OurToolbar.com

75% remove it

BS Player Toolbar by AB Team, d.o.o.

Installs a Conduit powered OurToolbar in Internet Explorer, Chrome and Firefox web browsers. The software collects and stores information about your web browsing and sends this information to OurToolbar so they can suggest services or provide ads via the toolbar.

BSPlayer.OurToolbar.com

63% remove it

Expat_Shield Toolbar by AnchorFree Inc

Expat Shield is a VPN program that allows users to access UK TV websites such as BBC iPlayer and ITV when outside of the UK. Expat Shield routes your IP address via a UK IP address as if you were still in the UK wherever you are in the world.

expatshield.ourtoolbar.com

72% remove it

IsoBuster Toolbar by Conduit Ltd.

IsoBuster Toolbar is a Community Toolbar by Conduit that runs in IE, Chrome and Firefox Web browsers. The toolbar collects and stores information about your web browsing and sends this information to OurToolbar so they can suggest services or provide ads via the toolbar.

79% remove it

Jaybob's_Movies Toolbar by Conduit Ltd.

Jaybob's_Movies Toolbar is a Conduit powered OurToolbar for Internet Explorer, Chrome and Firefox web browsers.

jaybobsmovies.ourtoolbar.com

65% remove it

myBabylon English Toolbar by Conduit Ltd.

myBabylon English Toolbar is a 'Community Toolbar' from Conduit, which integrates with major web browsers including Google Chrome, Firefox and Internet Explorer.

myBabylonEnglish.OurToolbar.com

78% remove it

myBabylon_English Toolbar by Babylon Ltd

Installs a Conduit toolbar in your Web browser that collects and stores information about your web browsing and sends this information to Conduit so they can suggest services or provide ads via the toolbar.

71% remove it

NCH Toolbar by Conduit Ltd.

NCH Toolbar is a Community Toolbar by Conduit that runs in IE, Chrome and Firefox Web browsers. The toolbar collects and stores information about your web browsing and sends this information to OurToolbar so they can suggest services or provide ads via the toolbar.

NCH.OurToolbar.com

62% remove it

ooVoo Video Chat Toolbar by Conduit Ltd.

ooVoo Video Chat Toolbar is a Community Toolbar by Conduit that runs in Internet Explorer, Chrome and Firefox Web browsers.

ooVooVideoChat.OurToolbar.com

70% remove it

Latest 20 of 13 programs

The file tbeaz0.dll has been seen being distributed by the following URL.

http://ieupdate.conduit.com/.../tbedrs.dll

Remove tbeaz0.dll - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.