» tbfree.dll
Overview
Analysis
File Details
Behaviors (8)
Programs (10)
Downloads (1)

tbfree.dll

Conduit Toolbar

Conduit Ltd.

The file is part of the Conduit Toolbar platform, a web browser monetization engine that is typiclaly distributed with third party programs through a bundled installation, this particular version is part of the Conduit Toolbar bundle. The module tbfree.dll by Conduit has been detected as a potentially unwanted program by 3 anti-malware scanners. It is installed within the context of Internet Explore as a BHO (Browser Helper Object) under the name ‘free-downloads.net Toolbar’. Additionally, the file is typically installed by a number of programs including Free_TV_Bar Toolbar by Conduit Ltd. and DailyGames Toolbar by Conduit Ltd., both potentially unwanted software.

File name:

tbfree.dll

Publisher:

Conduit Ltd. (signed and verified)

Product:

Conduit Toolbar

Version:

5, 3, 4, 2

MD5:

455e61a2cf37f7210df685e2b77bfbe3

SHA-1:

4e8bc33c6dfbdd9727988eb0aa95af115c08fa8f

SHA-256:

1429bb65815378be477091733036bf346c2030d3cec57b9ce55010c8ff21e3f0

Scanner detections:

3 / 68

Status:

Potentially unwanted

Explanation:

This component is distributed and installed with the Conduit Toolbar platform.

Analysis date:

12/24/2024 11:44:57 AM UTC (today)

Scan engine

Detection

Engine version

ESET NOD32

Win32/Toolbar.Conduit (variant)

7.9162

Reason Heuristics

SearchPlugin.ConduitSearchBar.BHO.G

14.8.7.22

VIPRE Antivirus

Conduit

24266

File size:

2.2 MB (2,349,080 bytes)

Product version:

5, 3, 4, 2

Trademarks:

File type:

Dynamic link library (Win32 DLL)

Language:

English (United States)

Common path:

C:\Program Files\free-downloads.net\tbfree.dll

Digital Signature

Signed by:

Conduit Ltd.

Authority:

VeriSign, Inc.

Valid from:

1/17/2007 1:00:00 AM

Valid to:

3/24/2010 12:59:59 AM

Subject:

CN=Conduit Ltd., OU=Digital ID Class 3 - Microsoft Software Validation v2, O=Conduit Ltd., S=Israel, C=IL

Issuer:

CN=VeriSign Class 3 Code Signing 2004 CA, OU=Terms of use at https://www.verisign.com/rpa (c)04, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:

59AB9B2EE67914B7DF4C479540DEC561

Registration

CLSIDs:

{2800C981-A7AB-480A-B1F8-FC19D824B3D6}, {A1E75A0E-4397-4BA8-BB50-E19FB66890F4}

ProgID:

Toolbar.CT2475029

COM registered:

Yes

File PE Metadata

Compilation timestamp:

12/31/2009 10:53:52 AM

OS version:

5.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

9.0

CTPH (ssdeep):

49152:GYqHRU4WtsufiSkJ9Z9gfU4zG+zWxK7/xrFbAvzVQQiFimvB25:GT0tNiZvMfhLzWxKjshB

Entry address:

0x1173A0

Entry point:

8B, FF, 55, 8B, EC, 83, 7D, 0C, 01, 75, 05, E8, 35, 99, 00, 00, FF, 75, 08, 8B, 4D, 10, 8B, 55, 0C, E8, EC, FE, FF, FF, 59, 5D, C2, 0C, 00, 8B, FF, 55, 8B, EC, 8B, 45, 08, 66, 8B, 55, 0C, EB, 07, 66, 3B, CA, 74, 11, 40, 40, 0F, B7, 08, 66, 85, C9, 75, F1, 66, 39, 10, 74, 02, 33, C0, 5D, C3, CC, CC, CC, CC, CC, CC, CC, 55, 8B, EC, 57, 56, 8B, 75, 0C, 8B, 4D, 10, 8B, 7D, 08, 8B, C1, 8B, D1, 03, C6, 3B, FE, 76, 08, 3B, F8, 0F, 82, A4, 01, 00, 00, 81, F9, 00, 01, 00, 00, 72, 1F, 83, 3D, 7C, 65, 1C, 10, 00, 74... 
[+]

Code size:

1.3 MB (1,340,928 bytes)

3 Internet Explorer BHOs

CLSID:

{ecdee021-0d17-467f-a1ff-c7a115230949}

CLSID name:

free-downloads.net Toolbar

CLSID:

{707db484-2428-402d-afb5-d85b387544c7}

CLSID name:

Mario Forever Toolbar

CLSID:

{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}

CLSID name:

MyAshampoo Toolbar

2 Internet Explorer Toolbars

Display name:

free-downloads.net Toolbar

CLSID:

{ecdee021-0d17-467f-a1ff-c7a115230949}

Display name:

Mario Forever Toolbar

CLSID:

{707db484-2428-402d-afb5-d85b387544c7}

2 Internet Explorer URL Search Hooks

CLSID:

{ecdee021-0d17-467f-a1ff-c7a115230949}

CLSID name:

free-downloads.net Toolbar

CLSID:

{707db484-2428-402d-afb5-d85b387544c7}

CLSID name:

Mario Forever Toolbar

Internet Explorer Web Browser

Name:

{ECDEE021-0D17-467F-A1FF-C7A115230949}

The file tbfree.dll has been discovered within the following programs.

BS_Player Toolbar by Conduit Ltd.

This is a Conduit/Perion (ClientConnect) powered toolbar that provides limited web browser functionality but will modify the user's search and home pages as well as bundle various ad-supported components.

www.ourtoolbar.com

69% remove it

DailyGames Toolbar by Conduit Ltd.

DailyGames Toolbar installs a Conduit toolbar in various Web browsers that collects and stores information about your web browsing habits and sends this information to Conduit so they can suggest services or provide ads via the toolbar.

wwwdailygamescom.ourtoolbar.com

62% remove it

Free_TV_Bar Toolbar by Conduit Ltd.

Installs a Conduit toolbar in your Web browser that collects and stores information about your web browsing habits and sends this information to Conduit so they can suggest services or provide ads via the toolbar.

75% remove it

Hotspot Shield Toolbar for IE by Conduit Ltd.

Hotspot Shield is a Conduit Connect toolbar for Internet Explorer. This toolbar runs as a web browser extension and Browser Helper Object and is distributed using the Conduit/Perion monetization platform.

HotspotShield.OurToolbar.com

78% remove it

IObitCom Toolbar by IObit

IObitCom Toolbar is an ad-supported (users may see additional banner and in-text link advertisements) cross web browser plugin for Internet Explorer (BHO) and Firefox/Chrome (plugin) and distributed through various monetization platforms during installation.

66% remove it

IsoBuster Toolbar by Conduit Ltd.

IsoBuster Toolbar is a Community Toolbar by Conduit that runs in IE, Chrome and Firefox Web browsers. The toolbar collects and stores information about your web browsing and sends this information to OurToolbar so they can suggest services or provide ads via the toolbar.

79% remove it

Mario_Forever Toolbar by Conduit Ltd.

Contrary to what most Internet surfers may think, Mario Forever actually isn't a video game or gaming application; it's a browsing toolbar that can be installed in an Internet browser for Web searching and access to several customized applications.

info.trovi.com

74% remove it

MyAshampoo Toolbar by Ashampoo GmbH & Co. KG

Installs a Conduit powered OurToolbar in Internet Explorer, Chrome and Firefox web browsers. The software collects and stores information about your web browsing and sends this information to OurToolbar so they can suggest services or provide ads via the toolbar.

MyAshampoo.OurToolbar.com

72% remove it

myBabylon_English Toolbar by Babylon Ltd

Installs a Conduit toolbar in your Web browser that collects and stores information about your web browsing and sends this information to Conduit so they can suggest services or provide ads via the toolbar.

71% remove it

Softonic-IT Toolbar by Conduit Ltd.

From the Privacy Policy: "The Trovi Software (including the Toolbar, the Search Protect, and the Value Apps software) may also collect and store information about your web browsing locally on your device, like the web pages that you have visited and the content you have accessed.

68% remove it

Latest 20 of 13 programs

The file tbfree.dll has been seen being distributed by the following URL.

http://ieupdate.conduit.com/.../tbedrs.dll

Remove tbfree.dll - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.