» tbhelper.dll
Overview
Analysis
File Details

tbhelper.dll

Internet Explorer Toolbar

ShopAtHome.com (Belcaro Group, Inc)

The module tbhelper.dll, “Internet Explorer Toolbar Helper” by ShopAtHome.com (Belcaro Group, Inc) has been detected as adware by 3 anti-malware scanners.

File name:

tbhelper.dll

Publisher:

ShopAtHome.com (Belcaro Group, Inc) (signed and verified)

Product:

Internet Explorer Toolbar

Description:

Internet Explorer Toolbar Helper

Version:

4.3.0.19

MD5:

edf0df137f6944a1c2281409617a5956

SHA-1:

775c91430e60c4704ae786371ee8e0b734b5d818

SHA-256:

1932113729bf5918eedc2ba535e48e1691c0a181568930a3c62740158089539f

Scanner detections:

3 / 68

Status:

Adware

Explanation:

Part of the Conduit (ClientConnect) Toolbar platform.

Analysis date:

1/15/2025 6:03:52 AM UTC (today)

Scan engine

Detection

Engine version

Reason Heuristics

Plugin.ConduitToolbar.Toolbar.I

14.7.17.10

Sophos

SAHAgent

4.98

Trend Micro House Call

TROJ_GEN.F47V0531

7.2.166

File size:

290.1 KB (297,104 bytes)

Product version:

4.3.0.19

Original file name:

tbhelperU.dll

File type:

Dynamic link library (Win32 DLL)

Language:

English (United States)

Common path:

C:\users\{user}\appdata\roaming\shopathome\shopathometoolbar\tbhelper.dll

Digital Signature

Signed by:

ShopAtHome.com (Belcaro Group, Inc)

Authority:

Symantec Corporation

Valid from:

5/21/2013 5:00:00 PM

Valid to:

6/6/2014 4:59:59 PM

Subject:

CN="ShopAtHome.com (Belcaro Group, Inc)", O="ShopAtHome.com (Belcaro Group, Inc)", L=Greenwood Village, S=Colorado, C=US, SERIALNUMBER=19871692567, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.2=Colorado, OID.1.3.6.1.4.1.311.60.2.1.3=US

Issuer:

CN=Symantec Class 3 Extended Validation Code Signing CA, OU=Symantec Trust Network, O=Symantec Corporation, C=US

Serial number:

05AACC1DBAF989DD6997926C9649BAEF

File PE Metadata

Compilation timestamp:

6/12/2013 10:05:29 AM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

10.0

CTPH (ssdeep):

6144:XGmhFh+/KFajwZqWnOcl74fyE9MnGJi+bnQQVEBl:jjs8asEWnVl74fyE9MnSiQBEBl

Entry address:

0x19F55

Entry point:

8B, FF, 55, 8B, EC, 83, 7D, 0C, 01, 75, 05, E8, 36, 8B, 00, 00, FF, 75, 08, 8B, 4D, 10, 8B, 55, 0C, E8, EC, FE, FF, FF, 59, 5D, C2, 0C, 00, 8B, FF, 55, 8B, EC, 56, 8D, 45, 08, 50, 8B, F1, E8, 4C, F7, FF, FF, C7, 06, 74, D8, 03, 10, 8B, C6, 5E, 5D, C2, 04, 00, C7, 01, 74, D8, 03, 10, E9, 90, F7, FF, FF, 8B, FF, 55, 8B, EC, 56, 8B, F1, C7, 06, 74, D8, 03, 10, E8, 7D, F7, FF, FF, F6, 45, 08, 01, 74, 07, 56, E8, E9, B0, FF, FF, 59, 8B, C6, 5E, 5D, C2, 04, 00, 8B, FF, 55, 8B, EC, 56, 57, 8B, 7D, 08, 8B, 47, 04... 
[+]

Entropy:

6.6537

Code size:

201 KB (205,824 bytes)

Remove tbhelper.dll - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.