Home Malware Programs Adware iWebar

iWebar

Posted: December 18, 2013

Threat Metric

Ranking: 2,413
Threat Level: 2/10
Infected PCs: 76,231
First Seen: December 18, 2013
Last Seen: October 17, 2023
OS(es) Affected: Windows

iWebar is adware that may display a variety of unwanted pop-up advertisements including discount coupons on the desktop of the computer system while the PC user is surfing on the Internet. iWebar may target Internet Explorer, Mozilla Firefox and Google Chrome web browsers. Once iWebar is installed on the PC, it may cover the screen of the computer with random pop-up ads while the computer user is visiting shopping related websites or social networking websites and other websites. If the PC user clicks on pop-up ads delivered by iWebar, he may get unwillingly rerouted to questionable websites that may show commercial ads. The main goal of iWebar may possibly be to boost traffic of unreliable websites and make money from ad clicks. iWebar may circulate and enter the computer system through bundled free apps. PC users may avoid this if they are attentive while installing other free programs and unmarking all options which may offer to install extra software that they are not familiar with. However, many PC users may often overlook the steps of the installation of other free tools simply because they want to install a desired program as quickly as possible. iWebar may gather information about the PC user's surfing routine and then transmit this data to the third parties and use it with the aim to deliver and show targeted advertisements.

Technical Details

Registry Modifications

The following newly produced Registry Values are:

CLSID{11111111-1111-1111-1111-110311551110}{22222222-2222-2222-2222-220322552210}{44444444-4444-4444-4444-440344554410}{55555555-5555-5555-5555-550355555510}{66666666-6666-6666-6666-660366556610}Regexp file mask%WINDIR%\System32\Tasks\Installer_iwebar%WINDIR%\System32\Tasks\iWebar-chromeinstaller%WINDIR%\System32\Tasks\iWebar-codedownloader%WINDIR%\System32\Tasks\iWebar-enabler%WINDIR%\System32\Tasks\iWebar-firefoxinstaller%WINDIR%\System32\Tasks\iWebar-updater%WINDIR%\Tasks\iWebar-chromeinstaller.job%WINDIR%\Tasks\iWebar-codedownloader.job%WINDIR%\Tasks\iWebar-enabler.job%WINDIR%\Tasks\iWebar-firefoxinstaller.job%WINDIR%\Tasks\iWebar-updater.jobHKEY..\..\..\..{RegistryKeys}Software\AppDataLow\Software\Crossrider\onBeforeNavigate\35510Software\AppDataLow\Software\Crossrider\onRequest\35510Software\AppDataLow\Software\iWebarSOFTWARE\Classes\68671f62832e4803b34065d441f9a2210065123.BHOSOFTWARE\Classes\68671f62832e4803b34065d441f9a2210065123.BHO.1SOFTWARE\Classes\68671f62832e4803b34065d441f9a2210065123.SandboxSOFTWARE\Classes\68671f62832e4803b34065d441f9a2210065123.Sandbox.1SOFTWARE\Classes\CrossriderApp0035510.BHOSOFTWARE\Classes\CrossriderApp0035510.BHO.1SOFTWARE\Classes\CrossriderApp0035510.SandboxSOFTWARE\Classes\CrossriderApp0035510.Sandbox.1Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Software\iWebarSOFTWARE\InstalledBrowserExtensions\21836Software\InstalledBrowserExtensions\21836\35510Software\InstalledBrowserExtensions\iWebarSOFTWARE\iWebarSOFTWARE\iWebar-nvSOFTWARE\iWebar-nv-edgeSoftware\iWebar-nv-ieSoftware\Microsoft\Internet Explorer\Approved Extensions\{11111111-1111-1111-1111-110311551110}Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{11111111-1111-1111-1111-110311551110}Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{002255df-f361-4e29-b00b-d20403cebc16}Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{2837e313-a40f-4c02-b2d1-b7fbdf8884f9}Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{323ba568-5bdd-4660-a515-539fc3a87e54}Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8529ef48-2a25-4db8-bd46-8e8a8e0febfd}Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{94573f2c-7948-4a62-a279-254930e526f6}Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{95d1b1f6-13ab-4066-9e02-d6f81fb5940d}Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9e799fb7-8c3d-4dbf-8d52-c4420bf0ae18}SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION\iWebar-bg.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Installer_iwebarSOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\iWebar-chromeinstallerSOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\iWebar-codedownloaderSOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\iWebar-enablerSOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\iWebar-firefoxinstallerSOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\iWebar-updaterSOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110311551110}Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{11111111-1111-1111-1111-110311551110}Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{11111111-1111-1111-1111-110311551110}SOFTWARE\Wow6432Node\InstalledBrowserExtensions\21836SOFTWARE\Wow6432Node\iWebarSOFTWARE\Wow6432Node\iWebar-nvSOFTWARE\Wow6432Node\iWebar-nv-edgeSOFTWARE\Wow6432Node\iWebar-nv-ieSOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{2837e313-a40f-4c02-b2d1-b7fbdf8884f9}SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{323ba568-5bdd-4660-a515-539fc3a87e54}SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8529ef48-2a25-4db8-bd46-8e8a8e0febfd}SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{94573f2c-7948-4a62-a279-254930e526f6}SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9e799fb7-8c3d-4dbf-8d52-c4420bf0ae18}SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION\iWebar-bg.exeSOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110311551110}HKEY_LOCAL_MACHINE\Software\[APPLICATION]\Microsoft\Windows\CurrentVersion\Uninstall..{Uninstaller}iWebar

Additional Information

The following directories were created:
%APPDATA%\iWebar%LOCALAPPDATA%\iWebar-BrowserExtensionUninstall%PROGRAMFILES%\iWebar%PROGRAMFILES(x86)%\iWebar%USERPROFILE%\AppData\LocalLow\iWebar

Related Posts

One Comment

Loading...