Home Malware Programs Bad Toolbars Oscar Delta Toolbar

Oscar Delta Toolbar

Posted: December 9, 2013

Threat Metric

Ranking: 14,763
Threat Level: 5/10
Infected PCs: 5,876
First Seen: December 9, 2013
Last Seen: August 22, 2023
OS(es) Affected: Windows

Oscar Delta Toolbar Screenshot 1The Oscar Delta Toolbar or, to use its full name, the Oscar Delta DX Group Toolbar, is a radio hobbyist add-on that malware researchers have categorized as a Potentially Unwanted Program. As a PUP, the Oscar Delta Toolbar doesn't pose a major risk to your computer, but the Oscar Delta Toolbar does make settings changes controlling which sites your browser loads and may display advertisements. Deleting an Oscar Delta Toolbar is the safest reaction that you can take to seeing the Oscar Delta Toolbar on your browser, for which purpose the use of a steadfast anti-malware application is heartily suggested.

The Oscar Delta Toolbar: Definitely not an Alpha at Add-on Originality

A common example of an add-on with minor advantages and not-so-minor disadvantages, the Oscar Delta Toolbar is one of the latest analyzed members of the Conduit family of toolbars. This family has an extended history of trying to promote its affiliated website through unwanted and unneeded changes to the browsers of their users. Most of these browser changes are implemented either as homepage hijacks or search engine hijacks, the latter of which Oscar Delta Toolbar has designed to participate in – as the Oscar Delta Toolbar mentions in its overly lengthy Privacy Policy. Other tidbits hidden in the Oscar Delta Toolbar's user agreement include granting the Oscar Delta Toolbar permission to hijack your Web searches, monitor your online searches and deliver a variety of third party offers (or advertisements, as they're known).

While the Oscar Delta Toolbar's behavior certainly isn't beneficial for its user, neither is the Oscar Delta Toolbar particularly unique. Malware researchers have tracked the development of Conduit-affiliated toolbars for quite some time, with the Oscar Delta Toolbar just as one of the latest examples in a long line of browser-hijacking PUPs. Other toolbars from this family often use different themes and may pretend to provide other 'useful' services, as seen in the Crizbuzz Toolbar, the Swirlz Toolbar, the Sweet Tunes Toolbar, the Energy Community Toolbar, the MySavings Toolbar and the MakeMeBabies Toolbar.

Awarding the Oscar Delta Toolbar an Oscar in the Category of 'Most Quickly Uninstalled Toolbar'

Because the Conduit.com website isn't classified as an infection vector or other website-based threat, an Oscar Delta Toolbar is more of an irritant than the Oscar Delta Toolbar is a danger to your computer. Nevertheless, any cautious PC user would do well to remove the Oscar Delta Toolbar, or any other browser-hijacking add-on, as soon as possible when their browser redirects start becoming noticeable. Currently, the Oscar Delta Toolbar may affect the Chrome, Internet Explorer, Firefox and Safari browsers, making the Oscar Delta Toolbar compatible with both Mac OS X and Windows.

A browser that does have the Oscar Delta Toolbar installed, particularly when the installation uses suspect sources, usually should be disinfected by dedicated anti-malware tools. Closing your browser and launching in Safe Mode will provide a better environment than usual for removing all associated PC threats and getting your browser back to its old self.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:



C:\Users\<username>\AppData\Local\\babylon\\babylon\\2.2.0.0\babylon.exe File name: babylon.exe
Size: 314.88 KB (314880 bytes)
MD5: b1acdba825d9a815fca64828b45f00c6
Detection count: 562
File type: Executable File
Mime Type: unknown/exe
Path: C:\Users\<username>\AppData\Local\\babylon\\babylon\\2.2.0.0\babylon.exe
Group: Malware file
Last Updated: November 17, 2022
C:\Users\<username>\AppData\Local\\delta\\delta\\2.2.4.0\delta.exe File name: delta.exe
Size: 314.88 KB (314880 bytes)
MD5: af03dab221e9a52ba39ffb60dfe116dc
Detection count: 386
File type: Executable File
Mime Type: unknown/exe
Path: C:\Users\<username>\AppData\Local\\delta\\delta\\2.2.4.0\delta.exe
Group: Malware file
Last Updated: January 21, 2023
C:\Users\<username>\AppData\Local\\delta\\delta\\2.2.3.0\delta.exe File name: delta.exe
Size: 314.88 KB (314880 bytes)
MD5: a73c37d44700ec1e0dbf2be1c8451fac
Detection count: 197
File type: Executable File
Mime Type: unknown/exe
Path: C:\Users\<username>\AppData\Local\\delta\\delta\\2.2.3.0\delta.exe
Group: Malware file
Last Updated: December 10, 2021
C:\Users\<username>\AppData\Local\\delta\\delta\\2.2.0.1\delta.exe File name: delta.exe
Size: 314.88 KB (314880 bytes)
MD5: c0a2cb90edad563c1066d0e444d518c4
Detection count: 117
File type: Executable File
Mime Type: unknown/exe
Path: C:\Users\<username>\AppData\Local\\delta\\delta\\2.2.0.1\delta.exe
Group: Malware file
Last Updated: June 25, 2022
CT623771.xpi File name: CT623771.xpi
Size: 1.49 MB (1491642 bytes)
MD5: d08ae7160a35cde8d59ee2b744b667e1
Detection count: 66
Mime Type: unknown/xpi
Group: Malware file
Last Updated: December 17, 2013

Registry Modifications

The following newly produced Registry Values are:

HKEY..\..\..\..{RegistryKeys}Software\Microsoft\Windows\CurrentVersion\Run\ConduitFloatingPlugin_dadagcojlmomnjijlemdpoblelliecgi

Additional Information

The following directories were created:
%LOCALAPPDATA%\Google\Chrome\User Data\Default\Extensions\dadagcojlmomnjijlemdpoblelliecgi%LOCALAPPDATA%\Google\Chrome\User Data\Default\Local Extension Settings\dadagcojlmomnjijlemdpoblelliecgi%LOCALAPPDATA%\Google\Chrome\User Data\Default\databases\chrome-extension_dadagcojlmomnjijlemdpoblelliecgi_0%LOCALAPPDATA%\NativeMessaging\CT623771%USERPROFILE%\AppData\LocalLow\Oscar_Delta
Loading...