Home Safe Programs Good Toolbars Nmwegbsf Toolbar

Nmwegbsf Toolbar

Posted: June 4, 2008

ScreenshotNmwegbsf Toolbar is a Trojan toolbar from the Zlob family. Nmwegbsf Toolbar is a clone of other popular malicious toolbars like Atfxqogp Toolbar, Gktxaspm Toolbar, Mkrndofl Toolbar, Pvnsmfor Toolbar and Sgoblxtm Toolbar. Nmwegbsf Toolbar infects your system through corrupt video codecs, such as Video Access Codec, which are found on rogue and porn websites.

Nmwegbsf Toolbar is similar to Atfxqogp Toolbar in which it displays an interstitial ad page that has the title "Insecure Internet Activity - Threat of Virus Attack" with two links are shown under it. One link says "get protection" and the other "remain unprotected". Once you click on the "get protection" link, you'll be sent to a rogue website to download the rogue anti-spyware program Malware Protector 2008.

Nmwegbsf Toolbar has four icons named "Remove Popups", "Scan Spyware", "Security Test" and "Spam Protection", all of which lead to malicious websites that promote Malware Protector 2008. A yellow bar also appears on the Nmwegbsf Toolbar which attaches itself to the top of the search results webpage and says the following message: "Warning: possible spyware or adware infection! Click here to scan your computer for spyware...".

None of the products and services Nmwegbsf Toolbar distributes are legitimate or trustworthy. It is recommended the immediate removal of Nmwegbsf Toolbar.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 oggview32.dll
    2 toprates.dll
    3 turbosearchsite.dll

Registry Modifications

  • The following CLSID's were detected:
    HKEY..\..\{CLSID Path}47EFD4AD-CB46-4549-B24B-CEE415394C56A74F3FC3-CC9A-4D4C-AFB5-B56F0CAA445D17D2F953-B2D1-4D1B-BCD3-20432E09ECF14090F502-6B2D-41B4-8409-B08905A3A0E6F10587E9-0E47-4CBE-84AE-7DD20B8684BBF4D76F09-7896-458a-890F-E1F05C46069F80DFDD57-D8B8-4991-82B9-9E9D426668B0
Loading...