Home Malware Programs Browser Hijackers Gadgetbox Search

Gadgetbox Search

Posted: July 8, 2013

Threat Metric

Ranking: 3,808
Threat Level: 1/10
Infected PCs: 36,530
First Seen: April 10, 2013
Last Seen: October 17, 2023
OS(es) Affected: Windows

Gadgetbox Search is an unwanted toolbar/ browser hijacker, which is pushed via other free program downloads (PDF creators video, recording/streaming or download-managers) that had bundled into their installation Gadgetbox Search. Once installed on a vulnerable computer, Gadgetbox Search will embed its own toolbar and replace the default homepage and default search engine with Search.gboxapp.com, and install the Gadgetbox Toolbar. Gadgetbox Search will display disturbing pop-up advertisements and sponsored links in search results of any legal search engine and may gather search terms from an attacked Internet user's search queries. Gadgetbox Search is used to raise traffic of the particular advertising website by using blackhat SEO and benefit from click fraud. Gadgetbox Search is also recognized as a PUP (potentially unwanted program). Gadgetbox Search is also bundled within the custom installer on many download websites, such as Brothersoft, Softonic, or CNET so if the computer user has downloaded a certain application from these websites, Gadgetbox Search might have been installed as well during the application setup process.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:



C:\AdwCleaner\Quarantine\ZMrF6cI6NX\gadgetBoxTB_new.dll File name: gadgetBoxTB_new.dll
Size: 306.68 KB (306688 bytes)
MD5: 6f781a30f3168c80d00ba0a199d1cbd9
Detection count: 5,712
File type: Dynamic link library
Mime Type: unknown/dll
Path: C:\AdwCleaner\Quarantine\ZMrF6cI6NX\gadgetBoxTB_new.dll
Group: Malware file
Last Updated: July 13, 2023
%SYSTEMDRIVE%\Users\<username>\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1ZPEMAKQ\gadgetbox[1].exe File name: gadgetbox[1].exe
Size: 673.87 KB (673877 bytes)
MD5: af9b8ae40b12c12377364183f402517d
Detection count: 9
File type: Executable File
Mime Type: unknown/exe
Path: %SYSTEMDRIVE%\Users\<username>\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1ZPEMAKQ\gadgetbox[1].exe
Group: Malware file
Last Updated: August 17, 2022

Registry Modifications

The following newly produced Registry Values are:

CLSID{3B81079D-2AC9-425f-A494-A1C7D93AFA3C}{A36BCB13-778D-4A40-99C1-D686086D268F}{AA74FE59-BC4C-4172-9AC4-73315F71CFFE}{CCA8F2AB-BE4E-41F0-A289-4D960CEA58EA}HKEY..\..\..\..{RegistryKeys}Software\Microsoft\Internet Explorer\Explorer Bars\{3B81079D-2AC9-425f-A494-A1C7D93AFA3C}Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\gboxapp.comSoftware\Microsoft\Internet Explorer\SearchScopes\{AA74FE59-BC4C-4172-9AC4-73315F71CFFE}Software\Microsoft\Internet Explorer\UrlSearchHooks\{3B81079D-2AC9-425f-A494-A1C7D93AFA3C}Software\Wow6432Node\Microsoft\Internet Explorer\Explorer Bars\{3B81079D-2AC9-425f-A494-A1C7D93AFA3C}Software\Wow6432Node\Microsoft\Internet Explorer\UrlSearchHooks\{3B81079D-2AC9-425f-A494-A1C7D93AFA3C}HKEY_LOCAL_MACHINE\Software\[APPLICATION]\Microsoft\Windows\CurrentVersion\Uninstall..{Uninstaller}Gadgetbox

Additional Information

The following directories were created:
%ALLUSERSPROFILE%\GadgetBox%ALLUSERSPROFILE%\InstallMate\{ACE9FB2A-31A5-4285-9510-43F1636EAB21}%PROGRAMFILES%\Windows Sidebar\Shared Gadgets\gadgetbox.gadget%ProgramFiles%\GadgetBox%ProgramFiles(x86)%\GadgetBox
The following URL's were detected:
http://search.gboxapp.com/?
Loading...