Home Malware Programs Browser Hijackers KnowTheBible Toolbar

KnowTheBible Toolbar

Posted: April 23, 2014

Threat Metric

Ranking: 6,509
Threat Level: 5/10
Infected PCs: 11,148
First Seen: April 23, 2014
Last Seen: October 15, 2023
OS(es) Affected: Windows


The KnowTheBible Toolbar is a browser add-on that provides Bible verse lookup features, but also hijacks your browser's search engine in a manner that's typical of a variant of MyWebSearch. Search results procured through the KnowTheBible Toolbar rarely are threatening but may be inaccurate or include affiliate links to third-party sponsors, which makes the prolonged use of the KnowTheBible Toolbar's search 'feature' a questionable decision. Malware researchers currently classify the KnowTheBible Toolbar as a Potentially Unwanted Program, and recommend deleting the KnowTheBible Toolbar through the same methods applicable to any other browser hijacker.

Why the Bible isn't the Only Thing the KnowTheBible Toolbar Wants You to Know

The KnowTheBible Toolbar markets itself primarily as an educational tool for increasing accessibility to the Christian Bible, but this seemingly holy calling is a secondary aspect in the KnowTheBible Toolbar's set of features. As another version of the MyWebSearch toolbar, the KnowTheBible Toolbar's main functions are meant to redirect your Web browser's searches to affiliated sites. Search results found through these alternate sources usually are not threatening to your computer, but neither are they strenuously rated for accuracy, relevance or your safety.

Malware researchers see new versions of this software distributed almost weekly, with most variants including minor, positive features to distract from their search hijackings. Besides the KnowTheBible Toolbar, some other, recent examples of MyWebSearch clones include the TotalRecipeSearch Toolbar, the FilmFanatic Toolbar, the SoccerInferno Toolbar, the TelevisionFanatic.Toolbar, the Daily Bible Guide Toolbar and the WeatherBlink Toolbar. All evidence found by malware researchers so far indicates that all of these, and any other toolbar associated with MyWebSearch are equivalent to each other in terms of undesirable browser modifications and related symptoms, despite their different brand names and ostensible purposes.

Flipping the Page Away from the KnowTheBible Toolbar

Although Biblical scholarship is an admirable pastime, its pursuit never should entail giving up your own control over the software on your computer, including which sites your Web browser loads. The KnowTheBible Toolbar and other MyWebSearch toolbars may modify multiple browsers simultaneously, and malware experts have confirmed Firefox, Chrome and Internet Explorer as being the Web-browsing programs most likely to be hijacked. Deleting the KnowTheBible Toolbar with properly specialized PC security software is the recourse suggested by malware experts, although you may need to reset your browser's settings afterward.

Malware researchers usually find that the installers of PUPs such as the KnowTheBible Toolbar operate through the efforts of free software bundles that package more than one application's installation routine together. If, for some reason, you insist on installing software from sources likely to 'gift' you with a browser hijacker, you should try to scan downloaded files before you launch them. Proper PC security tools can detect widely-used PUP bundle-based utilities, including those that try to hide behind the 'Word of the Lord.'

Technical Details

Registry Modifications

The following newly produced Registry Values are:

CLSID{03F93D1D-0813-4F9B-BFE0-8892EF7C77D7}{09df68da-2acf-4828-9320-6d999a0834a3}{0b5f3350-4aaf-4f79-8e79-5f27101e3bcb}{13156FF9-0E67-4A4D-A528-558118B8B4D0}{171FD4EC-A44A-46D7-936F-F87CC7C11B28}{1733B2B4-AA70-4F7A-861B-445E684A147F}{18CA7BDA-98ED-4FE7-A6CA-18E939FF3C7C}{1b57d93a-ba4b-48aa-b61a-d27f76208884}{1C06A738-B60B-4402-9FA2-FD2D9F66B9E3}{1FA813C2-D24E-44B8-98CE-64E7E59F7E03}{1FC21123-4464-4281-BA8F-63A7E7A25AC6}{29062285-CFA7-49F0-933E-4EBFCF9193D9}{2F00700B-2223-40E4-A498-921EFDA62607}{3304EB48-3050-4409-B9E4-75D6254F34BB}{3934a030-3f39-49a9-a1c6-e566f5e6f214}{3f2ae504-aa17-4805-90e8-56e48f98731c}{40B9609F-E88E-41A1-92D5-39BCBFB050B8}{44101637-14AD-49B2-911F-2B21AA07E024}{49dfc715-3fdb-4f13-bd49-b3057e60db29}{4D90514C-5376-43FA-8030-2E1A8FDD3C3F}{4f426332-14d3-4383-abd6-ab0af916a73c}{5217D99D-F044-497A-BD1C-7C96A94B0989}{53418E1F-68F4-4248-860E-3EE2036E4084}{56C9BEB2-9A47-4FA4-8211-3C0AEFE31E6D}{642C935F-2789-451B-A143-3AA559E88DC2}{7203a4e6-5e6f-41c9-b9e7-cf227e0c9258}{7abeab51-07be-42c5-89b4-c7f1a3a31816}{7F29A125-2A27-4CB1-88EE-AC9213F352D0}{80BAD9F0-C176-4807-9C9C-45DB6AEFB02A}{8EA790C7-7ABD-495C-B18F-A6151F53E61F}{948336D5-D51E-4280-B32E-191982367B1B}{95b8d054-2982-4944-a649-a5f961b75463}{972058E6-0373-4987-B06A-269B2C9E573B}{98e8a9d7-97d0-44da-bbf1-952965cc9944}{99190D61-EFDA-409B-B0D2-E5C565CDFBCD}{9A33DA22-3172-48ED-BD00-6C776051F733}{A5ACA303-69AA-4FF6-8BD6-4630CA622ABE}{AD733DB8-1E5B-4B38-ADDD-FA4CBCFBC20D}{BC5E2B5A-4D37-4EA8-BCB3-04AB44C2E5E6}{BC86461B-908B-4F12-8CAD-1AA9D9717C50}{BE6EB150-709A-4AE4-8596-DA08AB48D867}{C5B608CF-BC87-4C74-8BE3-47138AFE8A93}{C88A6CC9-E1FD-4E3A-9DDB-F17D6F475453}{cc3b07ef-9441-4c7e-a1bc-8ff9940e9ec8}{CFFC9635-2090-4452-82E2-83DD32052E31}{D0330F02-E099-4DFB-9820-4C6E6D566F92}{D0C6C991-270D-4159-AEE0-F8E788ED6085}{D9273533-09A7-420F-99E4-D4B9D1BE7F27}{de0f0ec6-22bb-441c-83ff-4aa995b6753a}{e3465ed8-1f17-4b5c-b51d-5081f6d41ac6}{e7860dcd-dfa5-4a94-b6eb-8f79e0e9bbcf}{EFDCB716-F481-471E-851A-3713377FE2DD}{f3c098c2-7937-409e-9654-6f32ebbcf9d2}{f71c2389-b4bf-43d6-8571-8d82c5b84658}{f8f612c7-58e5-4efd-9435-5aa7a7a098d0}{FAE0690A-5A88-4218-AB2E-35AA880A36C2}{FAF2B364-5525-4FB0-ABB5-4DD71FF3E7DB}{FCFE68C4-059F-4F32-863C-17D660054B69}{fe25059a-395a-4541-a820-510a590a8663}File name without pathhttp_bibletriviatime.dl.tb.ask.com_0.localstoragehttp_bibletriviatime.dl.tb.ask.com_0.localstorage-journalHKEY..\..\..\..{RegistryKeys}Software\Microsoft\Internet Explorer\Approved Extensions\{09DF68DA-2ACF-4828-9320-6D999A0834A3}Software\Microsoft\Internet Explorer\Approved Extensions\{4F426332-14D3-4383-ABD6-AB0AF916A73C}Software\Microsoft\Internet Explorer\Approved Extensions\{7ABEAB51-07BE-42C5-89B4-C7F1A3A31816}SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1733b2b4-aa70-4f7a-861b-445e684a147f}SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{4b029b40-997f-4117-bada-cc66bc7aebc5}SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7203a4e6-5e6f-41c9-b9e7-cf227e0c9258}SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{80bad9f0-c176-4807-9c9c-45db6aefb02a}SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{980ab07e-fd49-4469-a3f1-efced34de513}SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{bec9ae26-225d-4ebe-a10f-9b292833f560}SOFTWARE\Microsoft\Internet Explorer\LowRegistry\DOMStorage\bibletriviatime.comSOFTWARE\Microsoft\Internet Explorer\LowRegistry\DOMStorage\bibletriviatime.dl.myway.comSOFTWARE\Microsoft\Internet Explorer\LowRegistry\DOMStorage\www.bibletriviatime.comSoftware\Microsoft\Internet Explorer\SearchScopes\{5aabc9ff-5729-4b10-8ce9-e6bcc6a701b6}Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{7ABEAB51-07BE-42C5-89B4-C7F1A3A31816}SOFTWARE\Microsoft\Internet Explorer\Toolbar\{7abeab51-07be-42c5-89b4-c7f1a3a31816}Software\Microsoft\Internet Explorer\URLSearchHooks\{3f2ae504-aa17-4805-90e8-56e48f98731c}SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{09df68da-2acf-4828-9320-6d999a0834a3}SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{4f426332-14d3-4383-abd6-ab0af916a73c}SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{BC86461B-908B-4F12-8CAD-1AA9D9717C50}SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{cc3b07ef-9441-4c7e-a1bc-8ff9940e9ec8}SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{e3465ed8-1f17-4b5c-b51d-5081f6d41ac6}SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{e7860dcd-dfa5-4a94-b6eb-8f79e0e9bbcf}SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{fe25059a-395a-4541-a820-510a590a8663}Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{09DF68DA-2ACF-4828-9320-6D999A0834A3}Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{4F426332-14D3-4383-ABD6-AB0AF916A73C}Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{7ABEAB51-07BE-42C5-89B4-C7F1A3A31816}SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1733b2b4-aa70-4f7a-861b-445e684a147f}SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{4b029b40-997f-4117-bada-cc66bc7aebc5}SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7203a4e6-5e6f-41c9-b9e7-cf227e0c9258}SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{80bad9f0-c176-4807-9c9c-45db6aefb02a}SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{980ab07e-fd49-4469-a3f1-efced34de513}SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{bec9ae26-225d-4ebe-a10f-9b292833f560}SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{5aabc9ff-5729-4b10-8ce9-e6bcc6a701b6}SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\{7abeab51-07be-42c5-89b4-c7f1a3a31816}SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{09df68da-2acf-4828-9320-6d999a0834a3}SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{4f426332-14d3-4383-abd6-ab0af916a73c}SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{BC86461B-908B-4F12-8CAD-1AA9D9717C50}SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{cc3b07ef-9441-4c7e-a1bc-8ff9940e9ec8}SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{e3465ed8-1f17-4b5c-b51d-5081f6d41ac6}SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{e7860dcd-dfa5-4a94-b6eb-8f79e0e9bbcf}SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{fe25059a-395a-4541-a820-510a590a8663}HKEY_LOCAL_MACHINE\Software\[APPLICATION]\Microsoft\Windows\CurrentVersion\Uninstall..{Uninstaller}BibleTriviaTime_4lbar Uninstall FirefoxBibleTriviaTime_4lbar Uninstall Internet Explorer

Additional Information

The following URL's were detected:
KnowtheBibleSearch.mywebsearch.com/mywebsearch/default.jhtml_4lMembers_@www.bibletriviatime.com
Loading...