Home Possibly Unwanted Program WebBars

WebBars

Posted: June 2, 2016

Threat Metric

Threat Level: 1/10
Infected PCs: 354
First Seen: June 2, 2016
Last Seen: May 26, 2024
OS(es) Affected: Windows


WebBars is a Russian application that is supposed to help users download videos from YouTube. This program also is intended to work on Russian social networks like Vkontakte and Odnoklassniki (meaning Classmates). The main feature of WebBars may work properly, but the software comes with a range of other problems. The security researchers classify WebBars as a Potentially Unwanted Program (PUP). The main reason to include WebBars in this category is that WebBars may affect third-party applications automatically. This video downloader is supported by ads, which you may encounter in Google Chrome, Mozilla Firefox and Internet Explorer. These commercial materials may be pretty annoying since they may cover a substantial area of almost all sites. WebBars tries to redirect you to sponsored domains, whose administrators are willing to pay referral commissions for the favor. Some of the promoted pages may be associated with commercial activity. Unfortunately, other sites may be involved in harmful schemes. They may, for example, offer you potentially dangerous software or undertake hoaxes to take your money. You can never be sure which ad will open safe platform and which will transfer you to a harmful one. For this reason, you should not click on any pop-up, banner or sponsored video with the slogan 'Brought by WebBars.' WebBars may change parts of the configuration of your browser automatically. WebBars may manipulate your searches or change your default provider to make you visit affiliated sites. Your homepage also may get replaced automatically. The extension that this PUP creates in the browsers may deteriorate their performance. Some PC users report that WebBars appeared all of a sudden, and they cannot recall downloading it. This issue may mean that this unreliable video downloader has entered in a software bundle, where the core program could have been freeware. The recommended course of action is to eliminate WebBars with a dedicated security utility immediately.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:



Toolbar64.dll File name: Toolbar64.dll
File type: Dynamic link library
Mime Type: unknown/dll
Group: Malware file
Toolbar32.dll File name: Toolbar32.dll
File type: Dynamic link library
Mime Type: unknown/dll
Group: Malware file
Runner.exe File name: Runner.exe
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Loader.exe File name: Loader.exe
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Interfaces64.dll File name: Interfaces64.dll
File type: Dynamic link library
Mime Type: unknown/dll
Group: Malware file
Interfaces32.dll File name: Interfaces32.dll
File type: Dynamic link library
Mime Type: unknown/dll
Group: Malware file
info.json File name: info.json
Mime Type: unknown/json
Group: Malware file
BackgroundSingleton.exe File name: BackgroundSingleton.exe
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
C:\Program Files\WebBars\uninstall.exe File name: C:\Program Files\WebBars\uninstall.exe
File type: Executable File
Mime Type: unknown/exe
Group: Malware file

Registry Modifications

The following newly produced Registry Values are:

CLSID{16CDE58D-402C-4FDA-92BB-DB2126A9A9B8}{83E7EA11-DE7D-408E-BA29-37D7F2B56D81}{9C695544-B1A7-4B74-B27A-D4D1F69DCCD1}Regexp file mask%WINDIR%\System32\Tasks\Update Service for WebBars%WINDIR%\System32\Tasks\Update Service for WebBars2%WINDIR%\Tasks\Update Service for WebBars.job%WINDIR%\Tasks\Update Service for WebBars2.jobHKEY..\..\..\..{RegistryKeys}Software\Microsoft\Internet Explorer\Approved Extensions\{9024F973-80C4-4B58-B02A-67C42A38232C}SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{175E8022-4A3D-4079-89AB-2E43A08401E1}SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{9024F973-80C4-4B58-B02A-67C42A38232C}SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{175E8022-4A3D-4079-89AB-2E43A08401E1}SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{9024F973-80C4-4B58-B02A-67C42A38232C}HKEY_LOCAL_MACHINE\Software\[APPLICATION]\Microsoft\Windows\CurrentVersion\Uninstall..{Uninstaller}WebBars

Additional Information

The following directories were created:
%PROGRAMFILES%\WebBars%PROGRAMFILES(X86)%\WebBars%USERPROFILE%\AppData\LocalLow\WebBars%USERPROFILE%\Application Data\WebBars
The following URL's were detected:
webbars.ru
Loading...