Besttoolbars.net

I know there is a thread similair to this but it remained ‘unanswered’ if it is a virus or not.

This is a toolbar made by me by using ToolbarStudio
Download Link :- [provided under the image]

Does this mean its a virus?

This is Jotti- Online Malware Scanner

http://img161.imageshack.us/img161/3739/eror7um.png

Here’s a download link for it if you want to check it yourself (to see if its a virus or not)- ONLY DOWNLOAD IT AT YOUR OWN RESPONSABILITY.IT WILL NOT BE MY FAULT.

www[broken].best toolbars.net/CUST/tbstudio.setup.exe
Your help is appreciated[broken]

Please don’t post active links to suspect files, modify the link and break the active link to avoid accidental exposure of the curious, e.g. http :confused: /www . besttoolbars.net/CUST/tbstudio.setup.exe

DrWeb link checker also detects this link as containing:
tbstudio.setup.exe packed by BINARYRES

tbstudio.setup.exe - archive INNO SETUP

tbstudio.setup.exe/data035 contains an advertising software Adware.SideSearch

tbstudio.setup.exe/data039/untitled.dll contains an advertising software Adware.Softomate
tbstudio.setup.exe/data059 packed by ZLIB
tbstudio.setup.exe/data059 - archive BINARYRES
The other files reported as OK.

So it would appear to be a correct detection of adware/spyware.

So it is an adware? Because on the site it says that their programs have no virus/adware

And sorry abut the link.I’ll change it immediately.

It certainly looks like that when three detect it as such, it may be that they don’t consider monitoring your activity to either deliver targeted ads or sponsored ads, etc. to be a virus/adware.

It could be that what they are doing is being misinterpreted, but the more that detect it as adware/spyware the more they need to look at the code perhaps. I know that some toolbars can have malicious content and some can be difficult to remove.

It would be interesting to see what adaware and spybot S&D make of it.

  1. Ad-Aware
  2. Spybot Search and Destroy

Or http://www.spywareguide.com/onlinescan.php

Dave that link you posted could contain a virus:

AntiVir
Found Exploit/HTML.CodeBase.1 exploit
ArcaVir
Found nothing
Avast
Found nothing
AVG Antivirus
Found nothing
BitDefender
Found Exploit.Html.Codebase.Exec.Gen
ClamAV
Found nothing
Dr.Web
Found nothing
F-Prot Antivirus
Found HTML/ObjCode@expl
Fortinet
Found HTML/CodeBaseExec!exploit
Kaspersky Anti-Virus
Found nothing
NOD32
Found nothing
Norman Virus Control
Found nothing
UNA
Found nothing
VirusBuster
Found nothing
VBA32
Found nothing

I think not it is a well known anti-spyware site and that is its on-line scanner interface and a check with DrWeb shows OK

I’m still not convinced 100%. I appreciate your help, I know you are more of an expert than me so you’re probably right.

This is an e-mail I sent to them with the reply.

This is the e-mail I Sent to them:

Wednesday, June 14, 2006, 1:17:22 AM, you wrote:

BL> You should see this because on your support and FAQ you said
BL> that your programs contain no viruses when a virus was found.
BL>
BL> To make sure you know what I’m saying you should go to
BL> these sites (which contain all the info that your program Makes a
BL> virus/adware)
BL>
BL> The links are:-
BL>
BL> http://forum.avast.com/index.php?topic=21642.0
BL> http://forum.avast.com/index.php?topic=21265.0
BL>
BL> You should check the problem for bugs before writing
BL> something which is not true on a place where you are supposed to
BL> offer help, altough I’m pretty sure its not of your making but a
BL> small bug/error in your program.
BL> Thanks for your support.

This is their reply:

Date: Wed, 14 Jun 2006 11:31:21 +0700
From: “Alex Bers” bers@softomate.com Add to Address Book Add Mobile Alert
To: “Brian Livori” brianlivori@yahoo.com
Subject: Re: important

Brian,

Our Source code do not have any Spyware built in. You
can verify this by reviewing it. Or asking any third party to review
our Source code. So the identification is happening in error.

To fix your .exe installer, please use “Add licence agreement” option,
when making it. The problem should be solved.

If you have comments about
our quality please email qam@besttoolbars.net.

Thank you,
Alex Bers
bers@softomate.com
offshore software development services for your projects

(BL = My name[It appears in reply])

And rest assured that I didn’t change a thing from what i sent and the reply.

Thank you again

Perhaps you should change something, I suggest that you remove or obscure the email addresses in the posted emails as this is a publicly available web site and as such email addresses could be harvested by spambots increasing the spam content in your email, more so when it also applies to others email addresses.

The decision is entirely yours as avast did find something albeit by a generic detection (perhaps you should send the sample for further analysis Or better still that softomate contact avast/Alwil) I can’t suggest what the other AVs that did detect it should/could do to confirm that the detection is correct. However, Kaspersky has detected it with a specific signature naming it precisely Adware.Win32.Softomate-j.

:slight_smile: Hi all :

 According to spywareguide, Softomate is an Adaware company :

"Softomate  

Type: Adware
SG Index: 2

Category Description: Program that delivers advertisments on your PC.

Note that many websites have their own advertising, unrelated to adware.

Adware is any software application in which advertising is displayed while the program is running. The authors of these applications include additional code that delivers the ads, which can be viewed through pop-up windows or through a bar that appears on a computer screen and sometimes through text links or in integrated search results. Adware may or may not track personal information. It may also gather information anonymously or in aggregate only. Users should check the EULA and Privacy policy to ensure if the adware on their machines conforms to their standards.

Properties: Shows Advertisements "

Hi InFeSTeD,

Yes this is spyware: read here:
http://www3.ca.com/securityadvisor/pest/pest.aspx?id=453082746
Wy siteadvisor does not flag it, I do not know, but there are downloadsites that are flagged red (also installs with WhenU crapware). Do not take risks, and steer away, if you do not need it.

polonus

Hi everybody,

Thanks for your help. I am now 100 % convinced :stuck_out_tongue:

InFESTeD

Regards

Wow that took some doing ;D I wouldn’t need to be 100% convinced, just 5% doubt/convinced that there could be an issue with any program not to use it.

;D ;D