V-bates

V-bates

Known Toolbar

by Bit Cocktail Ltd.

What is V-bates?

V-bates is software application developed by Bit Cocktail Ltd.. It is most commonly found on computers running Windows 7 with nearly 54.90% of installations running this operating system. V-bates's installer is typically 5.00 MB in size and installs around 19 files. The most common release is 2.0.0.442 with 70.99% of all installations currently using this version.

V-bates is most popular in the United States with 67.62% of installations residing in this country.

V-bates adds 1 scheduled task to the Windows Task Scheduler launching the program at randomly scheduled times.

About V-bates?

The Wajamu toolbar/web browser extension is an ad/search-supported tool commonly installed as an optional offer, often bundled with third-party software. Upon installation, the toolbar will adjust the home page and new tab pages to an affiliate search portal utilizing a primary search engine to generate shared search revenue. It will also modify the default search provider. It should be noted that this add-on is installed into Firefox and Chrome silently, which goes against the Add-on Guidelines.

Multiple virus scanners have detected malware in V-bates.

notifier.exe (MD5: afe8f17cb9444b2f78681e4cb9a71c9c) has been flagged by 11 scanners:
Scanner Software Result
Lavasoft Ad-Aware Adware.SearchGuard.B
AVG Wajamu.F3D
AVware Wajamu (fs)
Baidu-International Adware.Win32.BitCocktail.81
Bitdefender Adware.SearchGuard.B
Emsisoft Anti-Malware Adware.SearchGuard.B (B)
F-Secure Adware.SearchGuard.B
G Data Adware.SearchGuard.B
MicroWorld-eScan Adware.SearchGuard.B
nProtect Adware.SearchGuard.B
VIPRE Antivirus Wajamu (fs)
Extension64.dll (MD5: 6047ff74d5f44577390893cb1ecbc5ea) has been flagged by 15 scanners:
Scanner Software Result
Lavasoft Ad-Aware Adware.SearchGuard.B
AVG Wajamu.F3D
AVware Wajamu (fs)
Baidu-International Adware.Win32.Agent.40
Bitdefender Adware.SearchGuard.B
Emsisoft Anti-Malware Adware.SearchGuard.B (B)
F-Secure Adware.SearchGuard.B
G Data Adware.SearchGuard.B
McAfee Artemis!6047FF74D5F4
McAfee-GW-Edition Artemis!6047FF74D5F4
MicroWorld-eScan Adware.SearchGuard.B
nProtect Adware.SearchGuard.B
TrendMicro-HouseCall Suspicious_GEN.F47V0701
VIPRE Antivirus Wajamu (fs)
Symantec WS.Reputation.1
ExtensionUpdaterService.exe (MD5: cf66ca0b94d9ca6f02aa36f78aca5542) has been flagged by 17 scanners:
Scanner Software Result
AVG Wajamu
Baidu-International Adware.Win32.BitCocktail.81
ESET-NOD32 a variant of Win32/Toolbar.BitCocktail.B
Malwarebytes PUP.Optional.SweetPacks.A
VIPRE Antivirus Wajamu (fs)
Lavasoft Ad-Aware Adware.SearchGuard.B
AVware Wajamu (fs)
Bitdefender Adware.SearchGuard.B
Emsisoft Anti-Malware Adware.SearchGuard.B (B)
F-Secure Adware.SearchGuard.B
G Data Adware.SearchGuard.B
McAfee Artemis!6047FF74D5F4
McAfee-GW-Edition Artemis!6047FF74D5F4
MicroWorld-eScan Adware.SearchGuard.B
nProtect Adware.SearchGuard.B
TrendMicro-HouseCall Suspicious_GEN.F47V0701
Symantec WS.Reputation.1
Extension32.dll (MD5: 81391e0177f7f853f89ac488fa6ab20d) has been flagged by 5 scanners:
Scanner Software Result
AVG Wajamu.F3D
AVware Wajamu (fs)
Baidu-International Adware.Win32.Agent.40
G Data Win32.Adware.Wajamu.B
VIPRE Antivirus Wajamu (fs)
guardsvc.exe (MD5: 257754e4713a1bed11d1d674106d8dc6) has been flagged by 11 scanners:
Scanner Software Result
Lavasoft Ad-Aware Adware.SearchGuard.B
AVG Wajamu.F3D
AVware Wajamu (fs)
Baidu-International Adware.Win32.Wajam.81
Bitdefender Adware.SearchGuard.B
Emsisoft Anti-Malware Adware.SearchGuard.B (B)
F-Secure Adware.SearchGuard.B
G Data Adware.SearchGuard.B
MicroWorld-eScan Adware.SearchGuard.B
nProtect Adware.SearchGuard.B
VIPRE Antivirus Wajamu (fs)

Software Behaviors

Services:
  • ExtensionUpdaterService.exe runs as a service named 'V-bates Updater' (V-bates Updater).
Scheduled tasks:
  • PrefHelper.exe is scheduled as a task named 'FF Watcher {5547EFC4-6E5D-4CB6-8978-1BBB0D295BD6}'.

Startup Entries

Startup tasks:
  • PrefHelper.exe is automatically launched at startup through a scheduled task named FF Watcher {047ACC18-6D1C-4A44-9029-AAD8CA307DC7}.
  • PrefHelper.exe is automatically launched at startup through a scheduled task named FF Watcher {14CABEE5-1F2F-447B-A633-274B777B84D7}.

Software Details

URL:
–
Support:
–
Installation path:
C:\Program Files\V-bates\
Uninstaller:
"C:\Program Files\V-bates\unins000.exe"
Size:
5.00 MB
Language:
English

V-bates Executable Details

Primary executable:
ExtensionUpdaterService.exe
Name:
V-bates
Path:
C:\Program Files\V-bates\ExtensionUpdaterService.exe
MD5:
cf66ca0b94d9ca6f02aa36f78aca5542
SHA-1:
–
SHA-256:
–
Files installed by V-bates
File Type Filename MD5
EXE
717e78c455ac2ee64060c6af9573ce1f
DLL
9306c7873fb88df77d09e847c5ac9d3d
EXE
afe8f17cb9444b2f78681e4cb9a71c9c
DLL
d196a5253c6f4c2af863178c2b59b88c
DLL
6047ff74d5f44577390893cb1ecbc5ea
EXE
cf66ca0b94d9ca6f02aa36f78aca5542
DLL
81391e0177f7f853f89ac488fa6ab20d
EXE
c7f40fc7f9968f74ba320a63578eded0
CRX
81792b6e2ae9bf716d9e4ded73ec52b8
DLL
25d0b2f54f0605c227d9e75c07878e7a