What is WiseConvert Toolbar?

WiseConvert Toolbar is software application developed by WiseConvert. It is most commonly found on computers running Windows 7 with nearly 73.63% of installations running this operating system. WiseConvert Toolbar's installer is typically 4.00 MB in size and installs around 18 files. The most common release is 6.9.0.16 with 59.34% of all installations currently using this version.

WiseConvert Toolbar is most popular in the United States with 59.52% of installations residing in this country.

WiseConvert Toolbar adds 2 scheduled tasks to the Windows Task Scheduler launching the program at randomly scheduled times. When using a computer that is connected to the internet, WiseConvert Toolbar is known to create 1 firewall exception to allow inbound and outbound connectivity.

About WiseConvert Toolbar?

The software installs a browser toolbar provided by Conduit, which gathers and retains data on the user's web browsing activities. This information is transmitted to Conduit, enabling them to offer personalized services and deliver targeted advertisements via the toolbar.

Multiple virus scanners have detected malware in WiseConvert Toolbar.

uninstall.exe (MD5: b728fa6a309e5d18141947b95b730e95) has been flagged by 3 scanners:

Scanner Software	Version	Result
Panda Antivirus	10.0.3.5	PUP/Conduit.A
VIPRE Antivirus	26380	Conduit (fs)
ESET-NOD32	9148	a variant of Win32/Toolbar.Conduit.P

tbWise.dll (MD5: a8a1b6e818b4e7ad6ec777c6633ced69) has been flagged by 16 scanners:

Scanner Software	Version	Result
ESET-NOD32	7.9731	a variant of Win32/Toolbar.Conduit.B
Panda Antivirus	14.08.06.10	PUP/Conduit.A
VIPRE Antivirus	28650	Conduit (fs)
AVware	1.5.0.21	Conduit (fs)
Baidu-International	3.5.1.41473	PUA.Win32.Conduit.BX
Fortinet FortiGate	5.0.999.0	Riskware/Toolbar_Conduit
G Data	24	Win32.Application.Conduit.F
Comodo Security	17676	Application.Win32.Conduit.~A
Malwarebytes	1.75.0.1	PUP.Optional.Conduit
TrendMicro-HouseCall	9.700.0.1001	TROJ_GEN.F47V1113
Agnitum Outpost	5.5.1.3	PUA.Toolbar.Conduit!
Dr.Web	7.00.8.02260	Adware.Conduit.16
IKARUS anti.virus	T3.1.7.5.0	PUA.ClientConnect
Avira AntiVir	7.11.151.60	TR/Trash.Gen
SUPERAntiSpyware	5.6.0.1032	Trojan.Agent/Gen-Nullo[Short]
Symantec	20131.1.5.61	Bloodhound.MalPE

tbWis0.dll (MD5: 975993043e355206a1fba5a702044f0c) has been flagged by 14 scanners:

Scanner Software	Version	Result
Comodo Security	17676	Application.Win32.Conduit.~A
ESET-NOD32	9338	a variant of Win32/Toolbar.Conduit.B
Malwarebytes	1.75.0.1	PUP.Optional.Conduit
Panda Antivirus	10.0.3.5	Adware/Conduit
TrendMicro-HouseCall	9.700.0.1001	TROJ_GEN.F47V1113
VIPRE Antivirus	25818	Conduit (fs)
Agnitum Outpost	5.5.1.3	PUA.Toolbar.Conduit!
Dr.Web	7.00.8.02260	Adware.Conduit.16
Baidu-International	3.5.1.41473	Adware.Win32.Conduit.45
G Data	24	Win32.Adware.Conduit.B
IKARUS anti.virus	T3.1.7.5.0	PUA.ClientConnect
Avira AntiVir	7.11.151.60	TR/Trash.Gen
SUPERAntiSpyware	5.6.0.1032	Trojan.Agent/Gen-Nullo[Short]
Symantec	20131.1.5.61	Bloodhound.MalPE

prxtbWise.dll (MD5: e73a448c311cbea9951941a9d8bcb413) has been flagged by 7 scanners:

Scanner Software	Version	Result
Avira AntiVir	7.11.151.60	TR/Trash.Gen
Dr.Web	7.00.9.04080	Trojan.Damaged.1
SUPERAntiSpyware	5.6.0.1032	Trojan.Agent/Gen-Nullo[Short]
Symantec	20131.1.5.61	Bloodhound.MalPE
ESET-NOD32	9264	a variant of Win32/Toolbar.Conduit.P
VIPRE Antivirus	25216	Conduit (fs)
Panda Antivirus	10.0.3.5	PUP/Conduit.A

prxtbWis2.dll (MD5: 480994ae776f86dc885fd654665ebdfa) has been flagged by 11 scanners:

Scanner Software	Version	Result
Agnitum Outpost	5.5.1.3	PUA.Toolbar.Conduit!
Dr.Web	7.00.8.02260	Adware.Conduit.16
ESET-NOD32	9631	a variant of Win32/Toolbar.Conduit.X
Panda Antivirus	10.0.3.5	PUP/Conduit.A
VIPRE Antivirus	27980	Conduit (fs)
Baidu-International	3.5.1.41473	Adware.Win32.Conduit.45
G Data	24	Win32.Adware.Conduit.B
IKARUS anti.virus	T3.1.7.5.0	PUA.ClientConnect
Avira AntiVir	7.11.151.60	TR/Trash.Gen
SUPERAntiSpyware	5.6.0.1032	Trojan.Agent/Gen-Nullo[Short]
Symantec	20131.1.5.61	Bloodhound.MalPE

Software Behaviors

Firewall:

WiseConvertToolbarHelper.exe is added as a firewall exception for 'C:\Program Files\eTvOnline.ro\eTvOnline.roToolbarHelper.exe'.

Scheduled tasks:

uninstall.exe is scheduled as a task with the class '{42CD7A24-AF4B-44A0-A119-1C6F9B6E2A90}' (runs on registration).
WiseConvertToolbarHelper.exe is scheduled as a task with the class '{34C01E1F-1D33-4264-8F52-97E13432C5E2}' (runs on registration).

Software Details

URL:

https://wiseconvert.ourtoolbar.com

Support:

https://wiseconvert.ourtoolbar.com/help

Installation path:

C:\Program Files\WiseConvert

Uninstaller:

C:\Program Files\WiseConvert\uninstall.exe toolbar

Size:

4.00 MB

Language:

English

WiseConvert Toolbar Executable Details

Primary executable:

tbWise.dll

Name:

WiseConvert Toolbar

Path:

C:\Program Files\WiseConvert\tbWise.dll

MD5:

a8a1b6e818b4e7ad6ec777c6633ced69

SHA-1:

–

SHA-256:

–

File Type

Filename

MD5

DLL

ldrtbWis0.dll

Malware

ce49528c9b0b3b3018ee2f70e76b362a

DLL

hktbWis2.dll

0e96154db502fb40ff99e980b4606fee

DLL

hktbWis0.dll

65394bd2969dd5002fef2eaa6096fd99

DLL

hk64tbWis2.dll

131a24d32db11671b1e737d784f565ab

DLL

hk64tbWis0.dll

bb9a3d5b48a59dfea97b22a4db5ecb4b

DLL

prxtbWis1.dll

f28eae74738ddb54919456b4be34d307

EXE

WiseConvertToolbarHelper.exe

Malware

da11d78d765e4b8fa4cfa5a37e8a94ff

EXE

WiseConvertToolbarHelper1.exe

4885da24a2c3f5b1426a4073de5e1c19

File Type	Filename	MD5
DLL	ldrtbWis0.dll Malware	ce49528c9b0b3b3018ee2f70e76b362a
DLL	hktbWis2.dll	0e96154db502fb40ff99e980b4606fee
DLL	hktbWis0.dll	65394bd2969dd5002fef2eaa6096fd99
DLL	hk64tbWis2.dll	131a24d32db11671b1e737d784f565ab
DLL	hk64tbWis0.dll	bb9a3d5b48a59dfea97b22a4db5ecb4b
DLL	prxtbWis1.dll	f28eae74738ddb54919456b4be34d307
EXE	WiseConvertToolbarHelper.exe Malware	da11d78d765e4b8fa4cfa5a37e8a94ff
EXE	WiseConvertToolbarHelper1.exe	4885da24a2c3f5b1426a4073de5e1c19