Softonic_Plus Toolbar

from ClientConnect Ltd.

What is Softonic_Plus Toolbar?

Softonic Plus Toolbar is an Internet toolbar/plugin (for Internet Explorer it runs as a BHO, in Chrome and Firefox it will run as an extension) that plugs into the user's default web browser and will modify a number of settings such as taking control of the browser's search and home pages, new tab functionality as well as DNS 'not found' redirection. Additionally this potentially unwanted program will change some security settings of the browser that might also lower the overall security of the user's PC. This is done in order to allow the program to run uninterrupted. Should the user attempt to uninstall the software using the standard methods in Add/Remove Programs, only parts of this PUP will be uninstalled and some items such as the modified search and home pages may still point to an unwanted web page. Also to note as disclosed in the privacy policy, the program will track and report behaviors or the user while the plugin is installed including but not limited to the URLs and web pages the user visits as well as search terms and search results the user queries.

Overview

It adds a background controller service that is set to automatically run. Delaying the start of this service is possible through the service manager. The program adds a toolbar to Microsoft Internet Explorer. A scheduled task is added to Windows Task Scheduler in order to launch the program at various scheduled times (the schedule varies depending on the version). The software is designed to connect to the Internet and adds a Windows Firewall exception in order to do so without being interfered with. The main program executable is Softonic_PlusToolbarHelper1.exe. Typically most users end up uninstalling this just after a few days. The software installer includes 8 files and is usually about 9.9 MB (10,381,584 bytes).

Possible malware installed by this program
Loads into the web browser
Adds a background Windows Service
Installed as part of a co-bundle
Hijacks the web browser's home page
The experts agree, you should remove it!

Warning, multiple anti-virus scanners have detected possible malware in Softonic_Plus Toolbar.

Softonic_PlusToolbarHelper1.exe (a320df2b47cfcaf98d06eb59cd72084c) has been flagged by the following 5 scanners:
Anti-Virus software	Version	Detection
Bkav FE	1.3.0.6379	W32.HfsAdware
Dr.Web	9.0.0.0103	Adware.Conduit.300
G Data	14.11.25	Win32.Adware.Conduit
IKARUS anti.virus	t3scan.1.6.1.0	PUA.ClientConnect
Panda Antivirus	14.01.11.10	PUP/Conduit.A
prxtbSof0.dll (b92293778555ce3dabe7f0a7e98b34c0) has been flagged by the following 4 scanners:
Anti-Virus software	Software version	Detection
AVware	1.5.0.16	Conduit (fs)
IKARUS anti.virus	T3.1.6.1.0	PUA.ClientConnect
Panda Antivirus	10.0.3.5	PUP/Conduit.A
VIPRE Antivirus	32010	Conduit (fs)
tbSoft.dll (1fecf655218fdf7329bea67f519c8642) has been flagged by the following 3 scanners:
Anti-Virus software	Software version	Detection
ESET-NOD32	9883	a variant of Win32/Toolbar.Conduit.B
Panda Antivirus	10.0.3.5	PUP/Conduit.A
VIPRE Antivirus	29878	Conduit (fs)

Softonic_Plus Toolbar has been found to be bundled with 3rd party software. If you have not purposefully installed this, you should be safe uninstalling it.

Program details

Installation folder: C:\Program Files\softonic_plus

Uninstaller: C:\Program Files\Softonic_Plus\uninstall.exe

Estimated size: 9.9 MB

Files installed by Softonic_Plus Toolbar

Program executable:	Softonic_PlusToolbarHelper1.exe (Malware detected)
Path:	C:\Program Files\softonic_plus\Softonic_PlusToolbarHelper1.exe
MD5:	a320df2b47cfcaf98d06eb59cd72084c

Additional files:

tbSof1.dll (by Conduit) - Conduit Toolbar Automatic Update (Conduit Toolbar)
uninstall.exe (by Conduit) - Conduit Engine Uninstall
(Malware detected) prxtbSof0.dll - Conduit Toolbar
tbSof0.dll
(Malware detected) tbSoft.dll
Softonic_PlusToolbarHelper.exe
(Malware detected) Softonic_PlusToolbarHelper1.exe
UNWISE.EXE

Behaviors exhibited

2 Internet Explorer BHOs

tbSoft.dll is installed in Internet Explorer as a BHO (Browser Helper Object) under the name 'Coolstreaming Tool-Bar v1.0 Toolbar' with the class of {bd0e4d83-654e-4213-965b-fcbe887061f4}.
prxtbSof0.dll is installed in Internet Explorer as a BHO (Browser Helper Object) under the name 'Ashampoo FR Toolbar' with the class of {ba679afc-8ba0-48f4-b8bf-c144e8699fbc} (Ashampoo FR).

Internet Explorer Bar

prxtbSof0.dll installs an Explorer Bar in Internet Explorer called 'Vuze Remote Findbar' with a class of {644597E7-96EC-4DC8-BDE1-D150A08E8D92}.

2 Internet Explorer Toolbars

prxtbSof0.dll is loaded as Internet Explorer Toolbar with the name 'Free Lunch Design TB Toolbar' with the class of {a5ae8924-4036-420f-b7f6-a47e4b8f692e}.
tbSoft.dll is loaded as Internet Explorer Toolbar with the name 'Coolstreaming Tool-Bar v1.0 Toolbar' with the class of {bd0e4d83-654e-4213-965b-fcbe887061f4}.

2 Internet Explorer URL Search Hooks

prxtbSof0.dll loads into IE as a URL Search Hook named 'Max ES Atube Toolbar' with a class of {58ba374f-d9ea-4f27-bb8f-519b84820cc1} in order to redirect unknown URL searches.
tbSoft.dll loads into IE as a URL Search Hook named 'Coolstreaming Tool-Bar v1.0 Toolbar' with a class of {bd0e4d83-654e-4213-965b-fcbe887061f4} in order to redirect unknown URL searches.

2 Internet Explorer Web Browsers

prxtbSof0.dll installs an IE Web Browser in Internet Explorer named 'Free Lunch Design TB Toolbar' with a class of {A5AE8924-4036-420F-B7F6-A47E4B8F692E}.
tbSoft.dll installs an IE Web Browser in Internet Explorer named 'Coolstreaming Tool-Bar v1.0 Toolbar' with a class of {BD0E4D83-654E-4213-965B-FCBE887061F4}.

2 Scheduled Tasks

UNWISE.EXE is scheduled as a task with the class '{F71A9918-1861-4EFE-AE94-530BDDE46DD4}' (runs on registration).
Softonic_PlusToolbarHelper1.exe is scheduled as a task with the class '{B8E8E278-F25D-478A-BAB2-24A5EDB01F6C}' (runs on registration).

Service

UNWISE.EXE runs as a service named 'Browser System Enahncer' (671c50b0).

Windows Firewall Allowed Program

UNWISE.EXE is added as a firewall exception for 'C:\Program Files1\Yahoo!\MESSEN~1\UNWISE.EXE'.

How do I remove Softonic_Plus Toolbar?

You can uninstall Softonic_Plus Toolbar from your computer by using the Add/Remove Program feature in the Window's Control Panel.

On the Start menu (for Windows 8, right-click the screen's bottom-left corner), click Control Panel, and then, under Programs, do one of the following:

Windows Vista/7/8/10: Click Uninstall a Program.
Windows XP: Click Add or Remove Programs.

When you find the program Softonic_Plus Toolbar, click it, and then do one of the following:

Windows Vista/7/8/10: Click Uninstall.
Windows XP: Click the Remove or Change/Remove tab (to the right of the program).

Follow the prompts. A progress bar shows you how long it will take to remove Softonic_Plus Toolbar.
If for some reason uninstallation fails, please install Microsoft's uninstall fixer utility which will help fix problems with programs that can't be uninstalled at support.microsoft.com.