Should I block it?
Yes, 98% block recommendation.
Possible reasons:
Multiple malware detections
Performance resource utilization
Additional versions
(Note, Zugo Ltd publishes each variation of this file with the same version, but the hashes are unique.)
Relationships
Parent process
Related files
ToolbarUpdaterService.exe
By Zugo Ltd (Signed)
| MD5: | 70eb41a4417ba0aa36ae12bf2b4d98f6 |
| SHA1: | ee697048ccb7950d5b03a98a1b3850e84dfa16c1 |
| SHA256: | 62c4aa714d27f9306338266ad757d701a2d07d68210d2db9754bb6589acc17f9 |
Warning 5 antivirus scanners has detected malware.
What is ToolbarUpdaterService.exe?
ToolbarUpdaterService.exe for the StartNow Toolbar is the software updater program which runs in the background of Windows and automatically starts up when your PC boots. It checks for software udpates and automatically downloads and installs them if found.
About ToolbarUpdaterService.exe (from Zugo Ltd)
“StartNow toolbar is developed by Zugo and it gives you instant access to multimedia search, Facebook one click away, your local weather forecast and many other features that give you the best online e”
Details
| File name: | ToolbarUpdaterService.exe |
| Typical file path: | C:\Program Files\startnow toolbar\toolbarupdaterservice.exe |
| Size: | 239.22 KB (244,960 bytes) |
| Certificate |
| Issued to: | Zugo Ltd |
| Authority (CA): | The USERTRUST Network |
| Effective date: | Thursday, January 27, 2011 |
| Expiration date: | Sunday, January 27, 2013 |
| Digital DNA |
| Entropy: | 6.259639 |
| File packed: | No |
| .NET CLR: | No |
More details
Programs
The following program will install this file
StartNow is a web browser toolbar that changes your homepage and redirects valid searches. StartNow toolbar is developed by Zugo and it gives you instant access to multimedia search, Facebook one click away, your local weather forecast and many other features that give you the best online experience. It is simple, light weight and blends perfectly with your browser to give you instant access to your favourite sites and information.
Behaviors
Services
Runs under 'SYSTEM\CurrentControlSet\Services' by the Service Controller (services.exe)
- Updater Service for PDFLite Toolbar
- 'Updater Service for StartNow Toolbar'
Network connections
[UDP] listens on port 51656
[UDP] listens on port 60494
[UDP] listens on port 51832
Malware detections
Based on 40+ industry antivirus scanners, 5 of them detected the following malware.
| Antivirus engine | Engine version | Detection |
| Antiy Labs AVL |
2.0.3.7 |
Trojan/Win32.Agent.gen |
| Dr.Web |
8.13.4.9 |
Adware.Zugo.71 |
| Emsisoft Anti-Malware |
3.0.0.575 |
Riskware.Win32.Toolbar.Zugo.AMN (A) |
| ESET NOD32 |
7.8171 |
Win32/Toolbar.Zugo |
| Fortinet |
5.0.43.0 |
Adware/Zugo |
Resource utilization
(Note: statistics below are averages based on a minimum sample size of 200 unique participants)
Averages
| CPU |
| Total CPU: | 0.00276831% | |
| Kernel CPU: | 0.00186452% | |
| User CPU: | 0.00090379% | |
| Kernel CPU time: | 70 ms/min | |
| CPU cycles: | 69,065/sec | |
| Memory |
| Private memory: | 3.73 MB | |
| Private (maximum): | 849 KB | |
| Private (minimum): | 777 KB | |
| Non-paged memory: | 3.73 MB | |
| Virtual memory: | 67.03 MB | |
| Virtual memory (peak): | 75.13 MB | |
| Working set: | 842 KB | |
| Working set (peak): | 9.12 MB | |
| Page faults: | 4,740/min | |
| I/O |
| I/O read transfer: | 7.19 KB/sec | |
| I/O read operations: | 2/sec | |
| I/O write transfer: | 14.19 KB/sec | |
| I/O write operations: | 3/sec | |
| I/O other transfer: | 258 Bytes/sec | |
| I/O other operations: | 23/sec | |
| Resource allocations |
| Threads: | 8 | |
| Handles: | 261 | |
Process properties
| Integrety level: | System |
| Platform: | 64-bit |
| Command line: | "C:\Program Files\startnow toolbar\toolbarupdaterservice.exe" |
| Owner: | SYSTEM |
| Windows Service |
| Service name: | SYSTEM\CurrentControlSet\Services\Updater Service for StartNow Toolbar |
| Display name: | Updater Service for PDFLite Toolbar |
| Parent process: | services.exe (Services and Controller app by Microsoft) |
Threads
Averages
| wow64.dll |
| Total CPU: | 0.00194336% | |
| Kernel CPU: | 0.00143595% | |
| User CPU: | 0.00050742% | |
| CPU cycles: | 52,691/sec | |
| Memory: | 252 KB | |
| ntdll.dll |
| Total CPU: | 0.00078144% | |
| Kernel CPU: | 0.00078144% | |
| User CPU: | 0.00000000% | |
| CPU cycles: | 6,710/sec | |
| Memory: | 1.66 MB | |
| sechost.dll |
| Total CPU: | 0.00072060% | |
| Kernel CPU: | 0.00048040% | |
| User CPU: | 0.00024020% | |
| CPU cycles: | 74,054/sec | |
| Memory: | 100 KB | |
| ToolbarUpdaterService.exe (main module) |
| Total CPU: | 0.00071818% | |
| Kernel CPU: | 0.00036585% | |
| User CPU: | 0.00035233% | |
| CPU cycles: | 20,814/sec | |
| Memory: | 260 KB | |
| WININET.dll |
| Total CPU: | 0.00024020% | |
| Kernel CPU: | 0.00024020% | |
| User CPU: | 0.00000000% | |
| CPU cycles: | 29,116/sec | |
| Memory: | 980 KB | |
Distribution by Windows OS
| OS version | distribution |
| Windows XP Professional |
50.00% |
|
| Windows 7 Home Premium |
20.00% |
|
| Windows Vista Home Premium |
20.00% |
|
| Windows Vista Ultimate |
10.00% |
|
Distribution by country
United States installs about 100.00% of ToolbarUpdaterService.exe.
Distribution by PC manufacturer
| PC Manufacturer | distribution |
| Dell |
80.00% |
|
| Hewlett-Packard |
20.00% |
|
