Should I block it?

98%

Yes, 98% block recommendation.

Possible reasons:

Multiple malware detections

Performance resource utilization

Additional versions

64eb5	3.51%
e202a	7.02%
1b34b	10.53%
af529	1.75%
952ec	1.75%
67873	3.51%
7e109	10.53%
0e4fd	8.77%
26b5c	1.75%
6870e	1.75%
c9eb9	1.75%
332a7	7.02%
6ec14	5.26%
a5584	1.75%
3cda2	3.51%
94ca1	1.75%
62e62	1.75%
40a32	1.75%
2e0f2	3.51%
d4c00	3.51%
b5f86	1.75%
d86f9	3.51%
3ccdd	1.75%
fb2d4	1.75%
87ecf	5.26%
View more
7c3a7	1.75%
10fc7	1.75%

(Note, Bandoo Media publishes each variation of this file with the same version, but the hashes are unique.)

Relationships

PE file structure

Show functions

Import table

advapi32.dll

ConvertSidToStringSidW, IsValidSid, GetTokenInformation, GetLengthSid, InitializeAcl, AddAce, GetSecurityInfo, GetAclInformation, GetAce, DeleteAce, SetSecurityInfo, OpenThreadToken, OpenProcessToken, RegEnumKeyW, ConvertStringSecurityDescriptorToSecurityDescriptorW, InitializeSecurityDescriptor, SetSecurityDescriptorDacl, RegNotifyChangeKeyValue, RegEnumValueW, RegQueryValueExW, RegEnumKeyExW, RegQueryInfoKeyW, RegSetValueExW, RegDeleteValueW, RegDeleteKeyW, RegCreateKeyExW, RegOpenKeyExW, RegCloseKey, SetKernelObjectSecurity, LookupAccountNameW, SaferCreateLevel, SaferCloseLevel, SetTokenInformation, CreateProcessAsUserW, GetSidSubAuthorityCount, GetUserNameW, GetSidLengthRequired, InitializeSid, GetSidSubAuthority, CopySid, SaferComputeTokenFromLevel

comctl32.dll

InitCommonControlsEx, _TrackMouseEvent

gdi32.dll

GetTextExtentPoint32W, SetTextColor, DeleteDC, CreateCompatibleBitmap, BitBlt, CreateFontIndirectW, CreateCompatibleDC, GetObjectW, SetBkMode, CreatePatternBrush, CreateSolidBrush, DeleteObject, GetTextMetricsW, SelectObject, GetStockObject

iphlpapi.dll

GetAdaptersInfo

kernel32.dll

DllMain

netapi32.dll

Netbios

ole32.dll

CoTaskMemRealloc, CoCreateInstance, CoTaskMemFree, CoUninitialize, CoInitialize, CLSIDFromString, StringFromGUID2, CoTaskMemAlloc, StringFromIID, CoCreateGuid, CoSetProxyBlanket

sensapi.dll

IsNetworkAlive

shell32.dll

SHGetSpecialFolderPathW, SHFileOperationW, ShellExecuteExW

shlwapi.dll

PathRemoveFileSpecW, UrlIsW, PathAddBackslashW, SHDeleteKeyW, SHCopyKeyW, StrStrIW

user32.dll

PeekMessageW, MsgWaitForMultipleObjectsEx, SetPropW, MessageBoxW, FindWindowW, MsgWaitForMultipleObjects, IsWindowUnicode, GetMessageA, DispatchMessageA, SetCursor, GetSysColor, ReleaseDC, GetDC, EndPaint, BeginPaint, PtInRect, IsWindow, RedrawWindow, SetWindowPos, DrawTextW, GetActiveWindow, SetLayeredWindowAttributes, SystemParametersInfoW, GetClientRect, GetWindowRect, MoveWindow, FillRect, DialogBoxParamW, LoadBitmapW, GetCursorPos, TrackMouseEvent, GetTopWindow, ChildWindowFromPoint, ShowWindow, ScreenToClient, GetMessageW, TranslateMessage, DispatchMessageW, CreateWindowExW, RegisterClassExW, PostQuitMessage, LoadCursorW, GetClassInfoExW, KillTimer, SetTimer, PostMessageW, LoadStringW, GetDlgItem, SetWindowTextW, SendMessageW, EndDialog, GetWindowLongW, SetWindowLongW, CallWindowProcW, DestroyWindow, CharNextW, DefWindowProcW, GetParent, UnregisterClassA, LoadStringA, InvalidateRect, GetGUIThreadInfo

version.dll

GetFileVersionInfoW, GetFileVersionInfoSizeW, VerQueryValueW

wininet.dll

InternetCloseHandle, InternetReadFile, HttpQueryInfoW, HttpSendRequestW, InternetSetOptionW, HttpOpenRequestW, InternetConnectW, InternetOpenW, InternetGetConnectedState

datamngrUI.exe

By Bandoo Media (Signed)

Remove datamngrUI.exe

MD5:	1b34bb332729a9b288da14ce5ea5149f
SHA1:	61c34116ce03fed40d352c9bbd289ec35af0efe6
SHA256:	3403e63d44a00228d64642c5830a27c2298c64890f8cb636b780f92157b2ab8d

Warning 4 antivirus scanners has detected malware.

What is datamngrUI.exe?

Searchqu Toolbar is a browser add-on which adds various shortcuts and other buttons to your Internet browsers such as Internet Explorer, FireFox, Google Chrome. Some PC users may find such shortcuts useful but Searchqu Toolbar can be categorized as an unwanted program because it's deceptive ways of installation and not full uninstall procedures. When installed on your PC this toolbar by default will change your homepage to searchnu.com.

About datamngrUI.exe (from Bandoo Media)

“Windows Searchqu Toolbar is an Internet browser toolbar that offers helpful search suggestions as the user types keywords into the search box. Additionally, it catches misspelled words and suggests a ”

Details

File name:	datamngrUI.exe
Typical file path:	C:\Program Files\Windows Searchqu Toolbar\Datamngr\datamngrUI.exe
Size:	1.8 MB (1,890,744 bytes)
Certificate
Issued to:	Bandoo Media
Authority (CA):	Thawte
Expiration date:	Friday, November 2, 2012
Digital DNA
PE subsystem:	Windows GUI
File packed:	No
.NET CLR:	No

More details

Programs

The following programs will install this file

Windows Searchqu Toolbar

Bandoo Media Inc

88% remove

Windows Searchqu Toolbar is an ad-supported program installed into Internet Explorer, Firefox and Chrome. The programs collects and stores information about web browsing habits and sends this information to its remote servers in order to provide injected advertising in search results and various other places. It will also modify the browser's home page and search provider. It displays various pop-up advertisements and tracks and reports...

Searchqu Toolbar

Bandoo Media Inc

83% remove

The Searchqu Toolbar is a Bandoo powered toolbar (by Bandoo Media Inc) for Intenet Explorer and Firefox. Searchqu collects and stores information about your web browsing habits and sends this information to Conduit so they can suggest services or provide advertising via the toolbar. The Bandoo Searchqu Toolbar will attempt to change your home page and search provider if you are not careful during installation and provides a search box a...

Behaviors

Startup files (all users) run

Runs under the registry key 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run'

'DATAMNGR' → C:\Program Files1\WIA6EB~1\Datamngr\DATAMN~1.EXE

Network connections

[TCP] 207.232.22.52:80

Malware detections

Based on 40+ industry antivirus scanners, 4 of them detected the following malware.

Antivirus engine	Engine version	Detection
Emsisoft Anti-Malware	3.0.0.575	Riskware.Win32.Toolbar.SearchSuite.AMN (A)
ESET NOD32	7.8175	a variant of Win32/Toolbar.SearchSuite.A
K7 AntiVirus	9.164.8447	Adware
Trend Micro HouseCall	9.700.0.1001	TROJ_GEN.F47V0902

Resource utilization

(Note: statistics below are averages based on a minimum sample size of 200 unique participants)

Averages

CPU
Total CPU:	0.05048919%	0.028634%
Kernel CPU:	0.04394301%	0.013761%
User CPU:	0.00654618%	0.014873%
Kernel CPU time:	657 ms/min	100,923,805ms/min
CPU cycles:	115,974/sec	17,470,203/sec
Memory
Private memory:	2.56 MB	21.59 MB
Private (maximum):	6.3 MB
Private (minimum):	1.58 MB
Non-paged memory:	2.56 MB	21.59 MB
Virtual memory:	81.25 MB	140.96 MB
Virtual memory (peak):	85.08 MB	169.69 MB
Working set:	1.91 MB	18.61 MB
Working set (peak):	7.96 MB	37.95 MB
Page faults:	7,187/min	2,039/min
I/O
I/O read operations:	1/sec	343/min
I/O other transfer:	317 Bytes/sec	448.09 KB/min
I/O other operations:	36/sec	1,671/min
Resource allocations
Threads:	10	12
Handles:	248	600
GUI GDI count:	19	103
GUI GDI peak:	28	142
GUI USER count:	13	49
GUI USER peak:	22	71

Process properties

Integrety level:	Medium
Platform:	32-bit
Command lines:	"C:\Program Files\searchqu toolbar\datamngr\datamngrui.exe" "C:\progra~1\search~1\datamngr\datamn~1.exe" "C:\progra~1\search~2\datamngr\datamn~1.exe"
Owner:	User

Threads