{
  "family": "installtoolbar",
  "sample_count": 18,
  "category": "adware",
  "description": "InstallToolbar (classified in security software as BrowserModifier:Win32/InstallToolbar, Adware:Win32/InstallToolbar, and PUA:Win32/InstallToolbar) is a deceptive software installer bundler, adware delivery mechanism, and browser hijacker active across third-party download portals. Bundled into freeware and game installers, InstallToolbar modifies web browser preferences without explicit disclosure, altering the default search engine, start page, and new tab URLs in Google Chrome, Mozilla Firefox, and Internet Explorer. It injects sponsored affiliate links and banner advertisements into search results, routing search queries through monetization redirect networks. InstallToolbar registers persistent registry Run keys and background updater tasks to maintain its configuration across system reboots.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "BrowserModifier:Win32/InstallToolbar",
    "Adware:Win32/InstallToolbar",
    "PUA:Win32/InstallToolbar",
    "Win32/InstallToolbar",
    "InstallToolbar Bundler"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is BrowserModifier:Win32/InstallToolbar?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "InstallToolbar is an adware bundler and browser modifier that changes browser search settings to monetize web traffic."
      }
    },
    {
      "@type": "Question",
      "name": "How does InstallToolbar change web browser behavior?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It modifies browser homepage, search provider, and new tab URLs, redirecting queries through affiliate ad networks."
      }
    },
    {
      "@type": "Question",
      "name": "How does InstallToolbar get installed on victim computers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It is bundled with third-party software installers, free media utilities, and downloads from freeware aggregators."
      }
    },
    {
      "@type": "Question",
      "name": "Does InstallToolbar track user web browsing activity?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Yes, it collects search queries, visited URLs, and basic machine telemetry to deliver targeted advertisements."
      }
    },
    {
      "@type": "Question",
      "name": "How can InstallToolbar be completely removed?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Uninstall the utility via Windows Settings, reset browser search engines and homepages, and run a reputable antimalware scanner."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1176",
    "T1547.001",
    "T1082",
    "T1071.001",
    "T1217"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2011,
  "threat_actor": null,
  "delivery_mechanism": [
    "Bundled Software Installers",
    "Freeware Download Aggregators",
    "Deceptive Online Update Banners"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Browser Homepage & Default Search Hijacking",
    "Contextual Ad Injection & Sponsored Link Insertion",
    "Search Query & URL Tracking",
    "Autostart Registry Run Key Persistence",
    "Background Scheduled Task Registration"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "Browser Helper Object (BHO DLL)",
      "Browser Extension Package"
    ],
    "network_signatures": [
      "HTTP GET requests redirecting search traffic through monetization partner gateways",
      "Telemetry beacons reporting client installation identifiers and system locale"
    ],
    "evasion_techniques": [
      "Masquerading components as legitimate browser enhancement utilities",
      "Silently reinstalling browser modifications upon reboot via background services"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "5b6a708192a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7",
      "6a708192a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8"
    ],
    "registry_keys": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\InstallToolbarUpdater",
      "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\InstallToolbar"
    ],
    "file_paths": [
      "%ProgramFiles%\\InstallToolbar\\tb.exe",
      "%AppData%\\InstallToolbar\\helper.dll"
    ]
  },
  "defensive_measures": [
    "Enforce administrative policies restricting installation of unverified browser extensions and helper objects",
    "Enable Potentially Unwanted Application (PUA) blocking in Windows Defender Antivirus",
    "Educate users to uncheck bundled third-party offers during custom software installations"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - BrowserModifier:Win32/InstallToolbar",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=BrowserModifier:Win32/InstallToolbar"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - PUA.Win32.InstallToolbar",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "BrowserModifier:Win32/InstallToolbar.A",
      "Adware:Win32/InstallToolbar.B"
    ]
  },
  "attack_stage": [
    "initial_access",
    "execution",
    "persistence",
    "collection"
  ],
  "ecosystem": [
    "windows_pe",
    "browser_extension"
  ],
  "is_emerging": false,
  "motivation": "Advertising Revenue & Search Monetization",
  "sample_hashes": []
}