CursorMania Internet Explorer Toolbar

• NP7lStub.dll is loaded in the Google Chrome web browser as 'NP7lStub.dll'.

• 7lSrcAs.dll is installed in Internet Explorer as a BHO (Browser Helper Object) under the name 'ConservativeTalkNow' with the class of {af77c74d-a46e-4671-afa0-1a09b1d4be39}.
• 7lbar.dll is installed in Internet Explorer as a BHO (Browser Helper Object) under the name 'Toolbar BHO' with the class of {e5af9d32-01d7-47b8-9eb6-87d9afce744f}.

• 7lbar.dll is installed as an Internet Explorer extension using the class {92780B25-18CC-41C8-B9BE-3C9C571A8263}.

• 7lbar.dll is loaded as Internet Explorer Toolbar with the name 'ConservativeTalkNow' with the class of {533329c9-ca91-42a2-8792-7f91c7b4172a}.

• 7lSrcAs.dll is loaded in Internet Explorer as a URL search hook using the CLSID {752929fc-c897-4620-9fa8-0303247277e2} and is used by IE to redirect the address of an unknown typed URLs.

• 7lbar.dll installs an IE Web Browser in Internet Explorer named 'ConservativeTalkNow' with a class of {533329C9-CA91-42A2-8792-7F91C7B4172A}.

• 7lbar.dll is loaded into Mozilla Firefox under the product name 'McAfee Total Protection' with a plugin key of '@mcafee.com/MSC,version=10' for all users of the PC.
• NP7lStub.dll is loaded into Mozilla Firefox under the product name '@CursorMania_7l.com/Plugin' with a plugin key of '@CursorMania_7l.com/Plugin' for all users of the PC.

• AppIntegrator64.exe is scheduled as a task named 'Price Fountain' (runs daily at 4:45 PM).
• 7lmedint.exe is scheduled as a task with the class '{CEC2F177-6434-48CF-AEA5-AB1F3AD5E60A}' (runs on registration).
• 7lSrchMn.exe is scheduled as a task named 'MetaCrawler' (runs daily at 15:24).

• AppIntegrator64.exe is automatically launched at startup through a scheduled task named 7.
• 7lSrchMn.exe is automatically launched at startup through a scheduled task named 3.
• 7lmedint.exe is automatically launched at startup through a scheduled task named 2.
• 7lbrmon64.exe is automatically launched at startup through a scheduled task named 5.
• 7lbrmon.exe is automatically launched at startup through a scheduled task named 4.

• 7lbarsvc.exe runs as a service named 'ConservativeTalkNowService' (ConservativeTalkNow_4nService).

• 7lbrmon.exe is loaded in the current user (HKCU) registry as an auto-starting executable named 'ctfmon.exe' and executes as C:\Program Files3\rundll32.exe C:\Program Files3\lni28.dat,FG00.
• 7lSrchMn.exe is loaded in the current user (HKCU) registry as an auto-starting executable named 'Hoolapp Android' and executes as "C:\users\user\appdata\Roaming\HOOLAP~1\Hoolapp.exe" /Minimized.

• AppIntegrator64.exe is loaded in the all users (HKLM) registry as a startup file name 'FromDocToPDF Search Scope Monitor' which loads as "C:\Program Files2\FROMDO~2\bar\1.bin\65srchmn.exe" /m=2 /w /h.
• 7lbrmon.exe is loaded in the all users (HKLM) registry as a startup file name 'MyFunCards AppIntegrator 64-bit' which loads as C:\Program Files2\MYFUNC~2\bar\2.bin\AppIntegrator64.exe.
• 7lmedint.exe is loaded in the all users (HKLM) registry as a startup file name 'Utility Chest EPM Support' which loads as "C:\Program Files1\UTILIT~2\bar\1.bin\49medint.exe" T8EPMSUP.DLL,S.
• 7lbrmon64.exe is loaded in the all users (HKLM) registry as a startup file name 'MapsGalaxy Search Scope Monitor' which loads as "C:\Program Files2\MAPSGA~2\bar\2.bin\39srchmn.exe" /m=2 /w /h.
• 7lSrchMn.exe is loaded in the all users (HKLM) registry as a startup file name 'ConservativeTalkNow Search Scope Monitor' which loads as "C:\Program Files2\CONSER~2\bar\1.bin\4nsrchmn.exe" /m=2 /w /h.
• APPINTEGRATOR.EXE is loaded in the all users (HKLM) registry as a startup file name 'AutoPCBackup Search Scope Monitor' which loads as "C:\Program Files1\AUTOPC~1\bar\2.bin\cxsrchmn.exe" /m=2 /w /h.
Plus 2 more

• 7lbrmon.exe is loaded once in the all users (HKLM) registry as a startup file name 'ConnecitfyTemp c' which loads as cmd /Q /C "rmdir /S /Q C:\users\user\appdata\Local\Temp\Connectify\c".
• 7lSrchMn.exe is loaded once in the all users (HKLM) registry as a startup file name 'YTBChrInst' which loads as C:\users\user\appdata\Local\Temp\1391325400\ChromeHelperProc.exe.

Comments

Error posting comment.

'Your comment has been posted to the moderator, it should be approved shortly. Thank you for commenting!'

Pick a name