MyFunCards Internet Explorer Toolbar

• NP5mStub.dll is loaded in the Google Chrome web browser as 'NP5mStub.dll'.

• 5mSrcAs.dll is installed in Internet Explorer as a BHO (Browser Helper Object) under the name 'Search Assistant BHO' with the class of {c4b22c87-45ef-4f43-89f2-40db2078864e}.
• 5mbar.dll is installed in Internet Explorer as a BHO (Browser Helper Object) under the name 'Toolbar BHO' with the class of {da71fd14-5f7b-46ae-b8b1-44074a38f331}.

• 5mbar.dll is installed as an Internet Explorer extension using the class {92780B25-18CC-41C8-B9BE-3C9C571A8263}.

• 5mbar.dll is loaded as Internet Explorer Toolbar with the name 'MyFunCards' with the class of {210f1b36-3b7f-41a4-b5da-3eb87f5a56c2}.

• 5mSrcAs.dll is loaded in Internet Explorer as a URL search hook using the CLSID {f4c28532-b9d0-4950-a2df-e83f9929242b} and is used by IE to redirect the address of an unknown typed URLs.
• 5mbar.dll loads into IE as a URL Search Hook named 'McAfee SiteAdvisor Toolbar' with a class of {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} in order to redirect unknown URL searches.

• 5mbar.dll installs an IE Web Browser in Internet Explorer named 'MyFunCards' with a class of {210F1B36-3B7F-41A4-B5DA-3EB87F5A56C2}.

• NP5mStub.dll is loaded into Mozilla Firefox under the product name '@MyFunCards_5m.com/Plugin' with a plugin key of '@MyFunCards_5m.com/Plugin' for all users of the PC.
• 5mbar.dll is loaded into Mozilla Firefox under the product name 'McAfee Total Protection' with a plugin key of '@mcafee.com/MSC,version=10' for all users of the PC.

• AppIntegrator64.exe is scheduled as a task named 'Price Fountain' (runs daily at 4:45 PM).
• 5mmedint.exe is scheduled as a task with the class '{CEC2F177-6434-48CF-AEA5-AB1F3AD5E60A}' (runs on registration).
• 5mSrchMn.exe is scheduled as a task named 'MetaCrawler' (runs daily at 15:24).

• AppIntegrator64.exe is automatically launched at startup through a scheduled task named 7.
• 5mSrchMn.exe is automatically launched at startup through a scheduled task named 3.
• 5mmedint.exe is automatically launched at startup through a scheduled task named 2.
• APPINTEGRATOR.EXE is automatically launched at startup through a scheduled task named OnlineMapFinder AppIntegrator 32-bit_Reg_HKLMWow6432Run.

• 5mbarsvc.exe runs as a service named 'InboxNowService' (InboxNow_drService).

• 5mmedint.exe is loaded in the current user (HKCU) registry as an auto-starting executable named 'MapsGalaxy EPM Support' and executes as "C:\Program Files2\MAPSGA~2\bar\1.bin\39medint.exe" T8EPMSUP.DLL,S.
• APPINTEGRATOR.EXE is loaded in the current user (HKCU) registry as an auto-starting executable named 'PowerSuite' and executes as "C:\Program Files1\Uniblue\POWERS~1\launcher.exe" delay 20000 -m.
• AppIntegrator64.exe is loaded in the current user (HKCU) registry as an auto-starting executable named 'Hoolapp Android' and executes as "C:\users\user\appdata\Roaming\HOOLAP~1\Hoolapp.exe" /Minimized.
• 5mSrchMn.exe is loaded in the current user (HKCU) registry as an auto-starting executable named 'Hoolapp Android' and executes as "C:\users\user\appdata\Roaming\HOOLAP~1\Hoolapp.exe" /Minimized.

• AppIntegrator64.exe is loaded in the all users (HKLM) registry as a startup file name 'FromDocToPDF Search Scope Monitor' which loads as "C:\Program Files2\FROMDO~2\bar\1.bin\65srchmn.exe" /m=2 /w /h.
• 5mbar.dll is loaded in the all users (HKLM) registry as a startup file name 'VideoDownloadConverter' which loads as rundll32 C:\Program Files1\VIDEOD~2\bar\1.bin\4zbar.dll,S.
• 5mmedint.exe is loaded in the all users (HKLM) registry as a startup file name 'MyFunCards EPM Support' which loads as "C:\Program Files2\MYFUNC~1\bar\1.bin\5mmedint.exe" t8EPMSup.dll,S.
• APPINTEGRATOR.EXE is loaded in the all users (HKLM) registry as a startup file name 'DailyRecipeGuide AppIntegrator 32-bit' which loads as C:\Program Files2\DAILYR~2\bar\1.bin\AppIntegrator.exe.
• 5mSrchMn.exe is loaded in the all users (HKLM) registry as a startup file name 'ConservativeTalkNow Search Scope Monitor' which loads as "C:\Program Files2\CONSER~2\bar\1.bin\4nsrchmn.exe" /m=2 /w /h.
• 5mbarsvc.exe is loaded in the all users (HKLM) registry as a startup file name 'SuddenlyMusic AppIntegrator 64-bit' which loads as C:\Program Files2\SUDDEN~2\bar\1.bin\AppIntegrator64.exe.

• 5mSrchMn.exe is loaded once in the all users (HKLM) registry as a startup file name 'YTBChrInst' which loads as C:\users\user\appdata\Local\Temp\1391325400\ChromeHelperProc.exe.

Comments

Error posting comment.

'Your comment has been posted to the moderator, it should be approved shortly. Thank you for commenting!'

Pick a name