Astrology Internet Explorer Toolbar

• 4abar.dll is installed in Internet Explorer as a BHO (Browser Helper Object) under the name 'Toolbar BHO' with the class of {d36bfff8-a3ae-4032-a179-f29083c68ba7}.
• 4aSrcAs.dll is installed in Internet Explorer as a BHO (Browser Helper Object) under the name 'SoccerInferno' with the class of {73b8e1fd-331f-4c17-8613-8a3034d3b0ca}.

• 4abar.dll is loaded as Internet Explorer Toolbar with the name 'Daily Fitness Center' with the class of {a6547405-a964-4600-8326-e91c95218964}.

• 4aSrcAs.dll is loaded in Internet Explorer as a URL search hook using the CLSID {792d1703-9131-4929-9b08-57eca435f68b} and is used by IE to redirect the address of an unknown typed URLs.

• 4abar.dll installs an IE Web Browser in Internet Explorer named 'PuzzleGamesDaily' with a class of {C3E49807-F612-45DB-AEF6-B0F5B68FAE27}.

• NP4aStub.dll is loaded into Mozilla Firefox under the product name '@Astrology_4a.com/Plugin' with a plugin key of '@Astrology_4a.com/Plugin' for all users of the PC.
• 4abar.dll is loaded into Mozilla Firefox under the product name 'McAfee Total Protection' with a plugin key of '@mcafee.com/MSC,version=10' for all users of the PC.

• AppIntegrator64.exe is scheduled as a task named 'Price Fountain' (runs daily at 4:45 PM).

• AppIntegrator64.exe is automatically launched at startup through a scheduled task named 7.
• 4aSrchMn.exe is automatically launched at startup through a scheduled task named 3.
• 4amedint.exe is automatically launched at startup through a scheduled task named 2.

• 4abarsvc.exe runs as a service named 'GardeningEnthusiastService' (GardeningEnthusiast_7jService).

• 4amedint.exe is loaded in the current user (HKCU) registry as an auto-starting executable named 'MapsGalaxy EPM Support' and executes as "C:\Program Files2\MAPSGA~2\bar\1.bin\39medint.exe" T8EPMSUP.DLL,S.
• 4aSrchMn.exe is loaded in the current user (HKCU) registry as an auto-starting executable named 'Hoolapp Android' and executes as "C:\users\user\appdata\Roaming\HOOLAP~1\Hoolapp.exe" /Minimized.

• AppIntegrator64.exe is loaded in the all users (HKLM) registry as a startup file name 'FromDocToPDF Search Scope Monitor' which loads as "C:\Program Files2\FROMDO~2\bar\1.bin\65srchmn.exe" /m=2 /w /h.
• 4abar.dll is loaded in the all users (HKLM) registry as a startup file name 'VideoDownloadConverter' which loads as rundll32 C:\Program Files1\VIDEOD~2\bar\1.bin\4zbar.dll,S.
• 4amedint.exe is loaded in the all users (HKLM) registry as a startup file name 'SafePCRepair Home Page Guard 32 bit' which loads as "C:\Program Files1\SAFEPC~1\bar\1.bin\AppIntegrator.exe".
• 4aSrchMn.exe is loaded in the all users (HKLM) registry as a startup file name 'YourLocalLotto Toolbar EPM Support' which loads as "C:\Program Files2\YOURLO~2\bar\1.bin\20medint.exe" T8EPMSUP.DLL,S.
• 4abarsvc.exe is loaded in the all users (HKLM) registry as a startup file name 'Motitags AppIntegrator 64-bit' which loads as C:\Program Files2\MOTITA~2\bar\1.bin\AppIntegrator64.exe.
• APPINTEGRATOR.EXE is loaded in the all users (HKLM) registry as a startup file name 'GardeningEnthusiast AppIntegrator 32-bit' which loads as C:\Program Files2\GARDEN~2\bar\1.bin\AppIntegrator.exe.

• 4aSrchMn.exe is loaded once in the all users (HKLM) registry as a startup file name 'YTBChrInst' which loads as C:\users\user\appdata\Local\Temp\1391325400\ChromeHelperProc.exe.

Comments

Error posting comment.

'Your comment has been posted to the moderator, it should be approved shortly. Thank you for commenting!'

Pick a name