ThreatExpert Report: not-a-virus:WebToolbar.Win32.MyWebSearch.rh

Submission Summary:

Submission details:

Submission received: 22 October 2012, 19:30:38
Processing time: 8 min 52 sec
Submitted sample:

File MD5: 0x9EFC52A55C5AD56715E454E8CFF9706C
File SHA-1: 0x6F7FFEABA7484FE5CD8178597A30597D131BD9D6
Filesize: 212,216 bytes
Alias: not-a-virus:WebToolbar.Win32.MyWebSearch.rh [Kaspersky Lab]

Summary of the findings:

What's been found	Severity Level
Registers a 32-bit in-process server DLL.

Technical Details:

File System Modifications

The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%ProgramFiles%\MyFunCards_5mEI\Installr\1.bin\5mEIPlug.dll	56,560 bytes	MD5: 0x635D54DDB01D03E85279362EB0AA2427 SHA-1: 0x2D9FB0B7E49719C662F38E903E0AC20B0D1076AC	(not available)
2	%ProgramFiles%\MyFunCards_5mEI\Installr\1.bin\5mEZSETP.dll	232,688 bytes	MD5: 0xEA94909AE7FF09410C4BCD292D48B3BB SHA-1: 0x3FCCEDA89AEF4C5AF971926B022D9B3CA3C2C892	(not available)
3	%ProgramFiles%\MyFunCards_5mEI\Installr\1.bin\NP5mEISb.dll	31,992 bytes	MD5: 0x5006AF4640D2C849776944CFB5698CEF SHA-1: 0x6C69B83D176BFA42CD851AC0B4E3E29B468025A9	not-a-virus:WebToolbar.Win32.MyWebSearch.rh [Kaspersky Lab]
4	[file and pathname of the sample #1]	212,216 bytes	MD5: 0x9EFC52A55C5AD56715E454E8CFF9706C SHA-1: 0x6F7FFEABA7484FE5CD8178597A30597D131BD9D6	not-a-virus:WebToolbar.Win32.MyWebSearch.rh [Kaspersky Lab]

Note:

%ProgramFiles% is a variable that refers to the Program Files folder. A typical path is C:\Program Files.

The following directories were created:

%ProgramFiles%\MyFunCards_5mEI
%ProgramFiles%\MyFunCards_5mEI\Installr
%ProgramFiles%\MyFunCards_5mEI\Installr\1.bin

Memory Modifications

There was a new process created in the system:

Process Name	Process Filename	Main Module Size
[filename of the sample #1]	[file and pathname of the sample #1]	204,800 bytes

Registry Modifications

The following Registry Keys were created:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b88fdfa6-b3df-4a5f-acba-3d5d97930eee}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b88fdfa6-b3df-4a5f-acba-3d5d97930eee}\Control
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b88fdfa6-b3df-4a5f-acba-3d5d97930eee}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b88fdfa6-b3df-4a5f-acba-3d5d97930eee}\MiscStatus
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b88fdfa6-b3df-4a5f-acba-3d5d97930eee}\MiscStatus\1
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b88fdfa6-b3df-4a5f-acba-3d5d97930eee}\ProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b88fdfa6-b3df-4a5f-acba-3d5d97930eee}\Programmable
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b88fdfa6-b3df-4a5f-acba-3d5d97930eee}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b88fdfa6-b3df-4a5f-acba-3d5d97930eee}\Version
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b88fdfa6-b3df-4a5f-acba-3d5d97930eee}\VersionIndependentProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{63BA5725-11DF-4DC5-B846-D7F858B0652E}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{63BA5725-11DF-4DC5-B846-D7F858B0652E}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{63BA5725-11DF-4DC5-B846-D7F858B0652E}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{63BA5725-11DF-4DC5-B846-D7F858B0652E}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{75362E17-8E61-4A05-A8A2-04F585CABD79}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{75362E17-8E61-4A05-A8A2-04F585CABD79}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{75362E17-8E61-4A05-A8A2-04F585CABD79}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{75362E17-8E61-4A05-A8A2-04F585CABD79}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{63631BB2-E20C-49C6-8781-2FCE85DBD773}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{63631BB2-E20C-49C6-8781-2FCE85DBD773}\1.0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{63631BB2-E20C-49C6-8781-2FCE85DBD773}\1.0\0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{63631BB2-E20C-49C6-8781-2FCE85DBD773}\1.0\0\win32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{63631BB2-E20C-49C6-8781-2FCE85DBD773}\1.0\FLAGS
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{63631BB2-E20C-49C6-8781-2FCE85DBD773}\1.0\HELPDIR
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyFunCards_5mInstaller.Start
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyFunCards_5mInstaller.Start\CLSID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyFunCards_5mInstaller.Start\CurVer
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyFunCards_5mInstaller.Start.1
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyFunCards_5mInstaller.Start.1\CLSID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{b88fdfa6-b3df-4a5f-acba-3d5d97930eee}
HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins
HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@ei.MyFunCards_5m.com/Plugin
HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@ei.MyFunCards_5m.com/Plugin\MimeTypes
HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@ei.MyFunCards_5m.com/Plugin\MimeTypes\application/x-myfuncards_5mpluginei
HKEY_LOCAL_MACHINE\SOFTWARE\MyFunCards_5mEI
HKEY_LOCAL_MACHINE\SOFTWARE\MyFunCards_5mEI\Installer

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b88fdfa6-b3df-4a5f-acba-3d5d97930eee}\MiscStatus\1]

(Default) = "131473"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b88fdfa6-b3df-4a5f-acba-3d5d97930eee}\VersionIndependentProgID]

(Default) = "MyFunCards_5mInstaller.Start"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b88fdfa6-b3df-4a5f-acba-3d5d97930eee}\Version]

(Default) = "1.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b88fdfa6-b3df-4a5f-acba-3d5d97930eee}\TypeLib]

(Default) = "{63631bb2-e20c-49c6-8781-2fce85dbd773}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b88fdfa6-b3df-4a5f-acba-3d5d97930eee}\ProgID]

(Default) = "MyFunCards_5mInstaller.Start.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b88fdfa6-b3df-4a5f-acba-3d5d97930eee}\MiscStatus]

(Default) = "0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b88fdfa6-b3df-4a5f-acba-3d5d97930eee}\InprocServer32]

(Default) = "%ProgramFiles%\MyFunCards_5mEI\Installr\1.bin\5mEZSETP.dll"
ThreadingModel = "Apartment"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b88fdfa6-b3df-4a5f-acba-3d5d97930eee}]

(Default) = ""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{63BA5725-11DF-4DC5-B846-D7F858B0652E}\TypeLib]

(Default) = "{63631BB2-E20C-49C6-8781-2FCE85DBD773}"
Version = "1.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{63BA5725-11DF-4DC5-B846-D7F858B0652E}\ProxyStubClsid32]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{63BA5725-11DF-4DC5-B846-D7F858B0652E}\ProxyStubClsid]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{63BA5725-11DF-4DC5-B846-D7F858B0652E}]

(Default) = "It8InstallerStart"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{75362E17-8E61-4A05-A8A2-04F585CABD79}\TypeLib]

(Default) = "{63631BB2-E20C-49C6-8781-2FCE85DBD773}"
Version = "1.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{75362E17-8E61-4A05-A8A2-04F585CABD79}\ProxyStubClsid32]

(Default) = "{00020420-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{75362E17-8E61-4A05-A8A2-04F585CABD79}\ProxyStubClsid]

(Default) = "{00020420-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{75362E17-8E61-4A05-A8A2-04F585CABD79}]

(Default) = "_It8InstallerStartEvents"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{63631BB2-E20C-49C6-8781-2FCE85DBD773}\1.0\0\win32]

(Default) = "%ProgramFiles%\MyFunCards_5mEI\Installr\1.bin\5mEZSETP.dll\1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{63631BB2-E20C-49C6-8781-2FCE85DBD773}\1.0\HELPDIR]

(Default) = "%ProgramFiles%\MyFunCards_5mEI\Installr\1.bin\5mEZSETP.dll\"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{63631BB2-E20C-49C6-8781-2FCE85DBD773}\1.0\FLAGS]

(Default) = "0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{63631BB2-E20C-49C6-8781-2FCE85DBD773}\1.0]

(Default) = "Installer 1.0 Type Library"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyFunCards_5mInstaller.Start\CurVer]

(Default) = "MyFunCards_5mInstaller.Start.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyFunCards_5mInstaller.Start\CLSID]

(Default) = "{b88fdfa6-b3df-4a5f-acba-3d5d97930eee}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyFunCards_5mInstaller.Start]

(Default) = ""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyFunCards_5mInstaller.Start.1\CLSID]

(Default) = "{b88fdfa6-b3df-4a5f-acba-3d5d97930eee}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyFunCards_5mInstaller.Start.1]

(Default) = ""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{b88fdfa6-b3df-4a5f-acba-3d5d97930eee}]

(Default) = ""

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@ei.MyFunCards_5m.com/Plugin\MimeTypes\application/x-myfuncards_5mpluginei]

Description = "MyFunCards Plugin"
Suffixes = "5mi"

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@ei.MyFunCards_5m.com/Plugin]

Description = "MyFunCards Plugin"
Path = "%ProgramFiles%\MyFunCards_5mEI\Installr\1.bin\NP5mEISB.dll"
vendor = "FULL%CompanyName%_DDE0BB24-8F8C-44e9-B962-8289B302DEF9"
version = "1.1.0.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\MyFunCards_5mEI\Installer]

un = "MyFunCards"
Dir = "%ProgramFiles%\MyFunCards_5mEI\Installr\"
PluginPath = "%ProgramFiles%\MyFunCards_5mEI\Installr\1.bin\"
CurInstall = "1"
sr = "0"
pl = "9"

Other details

To mark the presence in the system, the following Mutex object was created:

MyFunCards_5mEI:Installer:Shared02042949646950

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.

The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.