39SRCHMN.EXE
Description: MindSpark Toolbar Platform SearchScope Monitor MindSpark MindSpark Toolbar Platform SearchScope Monitor 2, 3, 0, 0
MD5= CCA818A157A991CFD0B0D17C0C6D4ECD
File is signed and the signature was verified.
File size= 42536
Related registry changes:
HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{E1F80EB5-8AF4-410D-87C1-4F3E2776822A}\APPNAME: “39SRCHMN.EXE”
HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\MAPSGALAXY SEARCH SCOPE MONITOR: “”%PROGRAM FILES%\MAPSGA~2\BAR\1.BIN\39SRCHMN.EXE” /M=2 /W /H”

39BRMON.EXE
Description: VER_DESCRIPTION VER_COMPANY_NAME VER_PRODUCT_NAME 2,3,0,0
MD5= 35D6CAAA9E4D82974A74DBDB53801F98
File is signed and the signature was verified.
File size= 30096
Related registry changes:
HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\MAPSGALAXY_39 BROWSER PLUGIN LOADER: “%PROGRAM FILES%\MAPSGA~2\BAR\1.BIN\39BRMON.EXE“

FLASHUTIL10W_ACTIVEX.EXE
Description: Adobe® Flash® Player Installer/Uninstaller 10.3 r183 Adobe Systems, Inc. Flash® Player Installer/Uninstaller 10,3,183,7
MD5= BB646927C878EF8B966ED168D4C712AE
File is signed and the signature was verified.
File size= 243360
Related registry changes:
HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE\FLASHPLAYERUPDATE: “%SYSDIR%\MACROMED\FLASH\FLASHUTIL10W_ACTIVEX.EXE -UPDATE ACTIVEX”

39BAR.DLL
Description: MindSpark Toolbar Platform MindSpark MindSpark Toolbar Platform for Internet Explorer and Firefox 2, 5, 3, 20
MD5= 0087835A349C537E79583D41252915FB
File is signed and the signature was verified.
File size= 697744
Related registry changes:
HKLM\SOFTWARE\CLASSES\CLSID\{1E91A655-BB4B-4693-A05E-2EDEBC4C9D89}\INPROCSERVER32\: “%PROGRAM FILES%\MAPSGA~2\BAR\1.BIN\39BAR.DLL”
HKLM\SOFTWARE\CLASSES\CLSID\{364EA597-E728-4CE4-BB4A-ED846EF47970}\INPROCSERVER32\: “%PROGRAM FILES%\MAPSGALAXY_39\BAR\1.BIN\39BAR.DLL”
HKLM\SOFTWARE\CLASSES\CLSID\{4B7D0B0C-CFF3-49C5-9BC3-FFABC031C822}\INPROCSERVER32\: “%PROGRAM FILES%\MAPSGALAXY_39\BAR\1.BIN\39BAR.DLL”
HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\MAPSGALAXY_39BAR UNINSTALL\UNINSTALLSTRING: “RUNDLL32 %PROGRAM FILES%\MAPSGA~2\BAR\1.BIN\39BAR.DLL,O”
HKLM\SOFTWARE\MAPSGALAXY_39\BAR\UNINSTALLSTRING: “”%PROGRAM FILES%\MAPSGALAXY_39\BAR\1.BIN\39HIGHIN.EXE” 39BAR.DLL,O”

39SRCAS.DLL
Description: MindSpark Search Assistant MindSpark MindSpark Search Assistant for Internet Explorer 1, 2, 3, 5
MD5= CB31249537D2758F73046888AA02CA7A
File is signed and the signature was verified.
File size= 62864
Related registry changes:
HKLM\SOFTWARE\CLASSES\CLSID\{71C1D63A-C944-428A-A5BD-BA513190E5D2}\INPROCSERVER32\: “%PROGRAM FILES%\MAPSGALAXY_39\BAR\1.BIN\39SRCAS.DLL”
HKLM\SOFTWARE\MAPSGALAXY_39\BAR\SWITCHES\39SRCAS.DLL: “1”

39BARSVC.EXE
Description: Service MapsGalaxyService Start Type: loaded automatically by Server Manager PRODUCTVERS_TITLE COMPANYVERS_NAME PRODUCTVERS_NAME 2, 3, 0, 0
MD5= 622FCF264119F7DF127BE353F796B319
File is signed and the signature was verified.
File size= 42504
Related registry changes:
HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\MAPSGALAXY_39SERVICE\IMAGEPATH: “%PROGRAM FILES%\MAPSGA~2\BAR\1.BIN\39BARSVC.EXE“

GOOGLETOOLBARDYNAMIC_MUI_EN_60D6097707281E79.DLL/
Description: File is deleted or hidden by rootkit or could not be located.

%APPDATA%\MOZILLA\FIREFOX\PROFILES\7BLSFY3V.DEFAULT\EXTENSIONS\39FFXTBR@MAPSGALAXY_39.COM\CHROME\39FFXTBR.JAR
%APPDATA%\MOZILLA\FIREFOX\PROFILES\7BLSFY3V.DEFAULT\EXTENSIONS\39FFXTBR@MAPSGALAXY_39.COM\CHROME.MANIFEST
%APPDATA%\MOZILLA\FIREFOX\PROFILES\7BLSFY3V.DEFAULT\EXTENSIONS\39FFXTBR@MAPSGALAXY_39.COM\INSTALL.RDF
%APPDATA%\MOZILLA\FIREFOX\PROFILES\7BLSFY3V.DEFAULT\EXTENSIONS\39FFXTBR@MAPSGALAXY_39.COM\INSTALLKEYS.JS
%LOCAL APPDATA%\MICROSOFT\INTERNET EXPLORER\DOMSTORE\URCLIPSD\MAPS.GOOGLE[1].XML
%LOCAL APPDATA%\MICROSOFT\INTERNET EXPLORER\RECOVERY\LAST ACTIVE\{D19FAF50-B924-11E1-BBE7-000C2982064B}.DAT
%PROGRAM FILES%\MAPSGALAXY_39\BAR\1.BIN\39AUXSTB.DLL
%PROGRAM FILES%\MAPSGALAXY_39\BAR\1.BIN\39BAR.DLL
%PROGRAM FILES%\MAPSGALAXY_39\BAR\1.BIN\39BARSVC.EXE
%PROGRAM FILES%\MAPSGALAXY_39\BAR\1.BIN\39BRMON.EXE
%PROGRAM FILES%\MAPSGALAXY_39\BAR\1.BIN\39BRSTUB.DLL
%PROGRAM FILES%\MAPSGALAXY_39\BAR\1.BIN\39DATACT.DLL
%PROGRAM FILES%\MAPSGALAXY_39\BAR\1.BIN\39DLGHK.DLL
%PROGRAM FILES%\MAPSGALAXY_39\BAR\1.BIN\39DYN.DLL
%PROGRAM FILES%\MAPSGALAXY_39\BAR\1.BIN\39FEEDMG.DLL
%PROGRAM FILES%\MAPSGALAXY_39\BAR\1.BIN\39HIGHIN.EXE
%PROGRAM FILES%\MAPSGALAXY_39\BAR\1.BIN\39HKSTUB.DLL
%PROGRAM FILES%\MAPSGALAXY_39\BAR\1.BIN\39HTMLMU.DLL
%PROGRAM FILES%\MAPSGALAXY_39\BAR\1.BIN\39HTTPCT.DLL
%PROGRAM FILES%\MAPSGALAXY_39\BAR\1.BIN\39IDLE.DLL
%PROGRAM FILES%\MAPSGALAXY_39\BAR\1.BIN\39IEOVR.DLL
%PROGRAM FILES%\MAPSGALAXY_39\BAR\1.BIN\39IMPIPE.EXE
%PROGRAM FILES%\MAPSGALAXY_39\BAR\1.BIN\39MEDINT.EXE
%PROGRAM FILES%\MAPSGALAXY_39\BAR\1.BIN\39MLBTN.DLL
%PROGRAM FILES%\MAPSGALAXY_39\BAR\1.BIN\39MSG.DLL
%PROGRAM FILES%\MAPSGALAXY_39\BAR\1.BIN\39PLUGIN.DLL
%PROGRAM FILES%\MAPSGALAXY_39\BAR\1.BIN\39RADIO.DLL
%PROGRAM FILES%\MAPSGALAXY_39\BAR\1.BIN\39REGFFT.DLL
%PROGRAM FILES%\MAPSGALAXY_39\BAR\1.BIN\39REGHK.DLL
%PROGRAM FILES%\MAPSGALAXY_39\BAR\1.BIN\39REGIET.DLL
%PROGRAM FILES%\MAPSGALAXY_39\BAR\1.BIN\39SCRIPT.DLL
%PROGRAM FILES%\MAPSGALAXY_39\BAR\1.BIN\39SKIN.DLL
%PROGRAM FILES%\MAPSGALAXY_39\BAR\1.BIN\39SKNLCR.DLL
%PROGRAM FILES%\MAPSGALAXY_39\BAR\1.BIN\39SKPLAY.EXE
%PROGRAM FILES%\MAPSGALAXY_39\BAR\1.BIN\39SRCAS.DLL
%PROGRAM FILES%\MAPSGALAXY_39\BAR\1.BIN\39SRCHMN.EXE
%PROGRAM FILES%\MAPSGALAXY_39\BAR\1.BIN\39TPINST.DLL
%PROGRAM FILES%\MAPSGALAXY_39\BAR\1.BIN\39UABTN.DLL
%PROGRAM FILES%\MAPSGALAXY_39\BAR\1.BIN\CHROME\39FFXTBR.JAR
%PROGRAM FILES%\MAPSGALAXY_39\BAR\1.BIN\CHROME.MANIFEST
%PROGRAM FILES%\MAPSGALAXY_39\BAR\1.BIN\CREXT.DLL
%PROGRAM FILES%\MAPSGALAXY_39\BAR\1.BIN\CREXTP39.EXE
%PROGRAM FILES%\MAPSGALAXY_39\BAR\1.BIN\INSTALL.RDF
%PROGRAM FILES%\MAPSGALAXY_39\BAR\1.BIN\INSTALLKEYS.JS
%PROGRAM FILES%\MAPSGALAXY_39\BAR\1.BIN\LOGO.BMP
%PROGRAM FILES%\MAPSGALAXY_39\BAR\1.BIN\NP39STUB.DLL
%PROGRAM FILES%\MAPSGALAXY_39\BAR\1.BIN\T8EXTEX.DLL
%PROGRAM FILES%\MAPSGALAXY_39\BAR\1.BIN\T8EXTPEX.DLL
%PROGRAM FILES%\MAPSGALAXY_39\BAR\1.BIN\T8HTML.DLL
%PROGRAM FILES%\MAPSGALAXY_39\BAR\1.BIN\T8RES.DLL
%PROGRAM FILES%\MAPSGALAXY_39\BAR\1.BIN\T8TICKER.DLL
%PROGRAM FILES%\MAPSGALAXY_39\BAR\CACHE\0003253C
%PROGRAM FILES%\MAPSGALAXY_39\BAR\CACHE\00032905
%PROGRAM FILES%\MAPSGALAXY_39\BAR\CACHE\00032A8C.BMP
%PROGRAM FILES%\MAPSGALAXY_39\BAR\CACHE\00032ABA.BMP
%PROGRAM FILES%\MAPSGALAXY_39\BAR\CACHE\00032B18.BMP
%PROGRAM FILES%\MAPSGALAXY_39\BAR\CACHE\00032B57.BMP
%PROGRAM FILES%\MAPSGALAXY_39\BAR\CACHE\00032B86.BMP
%PROGRAM FILES%\MAPSGALAXY_39\BAR\CACHE\00032BC4.BMP
%PROGRAM FILES%\MAPSGALAXY_39\BAR\CACHE\00032BF3.BMP
%PROGRAM FILES%\MAPSGALAXY_39\BAR\CACHE\00032C22.BMP
%PROGRAM FILES%\MAPSGALAXY_39\BAR\CACHE\00032C60.BMP
%PROGRAM FILES%\MAPSGALAXY_39\BAR\CACHE\00032C8F.BMP
%PROGRAM FILES%\MAPSGALAXY_39\BAR\CACHE\00033DC5.JHTML
%PROGRAM FILES%\MAPSGALAXY_39\BAR\CACHE\000364D5
%PROGRAM FILES%\MAPSGALAXY_39\BAR\CACHE\0003786D.BMP
%PROGRAM FILES%\MAPSGALAXY_39\BAR\CACHE\FILES.INI
%PROGRAM FILES%\MAPSGALAXY_39\BAR\GEN1\COMMON.T8S
%PROGRAM FILES%\MAPSGALAXY_39\BAR\HISTORY\SEARCH3
%PROGRAM FILES%\MAPSGALAXY_39\BAR\IE9MESG\COMMON.T8S
%PROGRAM FILES%\MAPSGALAXY_39\BAR\MESSAGE\COMMON.T8S
%PROGRAM FILES%\MAPSGALAXY_39\BAR\SETTINGS\PREVCFG2.HTM
%PROGRAM FILES%\MAPSGALAXY_39\BAR\SETTINGS\SETTING3.HTM
%PROGRAM FILES%\MAPSGALAXY_39\BAR\SETTINGS\S_PID.DAT
%PROGRAM FILES%\MAPSGALAXY_39\BAR\SETTINGS\S_W1.DAT
%PROGRAM FILES%\MAPSGALAXY_39\BAR\SETTINGS\S_W2.DAT
%PROGRAM FILES%\MAPSGALAXY_39\MAPSGALAXY_39\CACHE\POPUPPROPERTIES202980343.HTML
%PROGRAM FILES%\MAPSGALAXY_39\MAPSGALAXY_39\CACHE\POPUPPROPERTIES202980364.HTML
%PROGRAM FILES%\MAPSGALAXY_39\MAPSGALAXY_39\CACHE\POPUPPROPERTIES202980406.HTML
%PROGRAM FILES%\MAPSGALAXY_39\MAPSGALAXY_39\CACHE\RADIO.HTML

%APPDATA%\MOZILLA\FIREFOX\PROFILES\7BLSFY3V.DEFAULT\EXTENSIONS.INI
%LOCAL APPDATA%\MICROSOFT\INTERNET EXPLORER\RECOVERY\LAST ACTIVE\{ED4A9D08-AFD1-11E1-BBE5-000C2982064B}.DAT

%APPDATA%\MACROMEDIA\FLASH PLAYER\MACROMEDIA.COM\SUPPORT\FLASHPLAYER\SYS\SETTINGS.SOL
%PROFILE%\IECOMPATCACHE\INDEX.DAT
%PROFILE%\IETLDCACHE\INDEX.DAT
%LOCAL APPDATA%\MICROSOFT\FEEDS\FEEDSSTORE.FEEDSDB-MS
%LOCAL APPDATA%\MICROSOFT\FEEDS\MICROSOFT FEEDS~\MICROSOFT AT HOME~.FEED-MS
%LOCAL APPDATA%\MICROSOFT\FEEDS\MICROSOFT FEEDS~\MICROSOFT AT WORK~.FEED-MS
%LOCAL APPDATA%\MICROSOFT\FEEDS\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\INTERNET EXPLORER SUGGESTED SITES~.FEED-MS
%LOCAL APPDATA%\MICROSOFT\FEEDS\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\WEBSLICES~\WEB SLICE GALLERY~.FEED-MS
%LOCAL APPDATA%\MICROSOFT\FEEDS CACHE\INDEX.DAT
%LOCAL APPDATA%\MICROSOFT\INTERNET EXPLORER\DOMSTORE\IG74HEML\WWW.GOOGLE[1].XML
%LOCAL APPDATA%\MICROSOFT\INTERNET EXPLORER\DOMSTORE\INDEX.DAT
%LOCAL APPDATA%\MICROSOFT\INTERNET EXPLORER\RECOVERY\LAST ACTIVE\RECOVERYSTORE.{EB98B106-AFD1-11E1-BBE5-000C2982064B}.DAT
%LOCAL APPDATA%\MICROSOFT\WINDOWS\USRCLASS.DAT
%TEMP%\CE4CF87733651BF1F44DD1E02FC1A8E8
%PROFILE%\PRIVACIE\INDEX.DAT
C:\DOCUMENTS AND SETTINGS\LOCALSERVICE\LOCAL SETTINGS\APPLICATION DATA\MICROSOFT\WINDOWS\USRCLASS.DAT
C:\DOCUMENTS AND SETTINGS\NETWORKSERVICE\LOCAL SETTINGS\APPLICATION DATA\MICROSOFT\WINDOWS\USRCLASS.DAT
%WinDir%\TASKS\USER_FEED_SYNCHRONIZATION-{600E3BA8-8EF5-4554-94FE-DB90950D3DEB}.JOB

%APPDATA%\MOZILLA\FIREFOX\PROFILES\7BLSFY3V.DEFAULT\EXTENSIONS
%APPDATA%\MOZILLA\FIREFOX\PROFILES\7BLSFY3V.DEFAULT\EXTENSIONS\39FFXTBR@MAPSGALAXY_39.COM
%APPDATA%\MOZILLA\FIREFOX\PROFILES\7BLSFY3V.DEFAULT\EXTENSIONS\39FFXTBR@MAPSGALAXY_39.COM\CHROME
%PROGRAM FILES%\MAPSGALAXY_39
%PROGRAM FILES%\MAPSGALAXY_39\BAR
%PROGRAM FILES%\MAPSGALAXY_39\BAR\1.BIN
%PROGRAM FILES%\MAPSGALAXY_39\BAR\1.BIN\CHROME
%PROGRAM FILES%\MAPSGALAXY_39\BAR\1.BIN\THIRDPARTYINSTALLERS
%PROGRAM FILES%\MAPSGALAXY_39\BAR\CACHE
%PROGRAM FILES%\MAPSGALAXY_39\BAR\GEN1
%PROGRAM FILES%\MAPSGALAXY_39\BAR\HISTORY
%PROGRAM FILES%\MAPSGALAXY_39\BAR\IE9MESG
%PROGRAM FILES%\MAPSGALAXY_39\BAR\MESSAGE
%PROGRAM FILES%\MAPSGALAXY_39\BAR\SETTINGS
%PROGRAM FILES%\MAPSGALAXY_39\MAPSGALAXY_39
%PROGRAM FILES%\MAPSGALAXY_39\MAPSGALAXY_39\CACHE