Your essential free software toolbox

SHARE
THIS ON

Adware.Bundler.Funwebproducts.M

LOW

aprox. 4M

(Funwebproducts)

Symptoms

Internet explorer will have a toolbar containing following buttons : “Fun Buddy”,” Smiley central”,”Screensaver”,”Cursor mania” and “fun cards”. A search bar may also be installed.

Removal instructions:

Please let BitDefender disinfect your files.

Analyzed By

Dragos Gavrilut, virus researcher

Technical Description:

Adware.Bundler.Funwebproducts consists in several programs (used to configure some aspect of your computer such as icons, cursor, and screensaver) and a toolbar. It also installs a search bar (MySearch) for internet explorer. This adware is located on:

http://funwebproducts.com/ { removed }

When Adware.Bundler.Funwebproducts is installed, it performs the following actions:

a) Creates the following directories (and subdirectories)

Ø C:\Program Files\FunWebProducts

Ø C:\Program Files\MyWebSearchWB\bar

b) Create the following registry keys

Ø HKEY_CLASSES_ROOT\FunWebProducts.DataControl.1

Ø HKEY_CLASSES_ROOT\FunWebProducts.DataControl

Ø HKEY_CLASSES_ROOT\FunWebProducts.HistoryKillerScheduler.1

Ø HKEY_CLASSES_ROOT\FunWebProducts.HistoryKillerScheduler

Ø HKEY_CLASSES_ROOT\FunWebProducts.HistorySwatterControlBar.1

Ø HKEY_CLASSES_ROOT\FunWebProducts.HistorySwatterControlBar

Ø HKEY_CLASSES_ROOT\FunWebProducts.HTMLMenu.1

Ø HKEY_CLASSES_ROOT\FunWebProducts.HTMLMenu

Ø HKEY_CLASSES_ROOT\FunWebProducts.HTMLMenu.2

Ø HKEY_CLASSES_ROOT\FunWebProducts.IECookiesManager.1

Ø HKEY_CLASSES_ROOT\FunWebProducts.IECookiesManager

Ø HKEY_CLASSES_ROOT\FunWebProducts.KillerObjManager.1

Ø HKEY_CLASSES_ROOT\FunWebProducts.KillerObjManager

Ø HKEY_CLASSES_ROOT\FunWebProducts.PopSwatterBarButton.1

Ø HKEY_CLASSES_ROOT\FunWebProducts.PopSwatterBarButton

Ø HKEY_CLASSES_ROOT\FunWebProducts.PopSwatterSettingsControl.1

Ø HKEY_CLASSES_ROOT\FunWebProducts.PopSwatterSettingsControl

Ø HKEY_CLASSES_ROOT\FunWebProducts.ShellViewControl.1

Ø HKEY_CLASSES_ROOT\FunWebProducts.ShellViewControl

Ø HKEY_CLASSES_ROOT\MyWebSearch.HTMLPanel.1

Ø HKEY_CLASSES_ROOT\MyWebSearch.HTMLPanel

Ø HKEY_CLASSES_ROOT\MyWebSearch.OutlookAddin.1

Ø HKEY_CLASSES_ROOT\MyWebSearch.OutlookAddin

Ø HKEY_CLASSES_ROOT\MyWebSearch.PseudoTransparentPlugin.1

Ø HKEY_CLASSES_ROOT\MyWebSearch.PseudoTransparentPlugin

Ø HKEY_CLASSES_ROOT\MyWebSearchToolBar.SettingsPlugin.1

Ø HKEY_CLASSES_ROOT\MyWebSearchToolBar.SettingsPlugin

Ø HKEY_CLASSES_ROOT\MyWebSearchToolBar.ToolbarPlugin.1

Ø HKEY_CLASSES_ROOT\MyWebSearchToolBar.ToolbarPlugin

Ø HKEY_CLASSES_ROOT\ScreenSaverControl.ScreenSaverInstaller.1

Ø HKEY_CLASSES_ROOT\ScreenSaverControl.ScreenSaverInstaller

Ø HKEY_LOCAL_MACHINE\SOFTWARE\Fun Web Products

Ø HKEY_LOCAL_MACHINE\SOFTWARE\FunWebProducts

Ø HKEY_LOCAL_MACHINE\SOFTWARE\MyWebSearch

c) Adds following value for HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run [Name = MyWebSearch Email Plugin]
[Value = C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe]
witch will run mywebserarch plug-in automatically on windows starts.

d) %PROGRAMFILES%/mywebsearch\bar\1.bin\mwsbar.dll and
%PROGRAMFILES%/mywebsearch\srchastt\1.bin\mwssrcas.dll are register as BHO for internet explorer

%PROGRAMFILES%\mywebsearch\srchastt\1.bin\mwssrcas.dll is register as Url Search Hooks for Internet Explorer