MergeDocsOnline is a software that usually installs without your knowledge with free software downloads. Identified the 08/14/2015.

Features:

– It belongs to a family of PUP (Potentially Unwanted Program).
– Vendor : PUP.Optional

Main actions :

– It installs a plugin of the browser Mozilla Firefox (P2)
– It is installed as a BHO (Browser Helper Object) of internet browser (O2),
– It installs as a process launched at startup of the system (RP),
– It settled in the Base of registers to be launched each time the system (O4).
– It installs as a service to be launched each time the system (O23),(SS/SR).
– It starts a task planned in automatic (O39),
– It installs as a program (O42),
– It creates to many registry keys ‘Software’
– It creates additional folders (O43),
– It moved to the Windows prefetcher folder (O45).
– It creates multiple files users (O61),
– It changes the Internet research provider (O69),

ZHPDiag report:

[MD5.07E013C666622AAE29A9AAE557D4E55E] – (.Mindspark – Mindspark Toolbar Platform.) — C:\Program Files\MergeDocsOnline_ew\bar\1.bin\ewbarsvc.exe[MD5.128E271ED32032A34FC93636E1A1D1D9] – (.Mindspark – Mindspark Toolbar Platform.) — C:\Program Files\MergeDocsOnline_ew\bar\1.bin\AppIntegrator.exe
P2 – EXT: (.Mindspark – MergeDocsOnline.) — C:\Users\Coolman\AppData\Roaming\Mozilla\Firefox\Profiles\w4lnh3vs.default-1436259410500\extensions\ewffxtbr@free.mergedocsonline.com
O2 – BHO: Search Assistant BHO – {00e2c623-e999-4b80-8ae1-f64f299f564c} . (.Mindspark – Mindspark Toolbar Platform.) — C:\Program Files\MergeDocsOnline_ew\bar\1.bin\ewSrcAs.dll
O2 – BHO: Toolbar BHO – {7954f122-e29b-41f3-b5c0-3c40a553cc37} . (.Mindspark – Mindspark Toolbar Platform.) — C:\Program Files\MergeDocsOnline_ew\bar\1.bin\ewbar.dll
O3 – Toolbar: 0xDBE7528AB487414A8BBA3D7459A92D3D – [HKCU]{8A52E7DB-87B4-4A41-8BBA-3D7459A92D3D} . (.Mindspark – Mindspark Toolbar Platform.) — C:\Program Files\MergeDocsOnline_ew\bar\1.bin\ewbar.dll
O4 – HKLM\..\Run: [MergeDocsOnline EPM Support] . (.Mindspark – Mindspark Toolbar Platform.) — C:\Program Files\MergeDocsOnline_ew\bar\1.bin\ewmedint.exe
O23 – Service: MergeDocsOnlineService (MergeDocsOnline_ewService) . (.Mindspark – Mindspark Toolbar Platform.) – C:\Program Files\MergeDocsOnline_ew\bar\1.bin\ewbarsvc.exe
O42 – Logiciel: MergeDocsOnline Internet Explorer Toolbar – (.Mindspark Interactive Network.) [HKLM] — MergeDocsOnline_ewbar Uninstall Internet Explorer
O43 – CFD: 2015/08/18 17:22:39 – [] D — C:\Program Files\MergeDocsOnline_ew
O43 – CFD: 2015/08/18 17:22:03 – [] D — C:\Users\Coolman\AppData\Local\MergeDocsOnline_ew
O61 – LFC: 2015/08/18 17:17:07 A . (..) — C:\Users\Coolman\AppData\Roaming\Mozilla\Firefox\Profiles\w4lnh3vs.default-1436259410500\extensions\ewffxtbr@free.mergedocsonline.com\plugins\NativeMessagingDispatcher.dll [478720] O69 – SBI: prefs.js [Coolman – u51nh3vt.default-2136249310511] user_pref(« extensions.toolbar.mindspark._ewMembers_.successUrl », « http://www.mergedocsonline.com/installComplete.jhtml »);
SR – Auto [2015/08/14 11:17:17] [ 89432] MergeDocsOnlineService (MergeDocsOnline_ewService) . (.Mindspark.) – C:\Program Files\MergeDocsOnline_ew\bar\1.bin\ewbarsvc.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00e2c623-e999-4b80-8ae1-f64f299f564c}
HKLM\Software\Classes\CLSID\{00e2c623-e999-4b80-8ae1-f64f299f564c}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{00e2c623-e999-4b80-8ae1-f64f299f564c}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{00e2c623-e999-4b80-8ae1-f64f299f564c}
HKLM64\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MergeDocsOnline_ewbar Uninstall Internet Explorer
HKLM\SYSTEM\CurrentControlSet\Services\MergeDocsOnline_ewService
HKLM\SOFTWARE\MergeDocsOnline_ew
HKCU\SOFTWARE\AppDataLow\Software\MergeDocsOnline_ew

Alias:

PUP.Optional.Mindspark.A [ Malwarebytes Antimalware ] Win32:Mindspark-A [Avast!]

Remove:

– Remove software in Windows Configuration Panel,
Remove with ZHPcleaner
ZHPCleaner_EN2
Diagnose with ZHPDiag
ZHPDiag_2-300x220

2016-12-30T07:34:23+00:00 Categories: Polluteware, PUP|Tags: , |Comments Off on PUP.Optional.MergeDocsOnline