» FF-NativeMessagingDispatcher.dll
Overview
Analysis
File Details
Programs (1)

FF-NativeMessagingDispatcher.dll

Mindspark Toolbar Platform for Internet Explorer

Mindspark Interactive Network

This library is part of the Mindspark toolbar which uses the Ask.com search property to install a web browser extension and modify the browser's search, home and new tab features in order to redirect web searches to the IAC property. The module FF-NativeMessagingDispatcher.dll, “Mindspark Toolbar Platform” by Mindspark Interactive Network has been detected as a potentially unwanted program by 25 anti-malware scanners. This file is typically installed with the program PConverter Internet Explorer Toolbar by Mindspark Interactive Network which is a potentially unwanted software program.

File name:

Publisher:

Mindspark (signed by Mindspark Interactive Network)

Product:

Mindspark Toolbar Platform for Internet Explorer

Description:

Mindspark Toolbar Platform

Version:

1.0.7.262

MD5:

f2a3ad3b5ff6740b4a6385cb758d5904

SHA-1:

82dd4d9b6db554857b818832a3f8bbd519b7bc10

SHA-256:

1fef7cfa7ac85043cdb6b2bf9ccea4fe34a6407f492b8f709e2ae70a346d336f

Scanner detections:

25 / 68

Status:

Potentially unwanted

Explanation:

Part of the MyWebSearch/Mindspark/Ask web browser extension and toolbar.

Analysis date:

4/26/2024 5:35:14 PM UTC (today)

Scan engine

Detection

Engine version

Agnitum Outpost

PUA.Toolbar.MyWebSearch

7.1.1

Avira AntiVirus

PUA/MyWebSearch.U.14

8.3.2.2

avast!

Win32:GenMaliciousA-MGY [PUP]

2014.9-151127

AVG

Toolbar.MyWebSearch

2016.0.2913

Baidu Antivirus

PUA.Win32.MyWebSearch

4.0.3.151127

Bkav FE

W32.HfsAdware

1.3.0.7383

Clam AntiVirus

Win.Adware.Mywebsearch-151

0.98/21511

Comodo Security

Application.Win32.MyWebSearch.DBS

23608

Dr.Web

Adware.MyWebSearch.103

9.0.1.0331

ESET NOD32

Win32/Toolbar.MyWebSearch.AO potentially unwanted (variant)

9.12581

Fortinet FortiGate

Riskware/MyWebSearch

11/27/2015

F-Prot

W32/Mywebsearch.K.gen

v6.4.7.1.166

G Data

Win32.Application.Agent.OA7U2D

15.11.25

Kaspersky

not-a-virus:WebToolbar.Win32.MyWebSearch

14.0.0.1059

Malwarebytes

PUP.Optional.MindSpark

v2015.11.27.04

McAfee

Artemis!127E14A29BDA

5600.6569

NANO AntiVirus

Riskware.Win32.MySearch.dyncgm

0.30.26.4437

Qihoo 360 Security

Win32/Virus.WebToolbar.819

1.0.0.1077

Quick Heal

PUA.Webwatcher.OD9

11.15.14.00

Reason Heuristics

PUP.Mindspark.MindsparkInteractiveNetwork.Toolbar (M)

15.11.27.4

Rising Antivirus

PE:Malware.Generic/QRS!1.9E2D [F]

23.00.65.151125

SUPERAntiSpyware

PUP.MindSpark/Variant

9483

Vba32 AntiVirus

AdWare.MySearch

3.12.26.4

VIPRE Antivirus

MyWebSearch Toolbar (not malicious)

45258

Zillya! Antivirus

Adware.Toolbar.Win32.1550

2.0.0.2516

File size:

474.3 KB (485,712 bytes)

Product version:

2.5.15.30

Original file name:

FF-NativeMessagingDispatcher.dll

File type:

Dynamic link library (Win32 DLL)

Language:

English (United States)

Common path:

C:\Program Files\pconverter_dz\bar\1.bin\ff-nativemessagingdispatcher.dll

Digital Signature

Signed by:

Mindspark Interactive Network

Authority:

VeriSign, Inc.

Valid from:

4/19/2015 7:00:00 PM

Valid to:

6/18/2018 6:59:59 PM

Subject:

CN=Mindspark Interactive Network, O=Mindspark Interactive Network, L=Yonkers, S=New York, C=US

Issuer:

CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:

438D4291E43C2DFFEEAAAEE5B6C070B5

File PE Metadata

Compilation timestamp:

8/4/2015 12:15:05 PM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

10.0

CTPH (ssdeep):

12288:kUSrJFMI7J37VZISEH7B/vfutrscmz/U9g2miyzc9dc:9SrJFf7J37nPEH7Bfu1xwCe

Entry address:

0x250BF

Entry point:

8B, FF, 55, 8B, EC, 83, 7D, 0C, 01, 75, 05, E8, 17, 54, 00, 00, FF, 75, 08, 8B, 4D, 10, 8B, 55, 0C, E8, EC, FE, FF, FF, 59, 5D, C2, 0C, 00, 8B, FF, 55, 8B, EC, 8B, 45, 08, 66, 8B, 08, 83, C0, 02, 66, 85, C9, 75, F5, 2B, 45, 08, D1, F8, 48, 5D, C3, 8B, FF, 55, 8B, EC, 5D, E9, 79, 54, 00, 00, 8B, FF, 55, 8B, EC, 8D, 45, 14, 50, 6A, 00, FF, 75, 10, FF, 75, 0C, FF, 75, 08, E8, A3, 31, 00, 00, 83, C4, 14, 5D, C3, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, 55, 8B, EC, 57, 56, 8B, 75, 0C, 8B, 4D, 10, 8B, 7D, 08, 8B... 
[+]

Entropy:

6.4339

Code size:

269 KB (275,456 bytes)

The file FF-NativeMessagingDispatcher.dll has been discovered within the following program.

PConverter Internet Explorer Toolbar by Mindspark Interactive Network

Publisher's description - “If you are still seeing Ask.com (or mywebsearch.com) after uninstalling our toolbar, it is likely that your browser's homepage has not yet been reset back to its previous setting.”

support.mindspark.com

66% remove it

Remove FF-NativeMessagingDispatcher.dll - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.