home

quizuloustoolbarsetup.exe

Quizulous Toolbar

Mindspark Interactive Network

This is the installer stub for the Mindspark (Quizulous/Ask) browser toolbar which provides the offer to the end user to install the toolbar and set the browser's search, home page and new tab to an Ask.com search destination. The application quizuloustoolbarsetup.exe by Mindspark Interactive Network has been detected as a potentially unwanted program by 12 anti-malware scanners. The program is a setup application that uses the Mindspark Custom Setup installer. This version of the installer will bundle a Mindspark/MyWebSearch Toolbar, a potentially unwanted web browser extension.
Publisher:
Quizulous  (signed by Mindspark Interactive Network)

Product:
Quizulous Toolbar

Version:
2, 0, 0, 9

MD5:
9c00895371452963b8899634c04e2d20

SHA-1:
56e7e76af35ebd76c6428f6dce5f2c596802a781

SHA-256:
db90c8cb774383c3ccde1a9b5d9e72ee44e50bd56dcefef705a92d4b59e0c7ee

Scanner detections:
12 / 68

Status:
Potentially unwanted

Explanation:
Bundles the Mindspark (MyWebSearch/Ask) toolbar, a web browser extension that will modify a user's search and home pages.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
1/13/2025 8:44:43 AM UTC  (today)

Scan engine
Detection
Engine version

Agnitum Outpost
Riskware.AdInstaller
7.1.1

Avira AntiVirus
TR/Agent.1172848.2
7.11.77.170

avast!
Win32:Malware-gen
2014.9-140824

Dr.Web
Adware.MyWay.64
9.0.1.0236

ESET NOD32
Win32/AdInstaller (variant)
8.8315

G Data
Win32:Malware-gen
14.8.22

IKARUS anti.virus
Trojan-Dropper.Agent
t3scan.2.0.0.0

MicroWorld eScan
Gen:Trojan.Heur.FU2.hr1@a01Ahqoi
15.0.0.708

NANO AntiVirus
Riskware.Win32.MyWay.ryqpj
0.24.0.52214

Norman
Suspicious_Gen5.BXRA
11.20140824

Reason Heuristics
PUP.Installer.MindsparkInteractiveNetwork.V
14.8.24.10

VIPRE Antivirus
MyWebSearch.J
17608

File size:
1.1 MB (1,172,848 bytes)

Product version:
2, 0, 0, 9

Copyright:
Copyright © 2009

Original file name:
q2Setup.exe

File type:
Executable application (Win32 EXE)

Bundler/Installer:
Mindspark Custom Setup

Language:
English (United States)

Common path:
C:\users\{user}\downloads\quizuloustoolbarsetup.exe

Digital Signature
Signed by:
Mindspark Interactive Network

Authority:
VeriSign, Inc.

Valid from:
5/6/2009 5:00:00 PM

Valid to:
5/7/2010 4:59:59 PM

Subject:
CN=Mindspark Interactive Network, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=Mindspark Interactive Network, L=White Plains, S=NewYork, C=US

Issuer:
CN=VeriSign Class 3 Code Signing 2004 CA, OU=Terms of use at https://www.verisign.com/rpa (c)04, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
0CB2B2261097404983B5ED92F342DE82

File PE Metadata
Compilation timestamp:
2/25/2010 4:50:45 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
12288:EpVVi7EYJmJIIzzT/TAaVjA4IZ9VPKLsAk0lybG/Rp/bkVmtcmm0:EpVVioImJzzz3AaVmZ9jVi/Rpzkrmm0

Entry address:
0x308A

Entry point:
55, 8B, EC, 83, EC, 44, 53, 56, 6A, 00, FF, 15, F4, 40, 40, 00, A3, 5C, 59, 40, 00, FF, 15, 84, 40, 40, 00, 8B, 1D, 80, 40, 40, 00, 8B, F0, 85, F6, 75, 04, 6A, FF, FF, D3, 8A, 06, 57, 8B, 3D, 5C, 41, 40, 00, 3C, 22, 75, 1B, 56, FF, D7, 8B, F0, 8A, 06, 3C, 22, 74, 04, 84, C0, 75, F1, 80, 3E, 22, 75, 15, 56, FF, D7, 8B, F0, EB, 0E, 3C, 20, 7E, 0A, 56, FF, D7, 8B, F0, 80, 3E, 20, 7F, F6, 8A, 06, 84, C0, 74, 04, 3C, 20, 7E, E1, 83, 65, E8, 00, 8D, 45, BC, 50, FF, 15, 7C, 40, 40, 00, E8, 2D, 00, 00, 00, F6, 45...
 
[+]

Entropy:
5.9198

Developed / compiled with:
Microsoft Visual C++

Code size:
12 KB (12,288 bytes)

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to www187.mindspark.com  (74.113.233.187:80)

TCP (HTTP):
Connects to anx.mindspark.com  (74.113.233.187:80)

Remove quizuloustoolbarsetup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.