Plugin369 is an adware toolbar program of Chinese origin.  The earliest recorded appearance of this program is on a message board for Mozilla Taiwan, with a post dated June 19, 2006.  Several other people on the message board reported infections within a month’s time.  Their reported symptoms were that when they booted their computers, Mozilla Firefox would automatically be redirected to http://open.369ip.com/union2.htm.

Plugin369 not only targets Mozilla Firefox, but also Microsoft Internet Explorer.  The form of attack on Internet Explorer is different, though.  It redirects the browser, but it also adds a toolbar, or more accurately, an advertising frame insert at the upper part of the Internet Explorer window.

If you are infected with Plugin369, it is highly recommended that you remove it.  SpyZooka is well-known to be able to kill Plugin369.

Also Known As:

{F52A94F5-A3CC-40DA-BCD7-222282E01406}, Adware.Plugin, Win-Adware/Plugin369.53248

Associated Files:

%SYSTEM%369.dll,
HKCRCLSID{F52A94F5-A3CC-40DA-BCD7-222282E01406}
HKCRInterface{081EDFB7-9A89-4671-8766-AFA97A1A160F}
HKCRPlugin369.369
HKCRPlugin369.369.1
HKCRTypeLib{713FB071-2148-4F3C-830B-4C5279393ADE}
HKLMSOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{F52A94F5-A3CC-40DA-BCD7-222282E01406}