Suspicious code there, see image attached.
Emsisoft reports this as Gen:Adware.MPlug.1 (B)

polonus