Malware & Windows Process Library

The program pup.crossrider is the CrossRider adware that serves unsolicited advertising content and causes the redirection of the Web browser to unwanted sites. It installs without consent when the user downloads freeware and software bundles from certain download sites. It creates new files in the Windows Registry, modifies the custom settings of the browser, and serves annoying popups that disrupt browsing. Its activities cause the slowing down of the Internet connection and degrade the performance of the PC.

The program worm.autorun is a file infector that replicates by infecting host files that spreads the infection to other files when it is executed. It creates an autorun.inf file in the root folder of infected drives and propagates by spreading the infection through removable drives and shared network drives. It exhibits backdoor behavior that enables a remote attacker to access the PC in order to download other malware such as password stealing Trojans.

The program pup.bundle is an adware and potentially unwanted program that serves unsolicited advertising content and redirects the Web browser to unknown or malicious sites. It installs without consent when downloading freeware and software bundles from certain download sites. It is a pre-checked option in the installation package that the user may not have noticed and remained unchecked. It disrupts browsing by serving advertising popups and banners and affects the quality of searches due to the redirection of the browser to its affiliated sites.

The program trojan.reveton belongs to a family of ransomware trojans that locks the desktop and makes payment demands to the user. It installs through visits to hacked and malicious websites, and loads a DLL (dynamic link library) file that is used to lock the screen and serve the ransom message. The ransom message alleges that the user engaged in illegal activities and must pay a fine before the system can be unlocked. The user is instructed to contact a premium number to arrange for the ransom payment.

The program trojan.alureon is a data-stealing trojan with rootkit functionalities that targets the Master Boot Record (MBR) for infection to elude detection and removal. It listens to network communications and intercepts traffic to steal usernames and passwords that relate to banking and financial transactions, which it sends to a remote server. It performs other functionalities such as the redirection of the Web browser to pay-per-click advertising sites and to sites that host rogue antivirus software to generate revenues for its author.

The program trojan.medfos belongs to the Win32/Medfos family of Trojan downloaders that installs on the PC through distribution channels like peer-to-peer (P2P) networks, the Internet Relay Chat (IRC), and spam email. It downloads malware from malicious sites by hijacking the Web browser and redirecting searches to sites that host exploits and other security threats, including advertising websites that employ pay-per-click techniques. It also downloads and installs arbitrary files to the PC when commanded by its author.

The program trojan.delf belongs to a family of backdoor Trojans that steals confidential information from the computer and transmits it to a remote server. It distributes through peer-to-peer networks and visits to malicious sites that host exploits, and through the action of trojan droppers. It intercepts and listens to network communications in order to collect usernames, passwords, browsing history, other information that may be required by its author. It is known to install arbitrary files when commanded by its author.

The program adware.downware is a component of custom installers for software bundles that exhibit both spyware and adware functionalities. It installs without seeking consent because it is a pre-checked option in the installation package for the software bundle. Once installed, it communicates with a remote server and tracks the browsing activities in order to serve advertising content that matches search queries. It puts the system at risk from malware introduction due to the redirection of the Web browser to suspicious sites that are known to host malware.

The program pup.ibryte is an adware that displays advertising content in the newsfeeds and news stories that it continuously displays in its homepage. It installs without consent when the user downloads freeware to which it is bundled. It installs as a plugin to the Web browser and automatically changes the homepage to its Web page that continuously displays the advertising feeds. It is considered a security risk because of its association with malicious sites.

The program trojan.startpage is an adware that automatically changes the homepage settings of the Web browser without consent in order to facilitate the display of advertising popups and banners. It is installed by trojan droppers and loads as a plugin to the Internet Explorer, which enables it to launch together with the browser. It hijacks the Web browser and redirects searches to malicious sites in order to facilitate the installation of malware on the computer.

The program trojan.clicker is a browser helper object (BHO) that secretly launches the Web browser to visit advertising sites to increase traffic and generate revenues for its author. It is distributed through spam email and infected files from P2P networks, and loads as an extension of the Web browser. It resides in the system memory and manages to secretly launch the browser to visit the pay-per-click advertising sites that are specified by its author.

The program trojan.zaccess belongs to a family of rootkit trojans with combined adware and remote access functionalities. It installs through spam email, security exploits, and downloads of cracked software. It replaces a system driver with its own rootkit driver to hide its presence and elude detection while performing its functions of delivering advertising popups and banners. It redirects the Web browser to certain advertising sites and is known to download other malware into the computer.

The program trojan.happili is an adware and browser hijacker that redirects searches to the site called Happili.com, which is an online shopping site that provides online shoppers with purchase options based on comparative costs. This variant of the Google Redirect Virus changes the search results to force the user to visit its affiliated sites, some of which are suspicious and known to host malware. It installs through social engineering techniques and the downloading of shareware programs. It serves numerous advertising popups that are disruptive and cause the slowing down of the PC.

The program adware.bprotector is a component of custom installers for software bundles that is responsible for displaying unwanted advertising popups and banners. It installs without consent as part of the software installation package. This potentially unwanted software has spyware components that track and record browsing activities. It is known to cause the redirection of the Web browser to sites that offer certain products and services, and to websites that employ pay-per-click advertising.

The program trojan.fakeav is an adware program that displays security alerts based on fraudulent system scan results to induce the user to purchase a subscription for a rogue antivirus program. It installs through spam email, freeware downloads, and visits to malicious sites. Once installed, it loads during the system startup and blocks the antivirus program from running. It serves the popup notifications periodically to scare the user into buying the rogue antivirus software. 

The program trojan.lameshield belongs to a family of remote administration trojans with a keylogging component that steals confidential information from the computer, which it sends to a remote server. It is introduced in the PC by trojan droppers and through the blackhole exploit kit, and spreads by infecting computers that are remotely connected to the compromised host. It blocks the antivirus program from running and maintains communications with a command and control server to wait for instructions from its author.

The program pup.adbundle is an adware and potentially unwanted software that installs in the computer when the user downloads software bundles from certain sites. It usually installs without consent because it is a pre-checked option in the installation of the software bundle. Once installed, its spyware component tracks and records browsing activities, which it sends to a remote server. It causes the display of numerous advertising banners and popups, and redirects the Web browser to unknown sites that may harbor malware exploits.