Home / malware PUA:Win32/DownloadGuide
First posted on 07 July 2016.
Source: MicrosoftAliases :
There are no other names known for PUA:Win32/DownloadGuide.
Explanation :
Installation
This application can be downloaded from websites that offer third-party software downloads. For example, we have seen it downloaded from:
- d4.computerbild.de
- d5.computerbild.de
- d3.computerbild.de
- dl.cdn.chip.de
- files.downloadnow.com
We have seen this application use the following file names:
- download_audiograbber.exe
- FreeYouTubeToMP3Converter_CB-DL-Manager.exe
- agsetup183se_v3.0.0.67.exe
- FreeYouTubeDownload_CB-DL-Manager.exe
- deluge+bittorrent+client_1.0.exe
- FreeAudioConverter_CB-DL-Manager.exe
- download-audiograbber.exe
- ccsetup518_slim_CB-DL-Manager.exe
- jetzt_installieren.exe
It can be digitally signed by the following vendors:
- COMPUTER BILD Digital GmbH
- Free-mium GmbH
- Covus Freemium GmbH
- Freemium GmbH
- Cyberservices B.V.
We have seen this application using product names such as:
- DownloadGuide2 Installer
- Software
- Freemium System Utilities
- Decrypter
This application communicates with domains such as:
- dlg-messages.buzzrin.de
- dlg-configs.buzzrin.de
- az687722.vo.msecnd.net
- d.computerbild.de
- dlg-factory.buzzrin.de
For example:
- dlg-messages.buzzrin.de/1/dg/3
- dlg-configs.buzzrin.de/
- dlg-configs.buzzrin.de/config-from-production
Payload
Exhibits suspicious behaviors
We have observed this application exhibit the following potentially unwanted behavior on PCs:
- Installs extensions into your browsers - often this is used to inject ads, add toolbars, or change how your browser works
Installs other programs
We have seen this application install other software on your PC. Some of these applications might be bundled during the installation process and not intended to be installed. We have seen it installing programs such as:
- Web Companion
- 7-PDF Printer 10.22.0.2525
- Advanced SystemCare 9
- CCleaner
This description was published using automated analysis.Last update 07 July 2016
