ADW_EASYDOWN

This adware may be manually installed by a user.

Arrival Details

This adware may be manually installed by a user.

Installation

This adware drops the following non-malicious files:

• %System Root%\Documents and Settings\All Users\Desktop\Click-n-Load Quick Start.lnk
• %System Root%\Documents and Settings\All Users\Desktop\EasyDownloads.lnk
• %System Root%\Documents and Settings\All Users\Start Menu\EasyDownloads\Click-n-Load Quick Start.lnk
• %System Root%\Documents and Settings\All Users\Start Menu\EasyDownloads\EasyDownloads.lnk
• %System Root%\Documents and Settings\All Users\Start Menu\EasyDownloads\Uninstall.lnk
• %Program Files%\Easy Downloads\click-n-load_ico.ico
• %Program Files%\Easy Downloads\current-cloud.html
• %Program Files%\Easy Downloads\easydl.exe
• %Program Files%\Easy Downloads\easydownloads.exe
• %Program Files%\Easy Downloads\gotourl.url
• %Program Files%\Easy Downloads\htmlayout.dll
• %Program Files%\Easy Downloads\uninstall.exe
• %User Temp\htmlayout.dll

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.. %Program Files% is the default Program Files folder, usually C:\Program Files.)

It creates the following folders:

• %System Root%\Documents and Settings\All Users\Start Menu\EasyDownloads
• %Program Files%\Easy Downloads

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.. %Program Files% is the default Program Files folder, usually C:\Program Files.)

Autostart Technique

This adware adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
EasyDownloads = "%Program Files%\Easy Downloads\easydownloads.exe" -tray

Other System Modifications

This adware adds the following registry entries as part of its installation routine:

HKEY_CLASSES_ROOT\Magnet\DefaultIcon
@ = "%Program Files%\Easy Downloads\easydownloads.exe",0

HKEY_CLASSES_ROOT\Magnet\shell
@ = open

HKEY_CLASSES_ROOT\Magnet\shell\
open\command
@ = "%Program Files%\Easy Downloads\easydownloads.exe" "%1"

HKEY_CLASSES_ROOT\Magnets
@ = Magnets URI

HKEY_CLASSES_ROOT\Magnets
Content Type = application/x-magnets

HKEY_CLASSES_ROOT\Magnets\DefaultIcon
@ = "%Program Files%\Easy Downloads\easydownloads.exe",0

HKEY_CLASSES_ROOT\Magnets\shell
@ = open

HKEY_CLASSES_ROOT\Magnets\shell\
open\command
@ = "%Program Files%\Easy Downloads\easydownloads.exe" "%1"

HKEY_CURRENT_USER\Software\EasyDownloads
version = tr74adv5

HKEY_CURRENT_USER\Software\EasyDownloads
userid = {user ID}

HKEY_CURRENT_USER\Software\EasyDownloads
date = {encoded value}

HKEY_CURRENT_USER\Software\EasyDownloads
installdate = {hex values}

HKEY_CURRENT_USER\Software\EasyDownloads
SoftID = {SID}

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\ProtocolExecute\magnet
WarnOnOpen dword:00000000 = 0

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\ProtocolExecute\magnets
WarnOnOpen = 0

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
EasyDownloads
DisplayName = EasyDownloads - fastest downloads in two clicks!

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
EasyDownloads
UninstallString = "%Program Files%\Easy Downloads\uninstall.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
EasyDownloads
DisplayIcon = %Program Files%\Easy Downloads\easydownloads.exe

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
EasyDownloads
Publisher = http://izloader.com/

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
EasyDownloads
InstallLocation = %Program Files%\Easy Downloads

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
EasyDownloads
URLInfoAbout = http://izloader.com/

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
EasyDownloads
DisplayVersion = 1.0.0.1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\
List
%Program Files%\Easy Downloads\easydownloads.exe = %Program Files%\Easy Downloads\easydownloads.exe:*:Enabled:EasyDownloads

HKEY_CLASSES_ROOT\Magnet
@ = Magnet URI

HKEY_CLASSES_ROOT\Magnet
Content Type = application/x-magnet

HKEY_CLASSES_ROOT\Magnet
URL = Protocol

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\
List
%Program Files%\Easy Downloads\easydl.exe = %Program Files%\Easy Downloads\easydl.exe:*:Enabled:EasyDownloadsDL

It adds the following registry keys as part of its installation routine:

HKEY_CLASSES_ROOT\Magnets\DefaultIcon

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
EasyDownloads

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\ProtocolExecute\magnet

HKEY_CLASSES_ROOT\Magnets\shell

HKEY_CLASSES_ROOT\Magnet\shell

HKEY_CLASSES_ROOT\Magnet

HKEY_CLASSES_ROOT\Magnets

HKEY_CLASSES_ROOT\Magnet\DefaultIcon

HKEY_CLASSES_ROOT\Magnets\shell\
open

HKEY_CLASSES_ROOT\Magnets\shell\
open\command

HKEY_CURRENT_USER\Software\EasyDownloads

HKEY_LOCAL_MACHINE\SOFTWARE\EasyDownloads

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\ProtocolExecute\magnets

NOTES:
It is a download manager software that is configured to download a file named "La signora in giallo" from the following torrent site:

• http://{BLOCKED}tz.eu/

As of writing, it fails to download the said file. It connects to the following sites:

• http://{BLOCKED}n-load.com/software/ - software download site
• http://www.{BLOCKED}r.com/ - torrent site

It may also install a bundled browser toolbar software.