Adware.1ClickDownload

The detection of Adware.1ClickDownload on your system indicates the presence of a potentially unwanted program that could be compromising your online security and privacy. This type of software is designed to display unwanted advertisements, collect user data, and potentially lead to more severe security issues if not addressed promptly. Understanding the nature of this adware and how it operates is crucial for effective removal and prevention of future infections.

What Is Adware.1ClickDownload?

Adware.1ClickDownload is categorized as adware, a type of software that displays unwanted advertisements on a user's device. These advertisements can appear in various forms, including pop-ups, banners, and sponsored content within web pages. The primary goal of adware is to generate revenue for its developers by forcing users to view or interact with these advertisements. While not typically considered as malicious as viruses or Trojans, adware can significantly degrade the user experience, slow down system performance, and potentially expose users to more dangerous malware.

How Adware.1ClickDownload Operates

Adware.1ClickDownload, like other adware programs, operates by infiltrating a user's system, often through bundled software downloads, deceptive links, or exploits in software vulnerabilities. Once installed, it can modify browser settings, install additional software, or create scheduled tasks to ensure its persistence. The adware communicates with its command and control servers to receive updates, report user activity, and download new advertisements. This communication can lead to the collection of user data, including browsing history, search queries, and other sensitive information, which can be used for targeted advertising or sold to third parties.

Symptoms of Infection

Symptoms of an Adware.1ClickDownload infection can vary but commonly include an increase in unwanted advertisements appearing on web pages, new tabs opening with advertising content, and changes in browser home pages or search engines without user consent. Users may also notice a decrease in system performance, as adware can consume system resources to display advertisements and communicate with its servers. In some cases, the adware may prevent users from changing certain browser settings or uninstalling associated programs, further complicating its removal.

How to Remove Adware.1ClickDownload

1. Enter Safe Mode with Networking to limit the adware's ability to interfere with the removal process. This mode allows you to use the internet to download removal tools while disabling most startup programs.
2. Perform a full scan of your system using a reputable anti-malware tool, such as SpyHunter. Ensure the tool is updated to the latest version to improve detection and removal capabilities.
3. Uninstall suspicious programs that were installed around the time the adware symptoms appeared. Be cautious and only remove programs you do not recognize or no longer need.
4. Reset your web browsers (Chrome, Firefox, Edge, etc.) to their default settings. This step will remove changes made by the adware, such as altered home pages, search engines, and the removal of unwanted extensions.
5. After completing the above steps, reboot your system and perform another scan with your anti-malware tool to ensure all components of the adware have been removed.

Conclusion

Removing Adware.1ClickDownload requires a systematic approach to ensure all its components are eliminated from your system. By following the steps outlined above and maintaining good computing practices, such as regularly updating software, avoiding suspicious downloads, and using reputable security software, you can protect your system from similar threats in the future. Remember, prevention is key, and vigilance is crucial in the ever-evolving landscape of cybersecurity threats.

Analysis Report

General information

Family Name:	Adware.1ClickDownload
Signature status:	Root Not Trusted

Known Samples

i

Known Samples

This section lists other file samples believed to be associated with this family.

MD5: e18a14e71601cfbf01f12ca267720d37 SHA1: c3468afc2a3aa0502d0d9c067eed718e20eff427 SHA256: 9CC4E7D9E5AD3E4D6A7A0D92904D77DCC6F3FBF0979E3F7E672867C621FB4DC2 File Size: 60.32 KB, 60316 bytes

MD5: e4e03ec172f99726b7fcbf01a1e6aa0a SHA1: 84a6bd8211e822ab5f9c588ba572215478518b27 SHA256: E0C645664F7378D3E8242666562DF926DCC99CA9C47F49954D3153D0AF9843E6 File Size: 390.62 KB, 390624 bytes

MD5: 2b557ae9cbda1e6ea5fabc3109ea2696 SHA1: cac0563285c80bd44126bdee5eb4d4c1933eeb22 SHA256: 56EBEB94A3A49ABDCBD8F6A546BC0DB6427C3A2EABE79071402106EBF3733430 File Size: 263.49 KB, 263488 bytes

MD5: 46b1618da865bcc20362fa517e633ba6 SHA1: 91d968cd26db5ed9143902bf21eed284995854a0 SHA256: 345E6DBB48555960BC9ED4D8B6981375753F791EE3200F45F75D600C32F7EE5A File Size: 279.12 KB, 279120 bytes

MD5: b758884eb2acbf556f6b4129ce7c8a90 SHA1: 1845b395eea5bc314c051c553897e0e17e473bcb SHA256: 738CAAEAFCBF57FEAF8417A900F395ECC28BACC8BD9A24B30AA4EA7FFB66D028 File Size: 277.54 KB, 277544 bytes

Show More

MD5: e38382a57ff2ad1f54241f6b8804019b SHA1: 819f34dfa8341f878bebcd6db670dc563cf7cc68 SHA256: 058A79A9618F1552473798C42A8B099961A56455CB7BA45788FCCC2C8C8F9247 File Size: 318.61 KB, 318608 bytes

MD5: 645ee6cfeb4fd94889ba724f7ab8ec3c SHA1: 7f58d218f0fc60ee20bbef8900da5b3de0b7f6dd SHA256: 82F317293F23BE2A591BB25029A027C6ECA04C9B3079792EA499729877D27E85 File Size: 195.03 KB, 195032 bytes

MD5: 9f6e89d5ad4650ac927344830c173e9a SHA1: 6df0179956aef3d58268399d7d968316ba25f2ab SHA256: 2BFA5ACA0F0A338D50E2A1763177F1A3CB08CD472DC81E0C04FBBC4575455E7E File Size: 229.22 KB, 229224 bytes

MD5: 4b11bd1465b086c0ed6e956f55373001 SHA1: edce35f761ca844e94d744133f8de6732cd04198 SHA256: FB92EDFECECF03BF9924D87E65C0CEE8E8CBABCA6121440DFA67B077E8EBE05F File Size: 464.84 KB, 464840 bytes

MD5: 8a970f62f393f4d2ef0bcf47d92ed335 SHA1: df6d31a4a6d004d4b1220b63064c91ccb622d562 SHA256: 9FC982F45FAE3D47D83B236258FAAC425A309FB425DE5A8AEA4F4F8C1190D658 File Size: 207.13 KB, 207128 bytes

MD5: 5f39f6d3cea7cd35130714c274588df1 SHA1: 684b4d732b020905351a2f9a720612f9128319cf SHA256: 35DB5FE69EC5C2DE3AFB2EEE178B9635D8869442A19E8DCE8A773AEF8E2A503C File Size: 284.81 KB, 284808 bytes

Windows Portable Executable Attributes

i

Windows Portable Executable Attributes

This section lists file attributes found within family samples. These attributes are extracted from the files’ Windows PE (Portable Executable) specification and various system flags. Portable Executable Attributes give malware researchers insight into a file’s functionality, executable details, platform and runtime environment.

• File doesn't have "Rich" header
• File doesn't have debug information
• File doesn't have exports table
• File doesn't have relocations information
• File doesn't have security information
• File is 32-bit executable
• File is either console or GUI application
• File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
• File is Native application (NOT .NET application)
• File is not packed

Show More

• IMAGE_FILE_DLL is not set inside PE header (Executable)
• IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Icons

i

File Icons

This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.

Digital Signatures

i

Digital Signatures

This section lists digital signatures that are attached to samples within this family. When analyzing and verifying digital signatures, it is important to confirm that the signature’s root authority is a well-known and trustworthy entity and that the status of the signature is good. Malware is often signed with non-trustworthy “Self Signed” digital signatures (which can be easily created by a malware author with no verification). Malware may also be signed by legitimate signatures that have an invalid status, and by signatures from questionable root authorities with fake or misleading “Signer” names.

Signer	Root	Status
Downloadnow Ltd	Thawte Code Signing CA - G2	Self Signed
Kanchana Khiandee	Thawte Code Signing CA - G2	Self Signed
Tanja Matkovic	Thawte Code Signing CA - G2	Self Signed
Terra Firma Internet Consulting LTD	Thawte Code Signing CA - G2	Self Signed
Cool Mirage ltd.	UTN-USERFirst-Object	Root Not Trusted

Files Modified

i

Files Modified

This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.

File	Attributes
c:\program files (x86)\1clickdownload\adobe_photoshop_cs5_[ita].torrent.gz	Generic Write,Read Attributes
c:\program files (x86)\1clickdownload\gzip.exe	Generic Write,Read Attributes
c:\program files (x86)\1clickdownload\mainpacklt.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsabbd4.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete
c:\users\user\appdata\local\temp\nsaf718.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete
c:\users\user\appdata\local\temp\nse47c4.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete
c:\users\user\appdata\local\temp\nse7f5c.tmp\1clogo.bmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nse7f5c.tmp\accept.bmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nse7f5c.tmp\accept1.bmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nse7f5c.tmp\accept2.bmp	Generic Write,Read Attributes

Show More

c:\users\user\appdata\local\temp\nse7f5c.tmp\accept3.bmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nse7f5c.tmp\anon.bmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nse7f5c.tmp\decline.bmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nse7f5c.tmp\gc0	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nse7f5c.tmp\getcountry	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nse7f5c.tmp\inetc3.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nse7f5c.tmp\nsdialogs.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nse7f5c.tmp\nsisdl.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nse7f5c.tmp\save.bmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nse7f5c.tmp\skip.bmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nse7f5c.tmp\system.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsff738.tmp\system.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsga3bf.tmp\bd.htm	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsga3bf.tmp\gdate	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsga3bf.tmp\inetc3.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsga3bf.tmp\system.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsgb123.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete
c:\users\user\appdata\local\temp\nshe431.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete
c:\users\user\appdata\local\temp\nsibf28.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete
c:\users\user\appdata\local\temp\nslb134.tmp\bd.htm	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nslb134.tmp\system.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsme451.tmp\load_4.bmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsme451.tmp\system.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsna95b.tmp\bd.htm	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsna95b.tmp\inetc3.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsna95b.tmp\system.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsp52ef.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete
c:\users\user\appdata\local\temp\nsqa3ae.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete
c:\users\user\appdata\local\temp\nsqbbe5.tmp\avg.htm	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsqbbe5.tmp\load_0.bmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsqbbe5.tmp\system.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsu530f.tmp\bd.htm	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsu530f.tmp\system.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsybf39.tmp\bd.htm	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsybf39.tmp\system.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsz47f4.tmp\load_0.bmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsz47f4.tmp\system.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\~nsu.tmp\au_.exe	Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 262144

Registry Modifications

i

Registry Modifications

This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.

Key::Value	Data	API Name
HKLM\system\controlset001\control\session manager::pendingfilerenameoperations	\??\C:\Users\Pakvivyw\AppData\Local\Temp\~nsu.tmp\Au_.exe	RegNtPreCreateKey
HKLM\system\controlset001\control\session manager::pendingfilerenameoperations	\??\C:\Users\Pakvivyw\AppData\Local\Temp\~nsu.tmp\Au_.exe\??\C:\Users\Pakvivyw\AppData\Local\Temp\~nsu.tmp	RegNtPreCreateKey
HKLM\software\classes\appid\{c007dadd-132a-624c-088e-59ee6cf0711f}::id0	 %	RegNtPreCreateKey
HKCU\software\1clickdownload::uid	319481074	RegNtPreCreateKey
HKCU\software\1clickdownload::lastinstall0	1 P2	RegNtPreCreateKey
HKCU\software\1clickdownload::lastinstall0	1""!	RegNtPreCreateKey
HKCU\software\1clickdownload::lastinstall0	1"sf	RegNtPreCreateKey
HKCU\software\1clickdownload::lastinstall0	1"�	RegNtPreCreateKey
HKLM\software\classes\appid\{c007dadd-132a-624c-088e-59ee6cf0711f}::id0	 &	RegNtPreCreateKey
HKCU\software\1clickdownload::lastinstall0	1$#	RegNtPreCreateKey

Show More

HKCU\software\1clickdownload::lastinstall0	1$'�	RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::proxybypass		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::intranetname		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::uncasintranet		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::autodetect		RegNtPreCreateKey
HKLM\software\classes\appid\{c007dadd-132a-624c-088e-59ee6cf0711f}::id0	" &	RegNtPreCreateKey
HKLM\software\classes\appid\{c007dadd-132a-624c-088e-59ee6cf0711f}::id0	 &	RegNtPreCreateKey
HKCU\software\1clickdownload::lastinstall0	1'4�	RegNtPreCreateKey

Windows API Usage

i

Windows API Usage

This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.

Category	API
Process Shell Execute	CreateProcess
Network Wininet	HttpOpenRequest HttpQueryInfo HttpSendRequest InternetConnect InternetOpen InternetQueryOption InternetReadFile
Network Winsock2	WSAStartup
Network Winsock	closesocket gethostbyname inet_addr socket

Shell Command Execution

i

Shell Command Execution

This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.

"C:\Users\Pakvivyw\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=c:\users\user\downloads\

gzip.exe -d -q "Adobe_Photoshop_CS5_[ITA].torrent.gz"