Content

Adware-Littlehelper

Type
Program
SubType
Adware
Discovery Date
12/22/2005
Minimum DAT
4656 (12/22/2005)
Updated DAT
4823 (08/07/2006)
Minimum Engine
5.1.00
Description Added
12/22/2005
Description Modified
03/11/2006 5:30 PM (PT)

Tab Navigation

Characteristics

McAfee(R) AVERT recognizes that this program may have legitimate uses in contexts where an authorized administrator has knowingly installed this application. If you agreed to a license agreement for this, or another bundled application, you may have legal obligations with regard to removing this software, or using the host application without this software. Please contact the software vendor for further information.

See http://vil.nai.com/vil/DATReadme.asp for a list of Program detections added to the DATs.

See http://vil.nai.com/vil/pups/configuration.htm for information about how to enable, disable, and exclude detection of legitimately installed programs.

Distribution

This is not a virus or a trojan. It is a direct-marketing adware application that generates pop-up advertisements. Upon installation a registry Run key and Start Menu Startup shortcut are created to ensure the software is loaded at each system startup. The program runs silently in the background and periodically opens new browser windows to popup advertisements. Advertisements are located via redirects received from clkde.tradedoubler.com. Additionally, the software sets the browser homepage to http://www.de.ag/

An example of a popup advertisement generated by the software:

A license agreement is displayed when the software is installed. No information appears to be available on the website contacted during installation (www.little-download.net)

Privacy

A privacy policy is also displayed during installation (see screenshot above). No information on privacy appears on the little-download.net website. No transmission of browsing or other personal data was observed during analysis.

System Changes

General defaults for typical path variables (although they may be different, they usually are not):
%WinDir% = \WINDOWS (Windows 9x/ME/XP), \WINNT (Windows NT/2000)
%SystemDir% = \WINDOWS\SYSTEM32 (Windows 9x/ME/XP), \WINNT\SYSTEM32 (Windows NT/2000)
%ProgramFiles% = \Program Files

"*" - Denotes files that, though installed along with the software, are by themselves innocent and not included in detection.

Files Added

  • Installer: musik-download.exe (308 KB)
    MD5: A1C1F3701079A210BDD55126EF2ECB5B
  • %ProgramFiles%\little_helper2\uninstall.exe.lnk (1 KB)
  • %ProgramFiles%\little_helper2\unins000.exe (655 KB)
    MD5: 21B7A1CB7E7ABD4EB39AFDA9EDA825C5
  • %ProgramFiles%\little_helper2\unins000.dat (70 KB)
  • %ProgramFiles%\little_helper2\stop.exe (20 KB)
    MD5: 886E50C03434E99EE1D61D38254F7D47
  • %ProgramFiles%\little_helper2\stop.bat (1 KB)
  • %ProgramFiles%\little_helper2\startseite.exe (28 KB)
    MD5: E41C1BE01A5E1AE35308882482FD58EA
  • %ProgramFiles%\little_helper2\little_helper2.exe (56 KB)
    MD5: A4A1055B7D1B5E90B03A8C54308B7BAE
  • %ProgramFiles%\little_helper2\clean.bat (1 KB)
  • c:\documents and settings\all users\start menu\programs\startup\little_helper2.lnk (1 KB)

Registry

The following registry keys are created:

  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    "little_helper2.exe"=""
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion
    \Uninstall\little_helper2_is1

The following registry keys are modified:

  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
    "Start Page"="www.de.ag"

Network Impact

Additional overhead in bandwidth due to download of advertising content.

Aliases

Aliases

    N/A