Virus

Adware/Websearch

Analysis

  • This Adware program has the following characteristics:
    File Size: 237,568, 116,381, 116,224, or 121,904.
    Packer: UPX
    Certain samples have the description of "Media Gateway".
    Certain samples have the internal name of "LoaderX".
    Certain samples have the product version of 1.20.

  • Upon executing the file some harddisk I/O will occur. There are however no graphical cues to it's existence.

  • The program will then create the directory:

    C:\Program Files\Media Gateway

  • The following files will be dropped:

    C:\Program Files\Media Gateway\Info.txt (File Size: 0)
    C:\Program Files\Media Gateway\mediagateway.exe (File Size: 237,568).

  • The following registry keys will be created:

    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Media Gateway
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Media Gateway

  • Note: The last registry entry is a common technique to ensure that the program is executed while booting Windows.
  • The executable mediagateway.exe will then display popup and/or popunder ads while the user is browsing websites.

  • The program may attempt to contact public.windupdates.com for additional downloads.

Recommended Action

Uninstall should be possible via the add/remove programs control panel applet. The program is named "Media Gateway".