Description

DownloadPlus is a process run at Windows startup which opens pop-up adverts (many of them porn-related) and, for some reason, weather reports.

Variants

DownloadPlus/MCInst is an ActiveX installer control for the main DownloadPlus program.

The code for the MCInst variant is derived from the Xupiter/Sqwire parasite; it is suspected the same people may be behind DownloadPlus as Xupiter.

Also known as

The software also refers to itself as MessageCenter.

Distribution

Installed by ActiveX drive-by download in pop-up ads (via DownloadPlus/MCInst).

Also loaded by the ISTbar/AUpdate parasite. In this case there is no ActiveX installer control, and the script at this site will be unable to detect DownloadPlus.

What it does

Advertising

Yes. Downloads an untargeted list of adverts to show from its controlling server tnc4u.

com, and opens them periodically as pop-unders.

Privacy violation

No.

Security issues

Yes. Can silently download and execute arbitrary unsigned code from its controlling server, as a self-updating feature.

Stability problems

No.

Removal

Click Start and open the Programs menu. Open the Startup submenu, right-click 'Download Plus' and choose 'Delete'.

Restart the computer and you should be able to delete DownloadPlus.exe which can be found in the Application Data folder. (On Windows 95/98/Me, the Application Data folder can be found inside the Windows folder; on Windows NT it is inside your user 'Profiles' folder in the Windows folder; on Windows 2000 and XP it is inside your user Documents and Settings folder.)

If you have the MCInst loader, open Downloaded Program Files (which is in the Windows folder), right-click 'Loader class' and choose 'Remove'.

You can also delete the key 'HKEY_CURRENT_USER\Software\0x7A69' in the registry (Start->Run->regedit) to clean up, if you like.