Adware:Win32/AddLyrics

Installation

The program may be installed from the addlyrics.net website, or it could be installed by offers in third-party software installers.

It installs itself as a Chrome extension, an Internet Explorer add-on, and a Firefox plug-in.

For the Chrome extension it installs the file Chrome.crx in the %ProgramFiles% folder, along with the following files in Chrome's user data folder (for example, %APPDATA%\Google\Chrome\User Data\Default\Extensions\kdlfddggdloaadnphbhejknhaggjaeld\1.0_0\):

• addlyrics128.png
• addlyrics16.png
• addlyrics48.png
• background.html
• background.js
• contentscript.js
• no nomanifest.json

For the Internet Explorer add-on, it installs the following files into the %ProgramFiles%/AddLyricsfolder:

• AddLyrics.dll
• r.log
• YTLUpdater.exe

You can see the add-on in the Manage Add-ons windows in Internet Explorer:

For the Firefox plug-in it installs the following files in %ProgramFiles%\AddLyrics\FF:

• chrome.manifest
• chrome\content\addlyrics32.png
• chrome\content\main.js (detected as Adware:Win32/AddLyrics)
• chrome\content\overlay.xul
• install.rdf

You can see the plug-in in the Add ons Manager in Firefox:

Adware:Win32/AddLyrics updates itself by creating a scheduled Windows task called YTLUpdater.exe that runs every day.

It also creates an entry in the Programs and Features section of the Control Panel. Running this uninstaller removes the program from your PC. The entry may be called AddLyrics or something similar:

Behavior

Adware:Win32/AddLyrics displays ads in your browser window, and also displays the lyrics to songs if you view a song on YouTube.

The following are some examples of the ads it displays:

Analysis by Chris Stubbs