Follow:

 

Adware:Win32/AddLyrics


Microsoft security software detects and removes this potentially unwanted software.

This adware program shows ads as you browse the web.

You can see examples of these ads on the Technical information tab.

It can be downloaded from the program's website or bundled with some third-party software installation programs.

Find out more about how and why we identify potentially unwanted software.



What to do now

This program poses a high threat to your PC.

Remove programs

You might need to manually remove this program:

The entry for this program may be called AddLyrics.

If an uninstaller is not available, does not work properly, or you do not want to use it, you can use the following free tools to detect and remove this program and other potentially unwanted software from your PC:

You should also run a full scan. A full scan might find other, hidden threats.

Remove browser add-ons

You might need to remove add-ons from your browser:

Get more help

You can also visit our advanced troubleshooting page or search the Microsoft virus and malware community for more help.

If you’re using Windows XP, see our Windows XP end of support page.

Threat behavior

Adware:Win32/AddLyrics may be installed from the addlyrics.net website, or it could be installed by offers in third-party software installers.

Installation

It installs itself as a Chrome extension, an Internet Explorer add-on, and a Firefox plug-in.

For the Chrome extension it installs the file Chrome.crx in the %ProgramFiles% folder, along with the following files in Chrome's user data folder (for example, %APPDATA%\Google\Chrome\User Data\Default\Extensions\kdlfddggdloaadnphbhejknhaggjaeld\1.0_0\):

  • addlyrics128.png
  • addlyrics16.png
  • addlyrics48.png
  • background.html
  • background.js
  • contentscript.js
  • no nomanifest.json

For the Internet Explorer add-on, it installs the following files into the %ProgramFiles%/AddLyricsfolder:

  • AddLyrics.dll
  • r.log
  • YTLUpdater.exe

You can see the add-on in the Manage Add-ons windows in Internet Explorer:

For the Firefox plug-in it installs the following files in %ProgramFiles%\AddLyrics\FF:

  • chrome.manifest
  • chrome\content\addlyrics32.png
  • chrome\content\main.js (detected as Adware:Win32/AddLyrics)
  • chrome\content\overlay.xul
  • install.rdf

You can see the plug-in in the Add ons Manager in Firefox:

Adware:Win32/AddLyrics updates itself by creating a scheduled Windows task called YTLUpdater.exe that runs every day.

It also creates an entry in the Programs and Features section of the Control Panel. Running this uninstaller removes Adware:Win32/AddLyrics from your PC. The entry may be called AddLyrics or something similar:

Behavior

Adware:Win32/AddLyrics displays ads in your browser window, and also displays the lyrics to songs if you view a song on YouTube.

The following are some examples of the ads it displays:

Analysis by Chris Stubbs


Symptoms

The following could indicate that you have this program on your PC:

  • You see these pop-up ads:

  • When viewing songs on YouTube, you might also see lyrics, such as:


Prevention


Alert level: High
First detected by definition: 1.145.177.0
Latest detected by definition: 1.177.1340.0 and higher
First detected on: Feb 21, 2013
This entry was first published on: Feb 21, 2013
This entry was updated on: Aug 21, 2014

This threat is also detected as:
No known aliases