LyricsFan-2

LyricsFan-2

Known Malware

by CrossLyrics

What is LyricsFan-2?

LyricsFan-2 is software application developed by CrossLyrics. It is most commonly found on computers running Windows 7 with nearly 68.89% of installations running this operating system. LyricsFan-2's installer is typically 8.00 MB in size and installs around 15 files. The most common release is 1.28.153.4 with 53.33% of all installations currently using this version.

LyricsFan-2 is most popular in Australia with 23.26% of installations residing in this country.

About LyricsFan-2?

LyricsFan-2 is a browser extension designed to control and manipulate the user's browsing experience through the injection of advertising and redirection of web searches. It operates as a Browser Helper Object in Internet Explorer, and is known for hijacking advertising on non-associated websites and injecting its own advertising in various forms, including contextual link ads, banner ads, popups, and pop-overs. This malware is often distributed alongside unwanted third-party applications and through web browser vulnerabilities. While it does come with an uninstaller and can be found in the Windows Add/Remove Programs, completely removing it may be challenging and may require the use of anti-malware software.

Multiple virus scanners have detected malware in LyricsFan-2.

LyricsFan-2-updater.exe (MD5: 4d90b3b1c1b89c4d3d23c4e676e5073f) has been flagged by 27 scanners:
Scanner Software Result
Lavasoft Ad-Aware Adware.AddLyrics.AK
AVG Generic_r.GS
Baidu-International Adware.Win32.CrossRider.J
Bitdefender Adware.AddLyrics.AK
Dr.Web Trojan.Crossrider.32
Emsisoft Anti-Malware Adware.AddLyrics.AK (B)
ESET-NOD32 a variant of Win32/Toolbar.CrossRider.J
Fortinet FortiGate Riskware/Toolbar_CrossRider
G Data Adware.AddLyrics.AK
IKARUS anti.virus AdWare.AddLyrics
K7 AntiVirus Trojan ( 0048c68d1 )
K7GW Trojan ( 0048c68d1 )
Malwarebytes PUP.Optional.Lyrics.A
McAfee PUP-FEJ!4D90B3B1C1B8
McAfee-GW-Edition PUP-FEJ!4D90B3B1C1B8
MicroWorld-eScan Adware.AddLyrics.AK
nProtect Adware.AddLyrics.AK
Sophos Lyrmix Agent
Symantec WS.Reputation.1
TrendMicro-HouseCall TROJ_GEN.R00UH06LO13
VIPRE Antivirus Crossrider (fs)
Antiy-AVL AdWare/Win32.Lyckriks
Jiangmin AdWare/Lyckriks.dm
Kaspersky not-a-virus:AdWare.Win32.Lyckriks.ly
Kingsoft AntiVirus Win32.Troj.Generic.a.(kcloud)
Trend Micro TROJ_GEN.R0C1C0OKI13
Bkav FE W32.Clodbf6.Trojan.80d1
LyricsFan-2-firefoxinstaller.exe (MD5: 973e6573d0a5346c3b918714c3eb13e9) has been flagged by 10 scanners:
Scanner Software Result
Baidu-International Adware.Win32.Lyrics.71
ESET-NOD32 a variant of Win32/Toolbar.CrossRider.J
Fortinet FortiGate Riskware/Toolbar_CrossRider
Malwarebytes PUP.Optional.Lyrics.A
McAfee PUP-FEJ!973E6573D0A5
McAfee-GW-Edition PUP-FEJ!973E6573D0A5
Sophos Lyrmix Agent
Symantec Adware.FindLyrics
VIPRE Antivirus Crossrider (fs)
Bkav FE W32.Clodbf6.Trojan.80d1
LyricsFan-2-enabler.exe (MD5: 41fa0a64f9354eaca4b4e7730513be75) has been flagged by 12 scanners:
Scanner Software Result
AVG Generic5.AJKA
Baidu-International HackTool.Win32.CrossRider.I
ESET-NOD32 a variant of Win32/Toolbar.CrossRider.J
K7GW Trojan ( 0048c68d1 )
Malwarebytes PUP.Optional.Lyrics.A
McAfee PUP-FEJ!41FA0A64F935
McAfee-GW-Edition Heuristic.BehavesLike.Win32.Suspicious-BAY.K
Sophos Lyrmix Agent
Symantec WS.Reputation.1
VIPRE Antivirus Crossrider (fs)
Fortinet FortiGate Riskware/Toolbar_CrossRider
Bkav FE W32.Clodbf6.Trojan.80d1
LyricsFan-2-codedownloader.exe (MD5: afa3b99fde80f4c614542e5b8fca8b56) has been flagged by 30 scanners:
Scanner Software Result
Lavasoft Ad-Aware Adware.AddLyrics.AH
AVG Generic_r
Baidu-International Adware.Win32.CrossRider.J
Bitdefender Adware.AddLyrics.AH
Dr.Web Trojan.Crossrider.19
Emsisoft Anti-Malware Adware.AddLyrics.AH
ESET-NOD32 a variant of Win32/Toolbar.CrossRider.J
F-Secure Adware.AddLyrics.AH
G Data Adware.AddLyrics.AH
IKARUS anti.virus AdWare.AddLyrics
K7 AntiVirus Trojan
K7GW Trojan ( 0048c68d1 )
Kingsoft AntiVirus Win32.Troj.Generic.a.(kcloud)
Malwarebytes PUP.Optional.Lyrics.A
McAfee PUP-FEJ!AFA3B99FDE80
McAfee-GW-Edition Heuristic.BehavesLike.Win32.Suspicious-BAY.K
MicroWorld-eScan Adware.AddLyrics.AH
NANO AntiVirus Trojan.Win32.Crossrider.csbfcl
nProtect Adware.AddLyrics.AH
Panda Antivirus Suspicious file
Sophos Lyrmix Agent
Symantec Trojan.Gen
TrendMicro-HouseCall TROJ_GEN.R0CBH05A414
VIPRE Antivirus Crossrider (fs)
Fortinet FortiGate Riskware/Toolbar_CrossRider
Antiy-AVL AdWare/Win32.Lyckriks
Jiangmin AdWare/Lyckriks.dm
Kaspersky not-a-virus:AdWare.Win32.Lyckriks.ly
Trend Micro TROJ_GEN.R0C1C0OKI13
Bkav FE W32.Clodbf6.Trojan.80d1
LyricsFan-2-chromeinstaller.exe (MD5: 95ee2144e170b56c478ee9945665a0a0) has been flagged by 18 scanners:
Scanner Software Result
Antiy-AVL AdWare/Win32.Lyckriks
AVG Generic5.AIIQ
Baidu-International HackTool.Win32.CrossRider.J
ESET-NOD32 a variant of Win32/Toolbar.CrossRider.K
Fortinet FortiGate Adware/Lyckriks
Jiangmin AdWare/Lyckriks.dm
Kaspersky not-a-virus:AdWare.Win32.Lyckriks.ly
Kingsoft AntiVirus Win32.Troj.Generic.a.(kcloud)
Malwarebytes PUP.Optional.Lyrics.A
McAfee PUP-FEJ!95EE2144E170
McAfee-GW-Edition PUP-FEJ!95EE2144E170
Sophos Generic PUA AC
Symantec Adware.FindLyrics
Trend Micro TROJ_GEN.R0C1C0OKI13
TrendMicro-HouseCall TROJ_GEN.R0C1C0OKI13
VIPRE Antivirus Crossrider (fs)
K7GW Trojan ( 0048c68d1 )
Bkav FE W32.Clodbf6.Trojan.80d1

Startup Entries

Startup tasks:
  • LyricsFan-2-enabler.exe is automatically launched at startup through a scheduled task named LyricsFan-2-enabler.
  • LyricsFan-2-firefoxinstaller.exe is automatically launched at startup through a scheduled task named LyricsFan-2-firefoxinstaller.
  • LyricsFan-2-updater.exe is automatically launched at startup through a scheduled task named LyricsFan-2-updater.
  • LyricsFan-2-codedownloader.exe is automatically launched at startup through a scheduled task named LyricsFan-2-codedownloader.
  • LyricsFan-2-chromeinstaller.exe is automatically launched at startup through a scheduled task named LyricsFan-2-chromeinstaller.

Software Details

URL:
–
Support:
–
Installation path:
C:\Program Files\lyricsfan-2
Uninstaller:
C:\Program Files\LyricsFan-2\Uninstall.exe /fromcontrolpanel=1
Size:
8.00 MB
Language:
English

LyricsFan-2 Executable Details

Primary executable:
utils.exe
Name:
LyricsFan-2
Path:
C:\Program Files\lyricsfan-2\utils.exe
MD5:
–
SHA-1:
–
SHA-256:
–
Files installed by LyricsFan-2
File Type Filename MD5
EXE
ab91a7350a5fddcdf0a7b0c60e8e4e71
EXE
a0bdc8051a740904d9e5f24d697f6875
EXE
4d90b3b1c1b89c4d3d23c4e676e5073f
EXE
973e6573d0a5346c3b918714c3eb13e9
EXE
41fa0a64f9354eaca4b4e7730513be75
EXE
afa3b99fde80f4c614542e5b8fca8b56
EXE
95ee2144e170b56c478ee9945665a0a0
EXE
5d15f0f5fec92af86e62f6c04154845b
EXE
61e782bd6b10969357c035395d3d3edc
DLL
470628e76a736e1e6c14819d84639d95