What is LyricsSay-16?

LyricsSay-16 is software application developed by FIRSERIA. It is most commonly found on computers running Windows 7 with nearly 48.44% of installations running this operating system. LyricsSay-16's installer is typically 4.00 MB in size and installs around 15 files.

LyricsSay-16 is most popular in the United States with 43.06% of installations residing in this country.

About LyricsSay-16?

Lyrics Say is presented to users as part of a co-bundled offer with the purported aim of displaying lyrics while viewing YouTube videos. However, its actual function involves the display of search ads through web browser hijacking. Operated primarily as a potentially unwanted application, Lyrics Say functions as a toolbar and web extension within the web browser. The application's main objective is to seize control of the user's browser, manipulating the search provider and redirecting web searches to affiliated search engine partners (SERPs) with whom the publisher holds revenue relationships. The toolbar/extension engages in various tactics to increase the likelihood of user clicks on sponsored advertisements via search and other ad-supported mechanisms. This includes altering the web browser's default home page to a partner search portal and modifying the browser's search provider, built-in search box, and address bar.

Multiple virus scanners have detected malware in LyricsSay-16.

LyricsSay-16-updater.exe (MD5: 3828335fe3cf5db370791d14ab6359ea) has been flagged by 13 scanners:

Scanner Software	Version	Result
Baidu-International	3.5.1.41473	HackTool.Win32.CrossRider.K
Dr.Web		Adware.Plugin.73
ESET-NOD32	9244	a variant of Win32/Toolbar.CrossRider.K
Fortinet FortiGate	5.1.147.0	Adware/Lyckriks
Malwarebytes	1.75.0.1	PUP.Optional.Adlyrics
McAfee	5.600.0.1067	PUP-FEJ!3828335FE3CF
McAfee-GW-Edition	2013	PUP-FEJ!3828335FE3CF
TrendMicro-HouseCall	9.700.0.1001	TROJ_GEN.R0CBH06KB13
VIPRE Antivirus	25040	Crossrider (fs)
AVG	13.0.0.3169	Generic5.AJKA
Kingsoft AntiVirus	2013.4.9.267	Win32.Troj.Generic.a.(kcloud)
Bkav FE	1.3.0.4415	W32.Clod7ad.Trojan.8141
Microsoft Security Essentials	1.10003	Adware:Win32/AddLyrics

LyricsSay-16-firefoxinstaller.exe (MD5: d65065e841be455a718a8705c18cb4dd) has been flagged by 17 scanners:

Scanner Software	Version	Result
Baidu-International	3.5.1.41473	Trojan.Win32.Toolbar.CrossRider.J
ESET-NOD32	9058	a variant of Win32/Toolbar.CrossRider.J
K7 AntiVirus	9.173.10217	Trojan ( 0048c68d1 )
K7GW	9.173.10217	Trojan ( 0048c68d1 )
Malwarebytes	1.75.0.1	PUP.Optional.Adlyrics
McAfee	5.600.0.1067	PUP-FEJ!D65065E841BE
McAfee-GW-Edition	2013	PUP-FEJ!D65065E841BE
Sophos	4.94.0	Generic PUA DK
Symantec	20131.1.5.61	Adware.FindLyrics
TrendMicro-HouseCall	9.700.0.1001	TROJ_GEN.R0C1H05JK13
VIPRE Antivirus	23450	Crossrider (fs)
Dr.Web		Adware.Plugin.73
Fortinet FortiGate	5.1.147.0	Adware/Lyckriks
AVG	13.0.0.3169	Generic5.AJKA
Kingsoft AntiVirus	2013.4.9.267	Win32.Troj.Generic.a.(kcloud)
Bkav FE	1.3.0.4415	W32.Clod7ad.Trojan.8141
Microsoft Security Essentials	1.10003	Adware:Win32/AddLyrics

LyricsSay-16-enabler.exe (MD5: c5af9d56545028c104b86baefc699ec2) has been flagged by 12 scanners:

Scanner Software	Version	Result
AVG	13.0.0.3169	Generic5.AJKA
Baidu-International	3.5.1.41473	Trojan.Win32.Toolbar.CrossRider.J
ESET-NOD32	9058	a variant of Win32/Toolbar.CrossRider.J
Kingsoft AntiVirus	2013.4.9.267	Win32.Troj.Generic.a.(kcloud)
Malwarebytes	1.75.0.1	PUP.Optional.Adlyrics
McAfee	5.600.0.1067	PUP-FEJ!C5AF9D565450
McAfee-GW-Edition	2013	PUP-FEJ!C5AF9D565450
TrendMicro-HouseCall	9.700.0.1001	TROJ_GEN.R0CBH06KC13
VIPRE Antivirus	23452	Crossrider (fs)
Bkav FE	1.3.0.4415	W32.Clod7ad.Trojan.8141
Microsoft Security Essentials	1.10003	Adware:Win32/AddLyrics
Fortinet FortiGate	5.1.147.0	Adware/Lyckriks

LyricsSay-16-codedownloader.exe (MD5: 4ba00beaec2f498b965e0dea64b63c22) has been flagged by 6 scanners:

Scanner Software	Version	Result
Baidu-International	3.5.1.41473	Adware.Win32.Lyrics.83
ESET-NOD32	9244	a variant of Win32/Toolbar.CrossRider.K
Fortinet FortiGate	5.1.147.0	Adware/Lyckriks
Malwarebytes	1.75.0.1	PUP.Optional.Adlyrics
TrendMicro-HouseCall	9.700.0.1001	TROJ_GEN.R0CBH06KG13
VIPRE Antivirus	25040	Crossrider (fs)

LyricsSay-16-chromeinstaller.exe (MD5: 07e4730a257116ddc7a19fed788f928b) has been flagged by 25 scanners:

Scanner Software	Version	Result
AhnLab-V3	2013.11.18	Adware/Win32.Lyckriks
AVG	2014.0.3629	Generic5
Baidu-International	4.0.3.131122	Trojan.Win32.Toolbar.CrossRider.J
Bitdefender	1.0.20.1630	Adware.Generic.610381
Bkav FE	1.3.0.4562	W32.Clod023.Trojan
Emsisoft Anti-Malware	8.13.11.22.12	Adware.Generic.610381
ESET-NOD32	7.9058	a variant of Win32/Toolbar.CrossRider.K
F-Secure	11.2013-22-11_6	Adware.Generic.610381
G Data	13.11.22	Adware.Generic.610381
K7 AntiVirus	13.173.10217	Trojan
K7GW	13.173.10217	Trojan ( 0048c68d1 )
Kaspersky	14.0.0.4492	not-a-virus:AdWare.Win32.Lyckriks
Kingsoft AntiVirus	331020.49267	Win32.Troj.Generic.a.(kcloud)
Malwarebytes	v2013.11.22.12	PUP.Optional.Adlyrics
McAfee	5600.7267	PUP-FEJ!07E4730A2571
McAfee-GW-Edition	7.7267	PUP-FEJ!07E4730A2571
MicroWorld-eScan	14.0.0.978	Adware.Generic.610381
Sophos	4.94	Generic PUA HO
Symantec	11/22/2013 rev. 6	Adware.FindLyrics
Trend Micro	10.465.22	TROJ_GEN.R0CBC0OKG13
TrendMicro-HouseCall	7.2.326	TROJ_GEN.R0CBC0OKG13
VIPRE Antivirus	23452	Crossrider (fs)
Dr.Web		Adware.Plugin.73
Fortinet FortiGate	5.1.147.0	Adware/Lyckriks
Microsoft Security Essentials	1.10003	Adware:Win32/AddLyrics

Startup Entries

Startup tasks:

LyricsSay-16-firefoxinstaller.exe is automatically launched at startup through a scheduled task named LyricsSay-16-firefoxinstaller.
LyricsSay-16-updater.exe is automatically launched at startup through a scheduled task named LyricsSay-16-updater.
LyricsSay-16-enabler.exe is automatically launched at startup through a scheduled task named LyricsSay-16-enabler.
LyricsSay-16-codedownloader.exe is automatically launched at startup through a scheduled task named LyricsSay-16-codedownloader.
LyricsSay-16-chromeinstaller.exe is automatically launched at startup through a scheduled task named LyricsSay-16-chromeinstaller.

Software Details

URL:

–

Support:

–

Installation path:

C:\Program Files\lyricssay-16

Uninstaller:

C:\Program Files\LyricsSay-16\Uninstall.exe /fromcontrolpanel=1

Size:

4.00 MB

Language:

English

LyricsSay-16 Executable Details

Primary executable:

utils.exe

Name:

LyricsSay-16

Path:

C:\Program Files\lyricssay-16\utils.exe

MD5:

–

SHA-1:

–

SHA-256:

–

File Type

Filename

MD5

EXE

LyricsSay-16-buttonutil64.exe

aa281500b37c2ed6ce5e53c15a719458

EXE

LyricsSay-16-buttonutil.exe

7b94d082f5b0b84759427863ae411492

DLL

LyricsSay-16-bho64.dll

6faedafad6cbf1ea45469fe005d98ff9

DLL

LyricsSay-16-bho.dll

Adware

f1685b51235c2830555efd9c19b938f5

EXE

LyricsSay-16-bg.exe

09166326d1256c1c1c4cac8a759786a5