5/5 - (1 votes)

YTDownloader, Potentially Superfluous Software.

Some legitimate programs like YTDownloader can be classified as superfluous, they are not necessarily necessary for the functioning of the system and sometimes even unwanted.

More specifically, the YTDownloader program falls into the category of software likely to display ads in the form of coupons and banner ads in the form of popups.
These announcements are usually signed with the words “Powered by”, “Brought to you by” or even “Ads by”, followed by the software name.
According to its developer Goobzo ltd, this program is capable of downloading YouTube videos for viewing on phones, tablets and other connected devices.
Some security solutions, such as Malwarebytes Antimalwares, classify this software as Potentially Unwanted Optional Software (PUP/LPI).

This program is classified as Potentially Unnecessary Software (LPS). It installs as a program and/or as a browser extension. It can start automatically from the Registry via a "Run" key, a service or a scheduled task. It may launch when you start your browser after changing its settings. Sometimes the launch is done silently, that is to say it works in the background. The virus analysis of this software does not show any malware detection.

These are mostly legitimate programs that may not be necessary for your system to function properly. The multiplication of programs launched at system startup can cause delays in the execution of ordinary system tasks but also when browsing the Internet. Note that some programs come from downloads with repackaging, a technique which consists of offering other software during installation. These additional programs are obviously superfluous, they can even be installed without your knowledge. It is recommended to read the EULA before installing packaged software. Before clicking, check the relevance of the pre-checked boxes offered to you.

Potentially unwanted software (LPI) or Potentialy Unwanted Programs (PUP) are the cause of many infections. The most common example is adware. InstallCore, Crossrider, Graftor ou Boxore which pollute the Registry and your data storage units. They are usually installed without your knowledge by downloading freeware. Indeed some sites use the repackaging method, an operation which consists of redoing the software installation module by adding download options. These options allow you to add other software such as browser toolbars, adware, potentially unwanted software, intrusive advertising software, or even browser hijackers.

Spyware (spyware) and adware (adwares) unwanted files, just like malware, can use the writing flaws of legitimate software or those of operating systems. It is therefore essential to have official software and that it has automatic updating. Likewise, your Windows operating system must be programmed in automatic update mode and activated, so that you can have the latest updates for critical security vulnerabilities.

TECHNICAL ELEMENTS

Preview in reports

Recorded on 18/01/2019
– Starts a process at system launch (RP),
- It installs a Mozilla Firefox (P2) browser plugin,
- It is installed in the Registry Base in order to be launched each time the system starts (O4),
- It is installed as a service to be launched each time the system starts (O23), (SS/SR),
- It installs as a program (O42)
– Created multiple “Software” registry keys,
- Adds additional folders (O43),
- Registration in the Windows prefetcher folder (O45)
– Added multiple user files (O61),

Preview in reports

Recorded on 01/03/2014.
[MD5.270BED0EB721D9FC306A6A96E5D7810E] – (.YTDownloader – YTDownloader.) — C:\Program Files (x86)\YTDownloader\YTDownloader.exe [2050408] [PID.8116]
O4 – HKLM\..\Wow6432Node\Run: [YTDownloader] . (.YTDownloader – YTDownloader.) — C:\Program Files (x86)\YTDownloader\YTDownloader.exe
O23 – Service: Search Module Update (SMUpd). (.Search Module Ltd. – Search Module Update Service.) – C:\Program Files\Common Files\Goobzo\GBUpdate\smu.exe
O23 – Service: (BrsHelper). (…) – C:\Program Files\YTDownloader\BrowserHelperSrv.exe
[MD5.182D7C7C3B522008CAFF99C29A6E0D52] [APT] [YTDownloaderUpd] (.Goobzo.) — C:\Program Files (x86)\YTDownloader\updater.exe [719720]
O42 – Software: YTDownloader – (.YTDownloader.) [HKLM][64Bits] — YTDownloader
O42 – Software: YouTube Accelerator – (.Goobzo Ltd..) [HKLM] — YouTube Accelerator
[HKCU\Software\YTDownloader]
[HKLM\Software\YTDownloader]
[HKLM\Software\Goobzo]
O43 – CFD: 11/11/2013 – 14:50:43 – [9,733] —-DC:\Program Files (x86)\YTDownloader
O43 – CFD: 27/02/2014 – 12:07:26 – [0,002] —-D C:\Users\christian\Coolman\Roaming\Microsoft\Windows\Start Menu\Programs\YTDownloader
SR – | Auto 04/03/2014 2541928 | (SMUpd). (.Search Module Ltd..) – C:\Program Files\Common Files\Goobzo\GBUpdate\smu.exe
[HKLM\SYSTEM\CurrentControlSet\Services\SMUpd]
[HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\YTDownloader]
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]:YTDownloader
[HKCU\Software\YTDownloader]
[HKLM\Software\YTDownloader]
[HKLM\Software\Goobzo]
[HKLM\SYSTEM\CurrentControlSet\Services\SMUpd]
C:\Program Files (x86)\YTDownloader
C:\Program Files (x86)\YTDownloader\YTDownloader.exe
C:\Program Files\Common Files\Goobzo\GBUpdate\smu.exe

Recorded on 12/09/2017
P2 – EXT FILE: (…) — C:\Users\Coolman\AppData\Roaming\Mozilla\Firefox\Profiles\4z4aj2fa.default\extensions\addon@ytdownloader.info.xpi