Files that Malwarebytes Anti-Malware (MBAM) detect as OneClickDownloader are what we call bundlers. We have defined bundlers as a blend of programs that are bunched up together to be installed with a main program, which is usually what users desire to install onto their systems. These additional programs are other unwanted software, such as adware and toolbars.
Such bundlers are normally free and can be downloaded from third-party sites. Examples of bundlers we already profiled on the Malwarebytes Labs blog are Outbrowse, SofTango, and InstalleRex to name a few.
We retrieved a sample of OneClickDownloader that markets itself as a YouTube video downloader. Once installed, OneClickDownloader initially displays the following user interface wizard:
Clicking the green ‘Next’ button leads to this window:
Download Youtube videos at lightning fast speedAs you can see, apart from the downloader (the main program), it also offers to install other software that users may be interested in checking out.Supports Windows XP vista and 7 (x86, X64). Easily downloads as MP3, aac, mpeg, flv and HD formats. Includes Buzzdock: the web’s best search enhancer. Ad supported search results modifier, ezlooker: Browse Craigslist faster. Share posts with friends. PageRage: Customize your Facebook profile with 100’s of free layouts. BannerGadgets: Replace Ads with useful gadgets like clocks and pictures.
The shortcut links on the interfaces point to ww1[DOT]1clickdownloader[DOT]com, which is currently a parked domain. As such, users can’t find the “Terms of Use” or “Privacy Policy” pages. The said URL is also on their Facebook page. Quite notably, it hasn’t been updated since the second half of 2012.
We did a little digging in the archive and found what 1clickdownloader[DOT]com looks like several years ago and here’s what we found:
Iminent IM & Web apps in a clickThis OneClickDownloader sample (detected as PUP.Optional.OneClickDownloader) installs files that we detect as PUP.Optional.Iminent, PUP.Optional.Yontoo, and PUP.Optional.SweetIM.Iminent gives you cool new ways to express yourself in your Facebook status, chat, wall posts and messages! Spice up your conversations with awesome smileys, winks and symbols.
Another sample of OneClickDownloader we found is a program called TornTV, which has marketed itself as a downloader of for shows, movies, and sports events aired on TV. Once installed, it shows an interface similar to that of 1Click Downloader’s:
Such a similarity is usually an indicator that these bundles generally function the same way and/or come from one family.
We weren’t surprised to find out that the TornTV site is also a parked domain, so we pulled its old site from the archives:
If you want to remove OneClickDownloader from your systems, refer to this Malwarebytes forum post.
Relevant hash values:
- MD5 015bc8466ef29cdbd3c8d5b9b06bb444
- MD5 c7a6d35d78c8473b2e674012c9b06106
COMMENTS