InterMute > Threat Research

MediaUpdate is an IE Browser Helper Object that monitors pages you view and opens or redirects to advertising.

Variants

MediaUpdate/012 and MediaUpdate/020; two versions of the same software controlled by media-update.com.

MediaUpdate/022 is a newer version controlled by stop-pops.com.

Also known as

DoubleAgent, or Movie-Viewer (020 variant), after internal object names. MedUp, after its filename. The 022 variant is known as SafeSurfing after the program it is distributed as part of.

Distribution

012 and 020 are known to be installed by .EXE video downloaders, probably spawned by porn pop-ups.

022 is distributed with a pop-up-advert stopper called ‘SafeSurfing’.

What it does

Advertising

Yes. It connects to its controlling server to download a list of site URLs and keywords to target. If you visit a targeted site, or view a page with a keyword in its title, MediaUpdate may redirect you to one of their affiliate pages, or open one in a new browser window.

Privacy violation

No.

Security issues

Yes. Can silently download and execute arbitrary code from its controlling server, as a self-updating feature.

Stability problems

No.

Removal

MediaUpdate/020 includes an entry in the Control Panel's Add/Remove Programs list for 'Movie Viewer 2.1'. Unfortunately, it does not work.

Manual removal

Open the registry (click 'Start', choose 'Run' and enter 'regedit'), and find the key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run. Delete the 'UpdateMedia' entry (012 and 020 variants) or 'SafeSurfingUpdate' (022 variant).

Now open a DOS command prompt window (from Start->Programs->Accessories), and enter the following commands (for the 012 variant):

Or, for the 020 variant:

Or, for the 022 variant:

Restart the computer and you should be able to delete the file 'medup012.dll' (012 variant), 'medup020.dll' (020 variant) or 'ssurf022.dll' (022 variant) in the System folder. (The System folder can be found inside the Windows folder; it is called 'System32' on Windows NT/2000/XP, or just 'System' on Windows 95/98/Me.) You can also delete the 'MediaUpdate' folder in Program Files with the 012 and 020 variants.

You can also delete the subkey 'Invictus' (012, 020 variants) or 'SafeSurfing' (022 variant) in the registry key HKEY_LOCAL_MACHINE\Software to clean up if you like.