Home Malware Programs Adware Adware.LyricsSay

Adware.LyricsSay

Posted: October 11, 2013

Threat Metric

Ranking: 12,346
Threat Level: 2/10
Infected PCs: 87,817
First Seen: October 11, 2013
Last Seen: September 25, 2023
OS(es) Affected: Windows

Ads by LyricsSay are a primary symptom of an installed instance of LyricsSay, an adware program that provides YouTube-centric lyrics search features – along with advertisements. Although Ads by LyricsSay is not a high-level PC threat and doesn't harm your computer intentionally, Ads by LyricsSay may be an inadvertent security or performance issue, and SpywareRemove.com malware experts suggest disabling Ads by LyricsSay by removing the associated Potentially Unwanted Program (or PUP). Ads by LyricsSay functions are compatible with most Web browsers, although Windows computers appear to be the primary targets of unwanted LyricsSay-related issues.

When You Don't Get to Choose the Tune to Which Your Browser Dances

Ads by LyricsSay are notable only for being one of the most visible symptoms of an adware program that, while Ads by LyricsSay doesn't benefit your computer significantly, at least has the courtesy to mark its advertisements as separate from any unrelated Web content. While LyricsSay adware may implement other advertisement-related features and most likely will update itself without requiring your permission, Ads by LyricsSay is the major symptom of LyricsSay and should be one of the first things that you notice on any computer with this program installed.

Ads by LyricsSay may appear on any site through injected keyword links, advertisement banners, etc, but LyricsSay's 'beneficial' features, the automatic look-ups for song lyrics, only appear on the YouTube website. Naturally, Ads by LyricsSay's content isn't vetted by YouTube (or any other reputable company) and malware experts warn that any interaction you deem taking related to these advertisements to be very much at your own risk. Avoiding giving out personal information, downloading potentially unsafe programs or using scripts with non-obvious consequences are some of the recommended safety tips for browsing Ads by LyricsSay or other advertising networks with a minimum of risk to your computer.

Bringing Silence to the Song of Advertising Gone Amuck

Because Ads by LyricsSay usually is an undesired side effect that hinders your browser's performance and may display potentially harmful content, malware experts consider LyricsSay a Potentially Unwanted Program and suggest deleting Ads by LyricsSay to get rid of Ads by LyricsSay, along with all other symptoms of this program. To be as sure as possible that Ads by LyricsSay and other browser modifications are removed entirely, the use of anti-malware utilities for this procedure is recommended.

Because the program responsible for delivering Ads by LyricsSay content lacks any form of marketing or readily-available download source, malware researchers suspect that this adware campaign is being distributed through either software bundles. As always, staying clear of sites with histories for distributing poor software or having overall bad security is the top way to keep your computer from being the next mark in an Ads by LyricsSay advertising plan.

Aliases

Generic5.AIIQ [AVG]Suspicious file [Panda]Generic PUA HO [Sophos]Adware.FindLyrics [Symantec]Artemis!07E4730A2571 [McAfee]Artemis!C2FA21DE1DC8 [McAfee]Generic_r.GS [AVG]Heuristic.BehavesLike.Win32.Suspicious-BAY.K [McAfee-GW-Edition]Artemis!FA709705174C [McAfee]Adware/Lyckriks [Fortinet]AdWare/Win32.Lyckriks [Antiy-AVL]Adware.Generic.600764 [F-Secure]ApplicUnwnt [Comodo]Generic PUA MO [Sophos]not-a-virus:AdWare.Win32.Lyckriks.lb [Kaspersky]
More aliases (42)

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:



%PROGRAMFILES(x86)%\ver2LyricsSay\d1LyricsSayn21.exe File name: d1LyricsSayn21.exe
Size: 513.02 KB (513024 bytes)
MD5: cf4056c02836c5932c75bd9f9070e0d4
Detection count: 522
File type: Executable File
Mime Type: unknown/exe
Path: %PROGRAMFILES(x86)%\ver2LyricsSay
Group: Malware file
Last Updated: August 17, 2017
%PROGRAMFILES(x86)%\LyricsSay-16\LyricsSay-16-bho64.dll File name: LyricsSay-16-bho64.dll
Size: 965.12 KB (965120 bytes)
MD5: 8acbc8b59285dd7c28cbf5339df317a1
Detection count: 129
File type: Dynamic link library
Mime Type: unknown/dll
Path: %PROGRAMFILES(x86)%\LyricsSay-16
Group: Malware file
Last Updated: September 21, 2019
%PROGRAMFILES%\ver2LyricsSay\178.dll File name: 178.dll
Size: 221.69 KB (221696 bytes)
MD5: a428b06df6148464853668771ecb79f4
Detection count: 96
File type: Dynamic link library
Mime Type: unknown/dll
Path: %PROGRAMFILES%\ver2LyricsSay
Group: Malware file
Last Updated: August 17, 2017
%PROGRAMFILES%\LyricsSay-16\LyricsSay-16-updater.exe File name: LyricsSay-16-updater.exe
Size: 391.68 KB (391680 bytes)
MD5: f27f97a0fe9ceefdf83ea2c5c4659d6f
Detection count: 93
File type: Executable File
Mime Type: unknown/exe
Path: %PROGRAMFILES%\LyricsSay-16
Group: Malware file
Last Updated: August 17, 2017
%PROGRAMFILES%\LyricsSay-16\LyricsSay-16-enabler.exe File name: LyricsSay-16-enabler.exe
Size: 346.62 KB (346624 bytes)
MD5: d0f495436c24d9ec1d766814d57adb39
Detection count: 92
File type: Executable File
Mime Type: unknown/exe
Path: %PROGRAMFILES%\LyricsSay-16
Group: Malware file
Last Updated: August 17, 2017
%PROGRAMFILES(x86)%\LyricsSay-16\LyricsSay-16-bho64.dll File name: LyricsSay-16-bho64.dll
Size: 963.07 KB (963072 bytes)
MD5: 607ae7a94b24e5b272c6184d2596ad8c
Detection count: 82
File type: Dynamic link library
Mime Type: unknown/dll
Path: %PROGRAMFILES(x86)%\LyricsSay-16
Group: Malware file
Last Updated: August 17, 2017
%PROGRAMFILES%\LyricsSay-16\LyricsSay-16-updater.exe File name: LyricsSay-16-updater.exe
Size: 367.1 KB (367104 bytes)
MD5: 1abde968623f78fd5d8c7534205be262
Detection count: 82
File type: Executable File
Mime Type: unknown/exe
Path: %PROGRAMFILES%\LyricsSay-16
Group: Malware file
Last Updated: August 17, 2017
%PROGRAMFILES%\LyricsSay-16\LyricsSay-16-enabler.exe File name: LyricsSay-16-enabler.exe
Size: 355.84 KB (355840 bytes)
MD5: 90176dfc09cb0041355f3a4218f6f978
Detection count: 81
File type: Executable File
Mime Type: unknown/exe
Path: %PROGRAMFILES%\LyricsSay-16
Group: Malware file
Last Updated: August 17, 2017
%PROGRAMFILES%\LyricsSay-16\LyricsSay-16-codedownloader.exe File name: LyricsSay-16-codedownloader.exe
Size: 494.59 KB (494592 bytes)
MD5: c6d6e1ad19e3ca65125c8a0cb927b3b0
Detection count: 80
File type: Executable File
Mime Type: unknown/exe
Path: %PROGRAMFILES%\LyricsSay-16
Group: Malware file
Last Updated: August 17, 2017
%PROGRAMFILES%\LyricsSay-16\LyricsSay-16-codedownloader.exe File name: LyricsSay-16-codedownloader.exe
Size: 521.34 KB (521345 bytes)
MD5: 86c82b94e756bcadd3a995c0a13cd26e
Detection count: 55
File type: Executable File
Mime Type: unknown/exe
Path: %PROGRAMFILES%\LyricsSay-16
Group: Malware file
Last Updated: August 17, 2017
%PROGRAMFILES(x86)%\LyricsSay-16\LyricsSay-16-updater.exe File name: LyricsSay-16-updater.exe
Size: 391.68 KB (391680 bytes)
MD5: b02ec0859c7f25120ac1c720d6f8d02b
Detection count: 53
File type: Executable File
Mime Type: unknown/exe
Path: %PROGRAMFILES(x86)%\LyricsSay-16
Group: Malware file
Last Updated: August 17, 2017
%PROGRAMFILES%\ver2LyricsSay\e0f.exe File name: e0f.exe
Size: 255.48 KB (255488 bytes)
MD5: 2442f711a5130e3cb083945a36947e56
Detection count: 30
File type: Executable File
Mime Type: unknown/exe
Path: %PROGRAMFILES%\ver2LyricsSay
Group: Malware file
Last Updated: August 17, 2017
%PROGRAMFILES%\LyricsSay\LyricsSaypUb.exe File name: LyricsSaypUb.exe
Size: 365.05 KB (365056 bytes)
MD5: be7fac06cd1d6ddd68dcdc2a3b8d71f7
Detection count: 26
File type: Executable File
Mime Type: unknown/exe
Path: %PROGRAMFILES%\LyricsSay
Group: Malware file
Last Updated: August 17, 2017
%PROGRAMFILES(x86)%\LyricsSay-15\LyricsSay-15-codedownloader.exe File name: LyricsSay-15-codedownloader.exe
Size: 565.24 KB (565248 bytes)
MD5: af596e7cba9f46da72dd2684a5f22ab4
Detection count: 26
File type: Executable File
Mime Type: unknown/exe
Path: %PROGRAMFILES(x86)%\LyricsSay-15
Group: Malware file
Last Updated: August 17, 2017
%PROGRAMFILES(x86)%\LyricsSay-15\LyricsSay-15-chromeinstaller.exe File name: LyricsSay-15-chromeinstaller.exe
Size: 558.59 KB (558592 bytes)
MD5: 4144910b2506900cc759c4779d574230
Detection count: 25
File type: Executable File
Mime Type: unknown/exe
Path: %PROGRAMFILES(x86)%\LyricsSay-15
Group: Malware file
Last Updated: August 17, 2017
%TEMP%\ins2554\LyricsSay_1060-8002_v122.exe File name: LyricsSay_1060-8002_v122.exe
Size: 5.56 MB (5562491 bytes)
MD5: 51c32c1c21cd21d579a34e08215f3301
Detection count: 21
File type: Executable File
Mime Type: unknown/exe
Path: %TEMP%\ins2554
Group: Malware file
Last Updated: October 30, 2013
%PROGRAMFILES(x86)%\LyricsSay-16\LyricsSay-16-chromeinstaller.exe File name: LyricsSay-16-chromeinstaller.exe
Size: 471.04 KB (471040 bytes)
MD5: ee5a33456c2fcddad37aa393fdb460f5
Detection count: 5
File type: Executable File
Mime Type: unknown/exe
Path: %PROGRAMFILES(x86)%\LyricsSay-16
Group: Malware file
Last Updated: August 17, 2017
%SystemDrive%\Documents and Settings\nico y bego\Datos de programa\LyricsSay-16-BrowserExtensionUninstall\LyricsSay-16-firefoxinstaller.exe File name: LyricsSay-16-firefoxinstaller.exe
Size: 732.16 KB (732160 bytes)
MD5: ea8e1f8b9a68f21b089d63564954810d
Detection count: 5
File type: Executable File
Mime Type: unknown/exe
Path: %SystemDrive%\Documents and Settings\nico y bego\Datos de programa\LyricsSay-16-BrowserExtensionUninstall
Group: Malware file
Last Updated: August 17, 2017

More files

Registry Modifications

The following newly produced Registry Values are:

CLSID{11111111-1111-1111-1111-110411151152}{22222222-2222-2222-2222-220422152252}{44444444-4444-4444-4444-440444154452}{55555555-5555-5555-5555-550455155552}{66666666-6666-6666-6666-660466156652}Regexp file mask%WinDir%\System32\Tasks\LyricsSay-1-enabler%WinDir%\Tasks\LyricsSay-1-enabler.jobHKEY..\..\..\..{RegistryKeys}Software\AppDataLow\Software\LyricsSay-1SOFTWARE\Classes\CrossriderApp0041552.BHOSOFTWARE\Classes\CrossriderApp0041552.BHO.1SOFTWARE\Classes\CrossriderApp0041552.SandboxSOFTWARE\Classes\CrossriderApp0041552.Sandbox.1Software\InstalledThirdPartyPrograms\EID41552SOFTWARE\LyricsSay-1Software\Microsoft\Internet Explorer\Approved Extensions\{11111111-1111-1111-1111-110411151152}Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{11111111-1111-1111-1111-110411151152}SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{25721a53-294e-4177-9d4a-ff72a748a486}SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{344beb71-0de9-46cc-8aa4-67a935d23fe4}SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{4da6a9c3-3299-4328-a906-fa86ff1272a0}SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5e5c21dc-2a32-46fe-b628-7c9a0da4df61}SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{79606797-a9a0-4c68-aaec-e369a7612da0}SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION\LyricsSay-1-bg.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\LyricsSay-1-enablerSOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110411151152}Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{11111111-1111-1111-1111-110411151152}Software\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{11111111-1111-1111-1111-110411151152}SOFTWARE\Wow6432Node\LyricsSay-1SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{25721a53-294e-4177-9d4a-ff72a748a486}SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{344beb71-0de9-46cc-8aa4-67a935d23fe4}SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{3a427c33-ee16-476b-8199-db28c855160d}SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{45c7ba75-e8b5-48a0-a746-79b822c963cc}SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{4da6a9c3-3299-4328-a906-fa86ff1272a0}SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5e5c21dc-2a32-46fe-b628-7c9a0da4df61}SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{741d0c1f-1250-4006-bdc0-0671383f2db7}SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{79606797-a9a0-4c68-aaec-e369a7612da0}SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{92067849-b941-4a8e-b45b-2ab5ee38df9d}SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{b11c38fe-61eb-4a06-b901-b3dcce8e66ca}SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION\LyricsSay-1-bg.exeSOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110411151152}SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\LyricsSay-1

Additional Information

The following directories were created:
%PROGRAMFILES%\LyricsSay-1%PROGRAMFILES(x86)%\LyricsSay-1
The following URL's were detected:
LyricsSay
Loading...