Home Possibly Unwanted Program Donation Reminder

Donation Reminder

Posted: February 3, 2016

Threat Metric

Ranking: 5,253
Threat Level: 1/10
Infected PCs: 9,256
First Seen: February 3, 2016
Last Seen: October 13, 2023
OS(es) Affected: Windows


Donation Reminder is a Potentially Unwanted Program (PUP) that may attract the attention of those PC users who enjoy donating money to various causes. As you probably know, some shopping platforms give a small percent of their revenue to charity organizations. Others suggest you donate a few dollars when you are finishing a purchase. Donation Reminder promises to inform you when the site you are currently on take part in some charity activity. In theory, this way you should never miss a chance to help people in need. While the toolbar may indeed take part in legit fundraising campaigns, there are reasons to consider before agreeing to install it. This tool may cause various changes to the Web clients that the majority of PC users may not enjoy. Donation Reminder may generate various notifications in Web pages that you may be unable to close. The messages may contain different information, but there are usually two buttons – 'Yes' and 'No.' Some users report that if they click on the first one, the browser will load the homepage. The second one doesn't work at all. This PUP may change your default starting site automatically. As a result, it may start redirecting you to partner pages or questionable search platforms. Some people note that the Donation Reminder toolbar may occupy a too large area of the screen – more than an inch. A particularly unpleasant aspect of this PUP is that Donation Reminder may seize a lot of resources for its processes. According to some users, it may consume from 500MB to 1GB of RAM. As a result, your whole PC may become sluggish. Once the toolbar detects that the opened site accepts donations, Donation Reminder may move the whole page down. If you try to read something, the process may be especially annoying. All in all, although the purpose of Donation Reminder seems worthy, it may ruin your surfing sessions. For this reason, you should consider using updated security software to delete Donation Reminder.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:



C:\Users\<username>\appdata\Roaming\Donation Reminder\uninstall.exe File name: C:\Users\<username>\appdata\Roaming\Donation Reminder\uninstall.exe
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
C:\Users\<username>\appdata\roaming\donation reminder\IEUpdater.exe File name: C:\Users\<username>\appdata\roaming\donation reminder\IEUpdater.exe
MD5: 134b0cd119c56ce6d7448faf093e07ec
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
ScriptHost.dll File name: ScriptHost.dll
File type: Dynamic link library
Mime Type: unknown/dll
Group: Malware file
ScriptHost64.dll File name: ScriptHost64.dll
File type: Dynamic link library
Mime Type: unknown/dll
Group: Malware file
EFR.dll File name: EFR.dll
File type: Dynamic link library
Mime Type: unknown/dll
Group: Malware file
EFR64.dll File name: EFR64.dll
File type: Dynamic link library
Mime Type: unknown/dll
Group: Malware file
IEUpdater.exe File name: IEUpdater.exe
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
IEUpdater64.exe File name: IEUpdater64.exe
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
AddonsFramework.Typelib.dll File name: AddonsFramework.Typelib.dll
File type: Dynamic link library
Mime Type: unknown/dll
Group: Malware file
AddonsFramework.Typelib64.dll File name: AddonsFramework.Typelib64.dll
File type: Dynamic link library
Mime Type: unknown/dll
Group: Malware file
BackgroundHost.exe File name: BackgroundHost.exe
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
BackgroundHost64.exe File name: BackgroundHost64.exe
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
ButtonSite.dll File name: ButtonSite.dll
File type: Dynamic link library
Mime Type: unknown/dll
Group: Malware file
ButtonSite64.dll File name: ButtonSite64.dll
File type: Dynamic link library
Mime Type: unknown/dll
Group: Malware file
jquery-1.9.1.min.js File name: jquery-1.9.1.min.js
File type: JavaScript file
Mime Type: unknown/js
Group: Malware file
json2.min.js File name: json2.min.js
File type: JavaScript file
Mime Type: unknown/js
Group: Malware file

Registry Modifications

The following newly produced Registry Values are:

CLSID{01B94BDC-2A0C-4471-B08A-47A24E677873}{0B7E4748-973A-40BF-83C3-1C5F7A63F91E}{28E1D71B-E5D4-427A-91C4-7C5584B59FB9}{2932FF3B-246F-4714-98A3-8406B15CA844}{3584840B-9815-4F88-B6F8-053BBA852FCB}{381DEA8D-EF7F-4EBC-AF6C-DA0AFC10C2BF}{4A951642-F22D-4ECD-8EEB-B4A05DADA26F}{9F470DB5-2FE6-41E1-88E3-4E4686CD4A28}{B1F9A831-E367-4202-9C42-AF48FA8057FE}{BAC26623-0D76-4C1C-A891-9D0EB853E7B1}{E718FC5E-0F7B-4735-B2D2-4AA856B03FCA}File name without pathhttp_www.easyfundraising.org.uk_0.localstoragehttp_www.easyfundraising.org.uk_0.localstorage-journalwww.easyfundraising.org[1].xmlHKEY..\..\..\..{RegistryKeys}SOFTWARE\Classes\Donation Reminder.BackgroundHostObjectSOFTWARE\Classes\Donation Reminder.BackgroundHostObject.1SOFTWARE\Classes\Donation Reminder.NavbarSOFTWARE\Classes\Donation Reminder.Navbar.1SOFTWARE\Classes\Donation Reminder.ScriptHostObjectSOFTWARE\Classes\Donation Reminder.ScriptHostObject.1SOFTWARE\Classes\Donation Reminder.ToolSOFTWARE\Classes\Donation Reminder.Tool.1SOFTWARE\Microsoft\Internet Explorer\Approved Extensions\{01B94BDC-2A0C-4471-B08A-47A24E677873}SOFTWARE\Microsoft\Internet Explorer\LowRegistry\DOMStorage\easyfundraising.org.ukSOFTWARE\Microsoft\Internet Explorer\LowRegistry\DOMStorage\www.easyfundraising.org.ukHKEY_LOCAL_MACHINE\Software\[APPLICATION]\Microsoft\Windows\CurrentVersion\Uninstall..{Uninstaller}Donation Reminder

Additional Information

The following directories were created:
%APPDATA%\Donation Reminder
The following URL's were detected:
www.easyfundraising.org.uk
Loading...