Websteroids

Posted: December 13, 2013

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Ranking:	918
Threat Level:	1/10
Infected PCs:	160,300

First Seen:	December 13, 2013
Last Seen:	March 10, 2025
OS(es) Affected:	Windows

Websteroids is a gaming application that provides a spinoff of the popular Asteroids game, but also finances itself through the automatic display of advertisements. Like any other adware program, Websteroids may endanger your computer incidentally through its advertisements, but the company responsible Websteroids denies any legal responsibility for policing the safety of its advertisements. Websteroids also requests the theoretical ability to make other unwanted modifications to your browser that cause this application to perform double-duty as a browser hijacker. Malware researchers usually recommend deleting Websteroids and all similar adware, but with Websteroids's history of resisting uninstallation, anti-malware software may be needed to make sure that any uninstallation 'sticks.'

Websteroids: the Clutter of Deep Space Meets the Clutter of the World Wide Web

A clear cash-in on the name recognition of one of the most influential arcade cabinets of all time, Websteroids is a browser gaming add-on that claims to add digital meteor excitement to your Web-browsing life. Simultaneously, Websteroids also includes various other browser changes that aren't as fun as an action-oriented spaceship simulation. Malware researchers have classified Websteroids as adware due to its focus on advertising, although Websteroids does have other functions as noted here:

Websteroids may choose to display injected banners, hyperlinked text advertisements, interstitial advertisements (advertisements that load 'between' you leaving one website and loading a second one) and various other types of advertisements without any restrictions.
Websteroids reserves the right to change your homepage, your default search page and 'other browser features' indiscriminately.
Websteroids also may disable various features that interfere with Websteroids (potentially including advertisement-blocking features).

One important detail that Websteroids doesn't mention directly is the fact that Websteroids usually attempts to avoid being uninstalled. The company behind Websteroids claims that any Websteroids deletion issues are an inevitable occurrence due to the so-called 'complexity' of their software, which malware researchers can't help but find to be an incredibly unbelievable suggestion.

Sailing Your Browser to a Sector Clear of Websteroids Obstacles

If you happen to take the unlikely leap in logic of assuming that all of the claims made by the Websteroids company's terms of use are honest, you're still left with the fact that Websteroids is overall, far more of a problem for your Web browser than a beneficiary program. While adware programs are quite prolific, reputable free games are just as numerous, and malware researchers would recommend you enjoy the latter, rather than expose your browser to the kinds of unnecessary changes espoused by Websteroids. Of course, all of that is ignoring the possibility of some of Websteroids's advertisements including unsafe content, which is a far from unheard of occurrence for adware programs.

Taking into account Websteroids's history of trying to stop itself from being deleted, removing Websteroids can be done relatively painlessly through the system-scanning functions of anti-adware and anti-malware products. For protection against an unwanted Websteroids installation to begin with, malware experts would consider it best to stay clear of all Web domains with a protracted history for adware distribution.

Aliases

Search Donkey [Sophos]ApplicUnwnt [Comodo]

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:

D:\Users\<username>\Documents\AdwCleaner\Quarantine\C\ProgramData\InternetUpdater\InternetUpdaterService.exe.vir

File name: InternetUpdaterService.exe.vir
Size: 40.44 KB (40448 bytes)
MD5: e3efa45e92b7f0b3dd9ddbb0b11cb24a
Detection count: 19,329
Mime Type: unknown/vir
Path: D:\Users\<username>\Documents\AdwCleaner\Quarantine\C\ProgramData\InternetUpdater\InternetUpdaterService.exe.vir
Group: Malware file
Last Updated: September 19, 2024

C:\ProgramData\Websteroids\up\2.6.80\Websteroids64.exe

File name: Websteroids64.exe
Size: 42.87 KB (42872 bytes)
MD5: a282253b4754476c1205f9e4946612f6
Detection count: 5,886
File type: Executable File
Mime Type: unknown/exe
Path: C:\ProgramData\Websteroids\up\2.6.80\Websteroids64.exe
Group: Malware file
Last Updated: March 2, 2024

%SYSTEMDRIVE%\AdwCleaner\Quarantine\files\vamttgfyvduaffwtynmrvtjqggporowe\Uninstall.exe

File name: Uninstall.exe
Size: 511.48 KB (511488 bytes)
MD5: aa2202e0b8b025bf72eb36bf09d04ae5
Detection count: 913
File type: Executable File
Mime Type: unknown/exe
Path: %SYSTEMDRIVE%\AdwCleaner\Quarantine\files\vamttgfyvduaffwtynmrvtjqggporowe\Uninstall.exe
Group: Malware file
Last Updated: January 18, 2024

%LOCALAPPDATA%\Mail.Ru\InternetUpdater.exe

File name: InternetUpdater.exe
Size: 33.33 MB (33338912 bytes)
MD5: b8fd9c83d5ca25d2f8c66e15f756dacd
Detection count: 443
File type: Executable File
Mime Type: unknown/exe
Path: %LOCALAPPDATA%\Mail.Ru
Group: Malware file
Last Updated: February 1, 2023

Setup.exe

File name: Setup.exe
Size: 3.99 MB (3999552 bytes)
MD5: b1c348b983eab2f69cb3bad7f1f8772a
Detection count: 63
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: January 8, 2020

D:\Users\<username>\Documents\AdwCleaner\Quarantine\C\ProgramData\Websteroids\IE\common.dll.vir

File name: common.dll.vir
Size: 409.46 KB (409464 bytes)
MD5: 436e7f7918ab94e0f68667393c39d5a0
Detection count: 30
Mime Type: unknown/vir
Path: D:\Users\<username>\Documents\AdwCleaner\Quarantine\C\ProgramData\Websteroids\IE\common.dll.vir
Group: Malware file
Last Updated: December 24, 2021

%ALLUSERSPROFILE%\InternetUpdater\InternetUpdaterService.exe

File name: InternetUpdaterService.exe
Size: 40.44 KB (40448 bytes)
MD5: 0146f56a7aa40a67c017d5bed5340bfc
Detection count: 26
File type: Executable File
Mime Type: unknown/exe
Path: %ALLUSERSPROFILE%\InternetUpdater
Group: Malware file
Last Updated: July 15, 2020

C:\System Volume Information\_restore{D0CB3F2B-88E5-4F4A-84F3-27ECAAC14546}\RP5\A0009040.dll

File name: A0009040.dll
Size: 409.46 KB (409464 bytes)
MD5: ce2024f33ec99c2e797eb989be1075a1
Detection count: 26
File type: Dynamic link library
Mime Type: unknown/dll
Path: C:\System Volume Information\_restore{D0CB3F2B-88E5-4F4A-84F3-27ECAAC14546}\RP5\A0009040.dll
Group: Malware file
Last Updated: April 5, 2022

%ALLUSERSPROFILE%\Websteroids\IE\common.dll

File name: common.dll
Size: 409.46 KB (409464 bytes)
MD5: f7412f6dbea34d777956ec69ac72c769
Detection count: 19
File type: Dynamic link library
Mime Type: unknown/dll
Path: %ALLUSERSPROFILE%\Websteroids\IE
Group: Malware file
Last Updated: June 23, 2014

More files

Registry Modifications

The following newly produced Registry Values are:

CLSID{2830488C-079B-45C2-88B6-AFE4EAA2DF85}{44ed99e2-16a6-4b89-80d6-5b21cf42e78b}{781CA792-9B6E-400B-B36F-15C097D2CA54}File name without pathhttp_d.websteroidsapp.com_0.localstoragehttp_d.websteroidsapp.com_0.localstorage-journalHKEY..\..\..\..{RegistryKeys}Software\Microsoft\Internet Explorer\DOMStorage\d.websteroidsapp.comSoftware\Microsoft\Internet Explorer\DOMStorage\websteroidsapp.comSoftware\Microsoft\Internet Explorer\LowRegistry\DOMStorage\websteroidsapp.comSOFTWARE\Microsoft\Tracing\WebsteroidsService_RASAPI32SOFTWARE\Microsoft\Tracing\WebsteroidsService_RASMANCSSoftware\Microsoft\Windows\CurrentVersion\Ext\Settings\{44ED99E2-16A6-4B89-80D6-5B21CF42E78B}Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{44ED99E2-16A6-4B89-80D6-5B21CF42E78B}Software\Mozilla\Firefox\Extensions\support@websteroidsapp.comSOFTWARE\Wow6432Node\Microsoft\Tracing\WebsteroidsService_RASAPI32SOFTWARE\Wow6432Node\Microsoft\Tracing\WebsteroidsService_RASMANCSSOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{44ed99e2-16a6-4b89-80d6-5b21cf42e78b}SYSTEM\ControlSet001\services\WebsteroidsSYSTEM\ControlSet002\services\WebsteroidsSYSTEM\CurrentControlSet\services\WebsteroidsHKEY_LOCAL_MACHINE\Software\[APPLICATION]\Microsoft\Windows\CurrentVersion\Uninstall..{Uninstaller}Websteroids{D54E3D9F-FEB8-4D2D-A138-B69A5C80080B}

Additional Information

The following directories were created:

%ALLUSERSPROFILE%\Application Data\Websteroids%ALLUSERSPROFILE%\Websteroids