Threat Encyclopedia

Selected viruses, spyware, and other threats: sorted alphabetically

Win32/Adware.MetaDirect.B

This Adware will show popup advertisements when the user is viewing content related to the advertised product, and then hide the popup if the content is not related to the advertised product.

Installation and Autostart Techniques

Win32.Adware.MetaDirect.B is usually bundled with other applications. The installation techniques may vary slightly in other adware bundles that include this threat.

Note: By default this Adware copies its Dynamic Link Library (DLL) into the %Windows% folder. The DLL is sometimes named "wildapp.dll". The size of this DLL may vary but should be around 130.000 Bytes (130 KB). During Analysis, this DLL had an exact file size of 131.072 Bytes in uncompressed format (not runtime packed)

If this adware was installed by ActiveX controls (from a web site) there is usually an INI file from the adware setup under "%Windows%\Downloaded Program Files\" This INI file is useful when manually removing this threat.

History: Analysis and Write-up by: Michael St. Neitzel