About DownloadPlus

Also known as: TrojanDownloader.Win32.Lalus

Variant: DownloadPlus.MCInst

DownloadPlus is a process run at Windows startup which opens pop-up adverts (many of them porn-related) and, for some reason, weather reports.

DownloadPlus.MCInst is an ActiveX installer control for the main DownloadPlus program.

The code for the MCInst variant is derived from the Xupiter/Sqwire parasite; it is suspected the same people may be behind DownloadPlus as Xupiter.

Removal Instructions

Automatic Removal:

DownloadPlus can be detected and removed Automatically by Spyware Doctor, also SpyEraser.

Manual Removal:

Follow these steps to remove DownloadPlus from your machine. Begin by backing up your registry and your system, and/or setting a Restore Point, to prevent trouble if you make a mistake.

1. Kill these running processes with Task Manager:

   profilepath+\application data\downloadplus.exe
   profilepath+\local settings\temporary internet files\content.ie5\8blz6av5\msgcenter_lminv1[1].exe
   profilepath+\local settings\temp\msgcenter_lminv1.exe
   systemroot+\msgcenter_lminv1.exe
   installer.exe
   invictus_04262003.exe
   updatemedia.exe

2. Unregister these DLLs with Regsvr32, then reboot:

   medup012.dll
   medup020.dll

3. Remove these registry items (if present) with RegEdit:

   HKEY_CURRENT_USER\software\0x7a69

4. Remove these files (if present) with Windows Explorer:

   profilepath+\application data\downloadplus.exe
   profilepath+\local settings\temporary internet files\content.ie5\8blz6av5\msgcenter_lminv1[1].exe
   profilepath+\local settings\temp\msgcenter_lminv1.exe
   profilepath+\start menu\programs\startup\download plus.lnk
   systemroot+\msgcenter_lminv1.exe
   inctrl.log
   install.log
   installer.exe
   invictus_04262003.exe
   medup012.dll
   medup020.dll
   muconf.xml
   updatemedia.exe
   urunet.ini

Removal Instructions for Other Adwares & Spywares