What is “PUP.Optional.LyricsAd”?

The PUP.Optional.LyricsAd is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What PUP.Optional.LyricsAd virus can do?

Sample contains Overlay data
Reads data out of its own binary image
Drops a binary and executes it
Authenticode signature is invalid
Attempts to modify proxy settings
Creates a copy of itself
Deletes executed files from disk

How to determine PUP.Optional.LyricsAd?


File Info:
name: 34FB227E57240300CD82.mlw
path: /opt/CAPEv2/storage/binaries/52c108989523c61181f389b047e62088a0ae728abfa196ceb10a048714a98b18
crc32: F0EFF296
md5: 34fb227e57240300cd823cbdd3d8a913
sha1: 07bcf2d72c015086b8fdeec2f69e673ab02dd2e2
sha256: 52c108989523c61181f389b047e62088a0ae728abfa196ceb10a048714a98b18
sha512: f6a78596bf0b06585168625fe2775df17ddfe87e95e5390f1ca349d158b6b3288cf33398ba2d488096ec3469f8fdbec1eafd1d604a8b79b6759d31500af517fd
ssdeep: 3072:rQIURTXJNzw9WLaJyEN/lg8W8iQLVSiFcIYv5:rs89w58W+ciFRYv5
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T12BE3F15A7AC2D47BE217063006BBDF39A3B7EB162745060B5B843F5F29A31439A1D393
sha3_384: 357273bb5d0ecc841c64e791084ccda5208eda88c8717c750a484aaaa5666a3b62651cab5aac9390e61dfa47cc40a0f5
ep_bytes: 81ec8001000053555633db57895c2418
timestamp: 2009-06-06 21:41:54

Version Info:
FileDescription: FoxyLyrics
FileVersion: 1.127.0.0
LegalCopyright: Copyright 2013
Translation: 0x0000 0x04e4

PUP.Optional.LyricsAd also known as:

Lionic	Riskware.Win32.Generic.1!c
Elastic	malicious (high confidence)
Cylance	unsafe
CrowdStrike	win/grayware_confidence_100% (D)
BitDefenderTheta	Gen:NN.ZedlaF.36680.iu4@aOiqbjei
Cynet	Malicious (score: 100)
APEX	Malicious
NANO-Antivirus	Riskware.Nsis.AddLyrics.ejtyot
SUPERAntiSpyware	Adware.Shopper
Sophos	Generic ML PUA (PUA)
F-Secure	Adware.ADWARE/ConvertAd.Gen7
DrWeb	Trojan.Lyrics.2307
Avira	ADWARE/ConvertAd.Gen7
Antiy-AVL	GrayWare[AdWare]/NSIS.AddLyrics.vh
Kingsoft	malware.kb.a.921
Xcitium	Application.Win32.AddLyrics.B@51a33h
Malwarebytes	PUP.Optional.LyricsAd
Rising	Trojan.Generic@AI.98 (RDML:eaxyHkH65tw0QCkYhoHPDQ)
Fortinet	W32/Lyrics.BCOH!tr

How to remove PUP.Optional.LyricsAd?

PUP.Optional.LyricsAd removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X