Name: DownloadPlus Category: Adware Alias: DownloadPlus MessageCenter, CostaSoft, TrojanDownloader.Win32.Lalus, MessageCenter Advice: Remove Risk: Elevated Risk Elevated threats are usually threats that fall into the range of adware in which data about a user's habits are tracked and sent back to a server for analysis without your consent or knowledge. Description: DownloadPlus is a process run at Windows startup which opens porn-related pop-up advertisements. The code for the MCInst variant is derived from the Xupiter threat; it is suspected the same people may be behind DownloadPlus as Xupiter. DownloadPlus is installed by ActiveX drive-by download in pop-up ads. DownloadPlus downloads an untargeted list of adverts to show from its controlling server tnc4u.com, and opens them periodically as pop-unders. Signatures: process: invictus_04262003.exe: MD5 Hash: bafcd491f6c8b45b465... process: msgcenter_lminv1.exe: MD5 Hash: 032f7bef1d577c0af78... process: updatemedia.exe: MD5 Hash: 4c4bd19453367c037ae... process: downloadplus.exe: MD5 Hash: c5e616ef074ed18e44a... process: msgcenter_lminv1[1].exe: MD5 Hash: ... process: msgcenter_lminv1.exe: MD5 Hash: ... process: DownloadPlus.exe: MD5 Hash: ... process: downloadplus.exe: MD5 Hash: af821314dabebe2c2a7.. Type: Adware - Adware is generally software that displays advertisements. Some advertisers may covertly install adware on your system and generate a stream of unsolicited advertisements that can clutter your desktop and affect your productivity. The advertisements may also contain pornographic or other material that you might find inappropriate. The extra processing required to track you or to display advertisements can tax your computer and hurt your system performance.