What does TR/Dldr.Favadd do?

**Eru** · 28-11-2009

I wanted to know that what does TR/Dldr.Favadd do on the system because when I am scanning my system from the last 2 days, I am getting this alert for TR/Dldr.Favadd virus found on your computer. I also keep getting messages like "a new application has been installed on your system. Do you want to restart your computer now?" I obviously select NO. I suppose this TR/Dldr.Favadd has installed some malicious codes onto my system. I do not know how this infection has entered into my system. Please suggest an eradication technique. I am using Windows XP as my operating system.

**Big Fish** · 28-11-2009

This TR/Dldr.Favadd must have entered into your system when you may have connected any portable to your system or when you may have clicked on some link on the web. I do not know exactly what this TR/Dldr.Favadd does onto the system, but will recommend you to always scan every external you connect to your system. About downloads, I will suggest you from only the genuine sites or from the sites you know. Links that provide patches and such other stuff may all be links to such malicious content on the internet.

**Snake08** · 28-11-2009

The TR/Dldr.Favadd virus is actually a trojan horse code that is written in Delphi (5.0) and it has the size of approximately 40KB when it is packed. I know what such kind of TR/Dldr.Favadd does onto the system. It corrupts the registry and adds special extentions onto the Internet Explorer as follows:
HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerExtensions{10954C80-4F0F-11d3-B17C-00C0DFE39736}]
"ButtonText"="Search cracks at CrackSpider.NET"
"MenuText"="Search cracks at CrackSpider.NET"
"MenuStatusBar"="Search cracks at CrackSpider.NET"
"ClSid"="{1FBA04EE-3024-11d2-8F1F-0000F87ABD16}"
"Exec"="http://crackspider.net/ie/btn.php"
"HotIcon"="%WINDIR%crcspider.ico"
"Icon"="%WINDIR%crcspider.ico"
"Default Visible"="Yes"
You need to install an antivirus like Quick Heal that enables a boot-scan to take place. This is the only eradication technique for this trojan.

**Milton.J** · 28-11-2009

Internet Explorer gets added with the links of TR/Dldr.Favadd. A folder called Freeman CrackLinks is created in Favorites and the links of the hacking sites are added in it. The links are as shown below: