Parasite: DownloadReceiver

This record last updated Tue Sep 20 2005 00:34:15

PLEASE NOTE: Due to the overwhelming extent of this problem and the unbelievable volume of email we have received, we regret that we cannot respond to questions about browser parasites at this time. If you have attempted to contact us about this parasite please accept our apology for not responding. "Thank you's" are always appreciated ;-)

Description

DownloadReceiver was a component used by eAcceleration (Acceleration Software International Corporation) to download and install their Webcelerator software. It also runs an advertising process called systimer.exe, on startup.

The software was discontinued in 2002 and installations should now be dormant.

Also known as

Raven (eAcceleration’s codename for it).

Distribution

Bundled with Direct Connect and older releases of AudioGalaxy Satellite.

What it does

Advertising

Yes. systimer.exe connects to eAcceleration’s servers at buttonware.net every so often to download a list of pop-up adverts and directions as to when to show them.

Privacy violation

No.

Security issues

No.

Stability problems

None known.

Removal

There should be a ‘Download Receiver’ entry in the Control Panel’s Add/Remove Programs option. After removing the software you should be able to delete download.exe, eac_drec.dll and systimer.exe from the eAcceleration folder in Program Files\Common Files. You can delete the folder itself if you have nothing else installed from eAcceleration (eg. eAnthology).

Manual removal

Open a DOS command prompt window (from the Start menu, Programs -> Accessories) and enter the commands:

cd "%WinDir%\System"
regsvr32 /u "C:\Program Files\Common Files\eAcceleration\eac_drec.dll"

You will need to change the path above if your Program Files folder is elsewhere (eg. on a different drive, or a non-English version of Windows where the name is different).

From the Start menu, choose ‘Run’ and enter regedit to edit the registry. Find and delete the keys HKEY_LOCAL_MACHINE\Software\Acceleration Software International Corporation, HKEY_CURRENT_USER\Software\Acceleration Software International Corporation and the entry in HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run that points to systimer. You can then restart the computer and delete the files as above.