Threat Explorer

The Threat Explorer is a comprehensive resource consumers can turn to for daily, accurate, up-to-date information on the latest threats, risks and vulnerabilities.

Adware.MemoryMeter

Adware.MemoryMeter

Updated:
February 13, 2007
Publisher:
Total Velocity
Risk Impact:
Medium
File Names:
MSMGT.exe
Systems Affected:
Windows

Behavior


Adware.MemoryMeter is a program that creates a connection to a server, from which it downloads and displays advertisements.

Symptoms


The files on the system are detected as Adware.MemoryMeter. There are connection attempts to totalvelocity.com or c.centralmedia.ws.

Behavior


This adware must be manually installed. However, there are several known programs that have Adware.MemoryMeter inside of them, and that install it as the program itself is installed.

Antivirus Protection Dates

  • Initial Rapid Release version October 02, 2014 revision 022
  • Latest Rapid Release version July 14, 2017 revision 005
  • Initial Daily Certified version September 07, 2003
  • Latest Daily Certified version July 14, 2017 revision 008
  • Initial Weekly Certified release date September 10, 2003
Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.

When you install Aware.MemoryMeter, it displays an End User License Agreemant (EULA) that includes the following text:

"Furthermore, by installing the Software on your computer, you understand that:
(i) certain system non-personally identifiable information, including statistical data, stored on your computer will be made available and transmittable to Total Velocity servers or the servers of affiliated companies of Total Velocity;
(ii) other information available now or in the future including links, services, messages advertisements, cookies and the like may be installed on your computer and;
(iii) Total Velocity may automatically transmit to and install on your computer, Software improvements, corrections, adaptations, conversions to more recent Software versions or any other changes to the Software, with or without giving notice."

If you agree to accept this, Adware.MemoryMeter creates several registry keys to ensure that it is memory-resident, and that it runs each time you start Windows.

These can include the modifications to or the creation of the following keys:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MemoryMeter

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MSMGT

When the program is running, it periodically contacts the Total Velocity servers, looking for updates or further instructions.





Note: Removing this adware component from the system will likely cause the program that installed it to not function as intended. The uninstaller generally identifies the programs that will not work after uninstallation.
  1. Update the virus definitions.
  2. Restart the computer in Safe mode or VGA mode.
  3. Uninstall "Memory Meter" and "TV Media" using the Add/Remove Programs utility.
  4. Run a full system scan and delete all the files detected as Memory Meter.
  5. Delete the value that was added to the registry.
For specific details on each of these steps, read the following instructions.

1. Updating the virus definitions
Symantec Security Response fully tests all the virus definitions for quality assurance before they are posted to our servers. There are two ways to obtain the most recent virus definitions:
  • Running LiveUpdate, which is the easiest way to obtain virus definitions: These virus definitions are posted to the LiveUpdate servers once each week (usually on Wednesdays), unless there is a major virus outbreak. To determine whether definitions for this threat are available by LiveUpdate, refer to the Virus Definitions (LiveUpdate).
  • Downloading the definitions using the Intelligent Updater: The Intelligent Updater virus definitions are posted on U.S. business days (Monday through Friday). You should download the definitions from the Symantec Security Response Web site and manually install them. To determine whether definitions for this threat are available by the Intelligent Updater, refer to the Virus Definitions (Intelligent Updater).

    The Intelligent Updater virus definitions are available: Read "How to update virus definition files using the Intelligent Updater" for detailed instructions.

2. To restart the computer in Safe mode or VGA mode
Shut down the computer and turn off the power. Wait for at least 30 seconds, and then restart the computer in Safe mode or VGA mode.
  • For Windows 95, 98, Me, 2000, or XP users, restart the computer in Safe mode. For instructions, read the document, "How to start the computer in Safe Mode."
  • For Windows NT 4 users, restart the computer in VGA mode.

3. Uninstalling the Adware
  1. Do one of the following:
    • On the Windows 98 taskbar:
      1. Click Start > Settings > Control Panel.
      2. In the Control Panel window, double-click Add/Remove Programs.

    • On the Windows Me taskbar:
      1. Click Start > Settings > Control Panel.
      2. In the Control Panel window, double-click Add/Remove Programs.
        If you do not see the Add/Remove Programs icon, click "...view all Control Panel options."

    • On the Windows 2000 taskbar:
      By default, Windows 2000 is set up the same as Windows 98. In that case, follow the Windows 98 instructions. Otherwise, click Start, point to Settings, point to Control Panel, and then click Add/Remove Programs.

    • On the Windows XP taskbar:
      1. Click Start > Control Panel.
      2. In the Control Panel window, double-click Add or Remove Programs.

  2. Click Memory Meter.


    Note: You may need to use the scroll bar to view the whole list.

  3. Click Add/Remove, Change/Remove, or Remove (this varies with the operating system). Follow the prompts.

  4. Repeat steps B and C for "TV Media," if found.

4. Scanning for and deleting the infected files
  1. Start your Symantec antivirus program and make sure that it is configured to scan all the files.
  2. Run a full system scan.
  3. If any files are detected as infected with Adware.MemoryMeter, click Delete.


5. Deleting the value from the registry

CAUTION : Symantec strongly recommends that you back up the registry before making any changes to it. Incorrect changes to the registry can result in permanent data loss or corrupted files. Modify the specified keys only. Read the document, "How to make a backup of the Windows registry ," for instructions.
  1. Click Start, and then click Run. (The Run dialog box appears.)
  2. Type regedit

    Then click OK. (The Registry Editor opens.)

  3. Navigate to the key:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

  4. In the right pane, delete and values pertaining to "Memory Meter."

  5. Exit the Registry Editor.
  6. Restart the computer in Normal mode. For instructions, read the section on returning to Normal mode in the document, "How to start the computer in Safe Mode."