Dlguide

Overview

Adware:Win32/DownloadGuide is a deceptive bundleware downloader that masquerades as a legitimate download manager to silently install Potentially Unwanted Programs (PUPs).

Understanding DownloadGuide
To the average user, DownloadGuide appears to be a helpful utility that facilitates the downloading of large files or software. For security analysts, it is a deceptive conduit for adware. It is specifically engineered to wrap legitimate software installers in a proprietary wrapper that injects secondary, unwanted payloads (like toolbars, optimizers, and crypto-miners) during the installation process.

Execution and Evasion Strategies
DownloadGuide is often encountered on third-party software hosting sites (e.g., CNET Download or SourceForge historical wrappers). When a user clicks a download link, they receive the DownloadGuide executable instead of the requested software. Upon execution, the wrapper initiates a C2 connection to retrieve the latest list of affiliate adware. It uses Dark Patterns in its UI—pre-checked boxes, hidden 'Advanced' menus, and misleading 'Accept' buttons—to trick the user into authorizing the installation of the PUPs alongside the desired software.

Indicators of Compromise (IoCs)
Incident responders should look for anomalous HTTP/HTTPS traffic to known PPI (Pay-Per-Install) networks during software installations. EDR tools frequently flag DownloadGuide due to its behavior of dropping multiple unassociated executables into the <code>%Temp% directory and rapidly executing them. The ultimate impact is a severely bloated endpoint, reduced performance, and an expanded attack surface.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1105: Implement network intrusion detection systems (NIDS) and host-based firewalls to block unauthorized inbound or outbound file transfers.

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_DLGUIDE {
    meta:
        description = "Detects Dlguide (pua)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "dlguide" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Dlguide Activity
id: 16da2ff8e232784dfe3ae33b78450bab
status: experimental
description: Detects generic indicators of the dlguide malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*dlguide*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Quarantine the endpoint to halt the ongoing downloading of secondary adware modules.
2. Audit the 'Add/Remove Programs' list and uninstall the DownloadGuide utility and any software installed at the exact same timestamp.
3. Clear the Windows <code>%Temp%</code> directory, as DownloadGuide uses this location to stage its malicious payloads.
4. Utilize an enterprise anti-malware scan to ensure no high-severity threats (like information stealers) were bundled with the adware.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not allow users to download software from third-party aggregators; enforce strict application whitelisting.
2. Avoid treating DownloadGuide as a simple annoyance; the affiliate networks it contacts are known to drop banking trojans.

References & External Analysis

• Search "dlguide" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: pua)

Explore other malware families in the same category:

• Dlsponsor
• Vittalia
• Csdimonetize
• Ibryte
• Mailru

Machine-readable

Get this profile as JSON: https://jordan123234-malware-families-explorer.static.hf.space/api/dlguide.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.