1. /
  2. Security Response/
  3. Adware.WeirdOnTheWeb

Adware.WeirdOnTheWeb

Updated:
February 13, 2007 11:44:31 AM
Type:
Adware
Risk Impact:
Low
File Names:
weirdontheweb.exe AltPayments.exe
Systems Affected:
Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP

When Adware.WeirdOnTheWeb is executed, it performs the following actions:
  1. Creates the following files:

    • %UserProfile%\Favorites\WeirdOnTheWeb.url
    • %ProgramFiles%\WeirdOnTheWeb\terms.txt
    • %ProgramFiles%\WeirdOnTheWeb\weirdontheweb.exe

      Notes:
    • %UserProfile% is a variable that refers to the current user's profile folder. By default, this is C:\Documents and Settings\[Current User] (Windows NT/2000/XP).
    • %ProgramFiles% is a variable that refers to the program files folder. By default, this is C:\Program Files.

  2. Adds the value:

    "WeirdOnTheWeb" = "C:\Program Files\WeirdOnTheWeb\WeirdOnTheWeb.exe"
    "AltPayments" = "[PATH TO ADWARE]\AltPayments.exe"

    to the registry subkey:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

    so that that the risk runs every time Windows starts.

  3. Creates the following registry subkeys:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WeirdOnTheWeb
    HKEY_LOCAL_MACHINE\SOFTWARE\Revisions
    HKEY_LOCAL_MACHINE\SOFTWARE\AltPayments
    HKEY_LOCAL_MACHINE\SOFTWARE\WeirdOnTheWeb
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DownloadManager


Summary| Technical Details| Removal

Search Threats

Search by name
Example: W32.Beagle.AG@mm
STAR Antimalware Protection Technologies
Internet Security Threat Report
Symantec DeepSight Screensaver