Adware.WeirdOnTheWeb

Updated: February 13, 2007 11:44:31 AM

Type: Adware

Risk Impact: Low

File Names: weirdontheweb.exe AltPayments.exe

Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP

When Adware.WeirdOnTheWeb is executed, it performs the following actions:

Creates the following files:
- %UserProfile%\Favorites\WeirdOnTheWeb.url
- %ProgramFiles%\WeirdOnTheWeb\terms.txt
- %ProgramFiles%\WeirdOnTheWeb\weirdontheweb.exe
  
  Notes:
- %UserProfile% is a variable that refers to the current user's profile folder. By default, this is C:\Documents and Settings\[Current User] (Windows NT/2000/XP).
- %ProgramFiles% is a variable that refers to the program files folder. By default, this is C:\Program Files.
Adds the value:

"WeirdOnTheWeb" = "C:\Program Files\WeirdOnTheWeb\WeirdOnTheWeb.exe"
"AltPayments" = "[PATH TO ADWARE]\AltPayments.exe"

to the registry subkey:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

so that that the risk runs every time Windows starts.
Creates the following registry subkeys:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WeirdOnTheWeb HKEY_LOCAL_MACHINE\SOFTWARE\Revisions HKEY_LOCAL_MACHINE\SOFTWARE\AltPayments HKEY_LOCAL_MACHINE\SOFTWARE\WeirdOnTheWeb HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DownloadManager

Summary

Search Threats

Search by name

_{Example: W32.Beagle.AG@mm}