[prev in list] [next in list] [prev in thread] [next in thread] 

List:       focus-virus
Subject:    RE: wnad.exe
From:       Brian McWilliams <bmcw () mediaone ! net>
Date:       2001-10-31 17:40:30
[Download RAW message or body]

This article might be helpful too:

Bin Laden Game's Adware Annoys Users
http://www.newsbytes.com/news/01/171646.html

Includes a link to a removal tool.

Brian

At 09:52 PM 10/29/01, Doug Schlachta wrote:
>Name: WNAD
>
>Characteristics:
>This is an AdWare program which gets installed when the "Yo Mama, Osama!"
>game is installed. It is a memory resident application which periodically
>connects to a webserver to download and display pop-up window
>advertisements. It creates a registry run key to load itself at startup
>and does not uninstall itself:
>HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WNAD
>Detection of this program was initially added to the 4166 DAT files as the
>WinAd Trojan. It was later discovered that the "Yo Mama, Osama!" installer
>required users to agree to the terms of the program which include the
>installation of this adware. As such, trojan detection of the program was
>removed in the 4167 DAT files. For those wishing to remove this program,
>manual removal instructions are provided below and the command line
>scanner will detect/remove this program as Application WNAD when including
>the /PROGRAM switch.
>
>To check your system for this Program, and to learn how to protect
>yourself from computer viruses, visit the McAfee.com Clinic at
>http://clinic.mcafee.com/clinic/ibuy/campaign.asp?cid=2103.
>
>For complete information on this Program, view McAfee.com's Virus
>Information Library listing at
>http://vil.mcafee.com/dispVirus.asp?virus_k=99236.
>
>Hope this helps you.
>
>Doug Schlachta
>
>
> > -----Original Message-----
> > From: Nissa Moore - ISSM [mailto:mooren@spawar.navy.mil]
> > Sent: Monday, October 29, 2001 6:21 PM
> > To: focus-virus@securityfocus.com
> > Subject: wnad.exe
> >
> >
> >
> > We run Norton Corporate Edition 7.5x.
> >
> > On Friday our scan picked up and quarantined wnad.exe
> > on 2 computers.
> >
> > When I looked on the symantec site though there wasn't anything
> > that correlated to wnad.exe
> >
> > Has anyone heard of wnad??
> >
> > If so, where can I find more information??
> >
> >
> >
> >
> >
> > --
> > N.Moore
> >

[prev in list] [next in list] [prev in thread] [next in thread]