|
Title: WNAD
Type: Adware
Remove WNAD. Removal instructions
Severity scale:
 (30 / 100)
WNAD properties: • Changes browser settings • Shows commercial adverts • Hides from the user • Stays resident in background Automatic WNAD removal: 
We are testing STOPzilla's efficiency at removing WNAD
(2012-02-11 03:01:47)
We are testing Malwarebytes Anti Malware's efficiency at removing WNAD
(2012-02-11 03:01:47)
We are testing Spyware Doctor's efficiency at removing WNAD
(2012-02-11 03:01:47)
WNAD manual removal:Kill processes:osama.exe, wnad.exe Delete registry values: HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\wnad Delete files: osama.exe, wnad.exe Delete directories: \osama 
Information added: 2004-03-19 10:00:00
Information updated: 2012-02-11 00:24:32 Additional resources related to WNAD:Attention: If you know or you have a website or page about WNAD removal, feel free to add a link to this list: add url |
Latest spyware news:
Subscribe to news
Similar parasites:
|
FORUM:
HELP:
Spreading the knowledge:
It is very hard to fight Computer parasites alone in internet space. If you have a website we would be more than happy if you would help us to spread the knowledge about latest threats. You can help your
visitors to manage their Computer system manually without aditional expences. Knowledge is the power, we just need to spread it.
wnad.exe
wnad.dat
wnad-update.exe
The program may also write a wnad.log file.
It then adds a registry key in HKEY_LOCAL_MACHINESoftwareMicrosfotWindowsCurrentVersionRun so that wnad.exe is executed every time the computer is started.
Upon successful install, wnad.exe initiates a connection to www.twistedhumor1.com that appears to be a sort of 'registration' for the program via SSL:
https://www.twistedhumor1.com/addorder.asp?a=0.02&c=1033145308-548335&b=confirm
It creates and transmits a GUID. The wnad.exe software then performs a key exchange with the server and transmits encrypted (SSLv3) information. We are presently unable to decrypt this transmission.
As directed by its controlling servers, the software may enter a 'sleep mode' for at least ten days after its initial installation. During this sleep mode, it will 'lay low' by not displaying ads.
During normal operation, the program will contact Web sites including, but not limited to, the following for the purpose of downloading advertising for display, and for obtaining configuration/display instructions:
www.rankyou.com
www.twistedhumor.com
www.srv2cpt.com
The wnad.exe program is coded to detect Web browsers installed on your system, most likely to coordinate the opening of new popups with Web browser activity. The version we examined looks for iexplore.exe (Internet Explorer), netscape.exe (Netscape Navigator), and AOL.exe (AOL browser/software).
The path to each program is taken from the Registry keys under HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionApp Paths
The program may also attempt to alter the 'Open' command for the browser so that it loads a page of advertising when opened.
Post Comment: