Content

Adware-SmartPops.dldr

Type
Program
SubType
Downloader
Discovery Date
06/03/2005
Minimum DAT
4506 (06/03/2005)
Updated DAT
4506 (06/03/2005)
Minimum Engine
5.1.00
Description Added
06/03/2005
Description Modified
03/01/2006 9:01 PM (PT)

Tab Navigation

Characteristics

McAfee(R) AVERT™ recognizes that this program may have legitimate uses in contexts where an authorized administrator has knowingly installed this application. If you agreed to a license agreement for this, or another bundled application, you may have legal obligations with regard to removing this software, or using the host application without this software. Please contact the software vendor for further information.

See http://vil.nai.com/vil/DATReadme.asp for a list of Program detections added to the DATs.

See http://vil.nai.com/vil/pups/configuration.htm for information about how to enable, disable, and exclude detection of legitimately installed programs.

Summary:

This is not a virus or Trojan. It is an adware downloader. Upon execution, it makes internet connections with weirdontheweb.net and downloads adware related components on the system. The downloaded files are responsible for adding a BHO in the internet explorer. While browsing, it contacts various servers such as track.aadserver.net, targetnetworks.net, and shows popup ads such as one shown below:   

      

Privacy:

No license agreement is displayed during installation, although one could be displayed by another installer if bundled with another application. No privacy policy related to the software could be found.

Installation:

File name: weirdontheweb.exe
MD5Hash: 64a940eb2d505883a60bb44f9dc51b25

Upon executing the application, following files are added: (Name and the location of the files may vary)

  • htyglspfqn.dll
  • htyglspfqn.exe

Following registries are added: (these may vary)

  • HKEY_CLASSES_ROOT\CLSID\
    {00c8d031-a800-6aa5-3400-37d466383739}
  • HKEY_CLASSES_ROOT\CLSID\
    {2a99f450-0068-1ce4-bd00-ce1bf00ff514}
  • HKEY_CLASSES_ROOT\CLSID\
    {2d88f655-2969-1be8-ba0f-cc12f80cf21e}
  • HKEY_CLASSES_ROOT\CLSID\
    {35fae400-9033-5f92-0031-00e155000000}
  • HKEY_CLASSES_ROOT\CLSID\
    {36ccfa4e-e41f-8bcc-380f-60e3706f4150}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
    CurrentVersion\Explorer\Browser Helper Objects\
    {2A99F450-0068-1CE4-BD00-CE1BF00FF514}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
    CurrentVersion\Uninstall\CDM
    HKEY_LOCAL_MACHINE\SOFTWARE\NP
  • HKEY_LOCAL_MACHINE\SOFTWARE\WeirdOnTheWeb

Aliases

Aliases

  • Adware.WeirdOnTheWeb: Symantec
  • Adware.Win32.WeirWeb.a: Kaspersky