Osama shooting gallery cleverly disguised adware Trojan

About.com ^

[ChadsDad]

Yo Mama, Osama
Osama shooting gallery cleverly disguised adware Trojan
Related Resources • Virus Encyclopedia • Glossary of terms   Several complaints to newsgroups indicate an adware Trojan created by Twistedhumor.com is being distribued in their popular Yo Mama Osama shooting game. This online game promises a free cell phone booster to players successfull in "taking out" Osama bid Ladin. What they don't realize is they may be "taking in" an adware Trojan that allegedly monitors Internet useage and feeds pop-up advertising to the user long after the game is over. According to complaints, uninstalling Yo Mama Osama removes the game and leaves the offensive adware. When installing Yo Mama Osama for game play, files specific to the adware Trojan are downloaded and installed on the user's system. These include WNAD.EXE, WNAD.DAT, WNAD-UPDATE.EXE and WNAD.LGC. These files are placed in the Windows folder and a shortcut to WNAD.EXE is added to the Startup folder. Removing the Adware Uninstalling the game will not remove the adware Trojan. The following steps should be taken for manual removal. Press CTRL-ALT-DEL and use End Task to close WNAD.EXE Browse to the Windows folder and delete WNAD.EXE, WNAD.DAT, WNAD-UPDATE.EXE and WNAD.LGC Remove the C:\Windows\Wnad.exe value from the following Registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Delete the shortcut for WNAD.EXE from the Start | Programs | Startup Folder In a press release announcing the game, Twistedhumor.com described the "Yo Mama, Osama!" game as a means to raise charitable contributions for the American Red Cross September 11 Fund. What the press release doesn't describe is how that money is being raised. Presumably, since game play is free, the funds are raised through the advertising being surreptitiously slipped to the user. Officials at Twistedhumor.com did not respond to requests for information.

[aomagrat]

So that's why norton anti-virus wouldn't let me play it!

[EggsAckley]

I was sick of the stupid pop-ups on certain pages (including Lucianne.com!) and installed the pop-up stopper, from panicware.com. Works great. It even makes a bug zapper sound when it zaps a pop-up.

[Hank Hill]

ping

[buickmackane]

Yeah, I use the Pop-Up Stopper at home and Zero Pop-Up at work. Thanks for the heads-up; I searched my hard drive and was relieved to find it clean. I did play that "Osama bin Laden Liquors" game and wasn't sure if it had affected me in anyway. I think it's vile to sneak those files into a game!

[Cicero]

The best way to remove most advertizing spyware is to install Lavasoft Ad-Aware, which can be found at http://www.lavasoftUSA.com . It's a nice little program.

[afraidfortherepublic]

filing at tech_index

[quietolong]

bump

[ChadsDad]

info bump

[HighWheeler]

Another fine non-political reason to keep FR as your home page: Virus and trojan notification and elimination. Thanks for the heads up.

[Musket]

Once again, happy I have a Mac! (tee-hee-hee).