Jump to content

Recommended Posts

  • Staff

What is WindoWeather?

The Malwarebytes research team has determined that WindoWeather is adware. These adware applications display advertisements not originating from the sites you are browsing.

How do I know if my computer is affected by WindoWeather?

You may see this entry in your list of installed programs:

warning4.png

and this warning during install:

warning1.png

and this icon in your start menu:

icons.png

How did WindoWeather get on my computer?

Adware applications use different methods for distributing themselves. This particular one was bundled with other software.

How do I remove WindoWeather?

Our program Malwarebytes Anti-Malware can detect and remove this potentially unwanted program.

  • Please download Malwarebytes Anti-Malware to your desktop.
  • Double-click mbam-setup-version.exe and follow the prompts to install the program.
  • At the end, be sure a check-mark is placed next to the following:
    • Enable free trial of Malwarebytes Anti-Malware Premium
    • Launch Malwarebytes Anti-Malware
  • Then click Finish.
  • If an update is found, you will be prompted to download and install the latest version.
  • Once the program has loaded, select Scan now. Or select the Threat Scan from the Scan menu.
  • When the scan is complete , make sure that everything is set to "Quarantine", and click Apply Actions.
  • Reboot your computer if prompted.
Is there anything else I need to do to get rid of WindoWeather?How would the full version of Malwarebytes Anti-Malware help protect me?

We hope our application and this guide have helped you eradicate this adware application.

As you can see below the full version of Malwarebytes Anti-Malware would have protected you against the WindoWeather adware. It would have warned you before the application could install itself, giving you a chance to stop it before it became too late.

protection1.png

Technical details for experts

You will see these signs in a HijackThis log:

O4 - HKLM\..\Run: [WindoWeather] "C:\Program Files (x86)\WindoWeather\WindoWeather.exe" monetize
You may see these signs in FRST logs:

 HKLM-x32\...\Run: [WindoWeather] => C:\Program Files (x86)\WindoWeather\WindoWeather.exe [3158016 2015-12-24] (WindoWeather) C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WindoWeather C:\Program Files (x86)\WindoWeatherWindoWeather 1.0 (HKLM-x32\...\WindoWeather) (Version: 1.0 - WindoWeather)
Alterations made by the installer:

File system details [View: All details] (Selection)---------------------------------------------------    Adds the folder C:\Program Files (x86)\WindoWeather       Adds the file uninst.exe"="31/12/2015 10:21, 104502 bytes, A       Adds the file WindoWeather.exe"="24/12/2015 16:04, 3158016 bytes, A    Adds the folder C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WindoWeather       Adds the file WindoWeather.lnk"="31/12/2015 10:21, 1091 bytes, ARegistry details [View: All details] (Selection)------------------------------------------------    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System]       "EnableLUA"=REG_DWORD, 0    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\WindoWeather\ExploreTech]       "(Default)"="REG_SZ", ""    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\WindoWeather\WindoWeather]       "(Default)"="REG_SZ", ""    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]       "WindoWeather"="REG_SZ", ""C:\Program Files (x86)\WindoWeather\WindoWeather.exe" monetize"    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WindoWeather]       "DisplayIcon"="REG_SZ", "C:\Program Files (x86)\WindoWeather\WindoWeather.exe"       "DisplayName"="REG_SZ", "WindoWeather 1.0"       "DisplayVersion"="REG_SZ", "1.0"       "Publisher"="REG_SZ", "WindoWeather"       "UninstallString"="REG_SZ", "C:\Program Files (x86)\WindoWeather\uninst.exe"       "URLInfoAbout"="REG_SZ", "www.windoweather.com"    [HKEY_CURRENT_USER\Control Panel\Desktop]       "HungAppTimeout"="REG_SZ", "0"       "WaitToKillAppTimeout"="REG_SZ", "0"
Malwarebytes Anti-Malware log:

Malwarebytes Anti-Malwarewww.malwarebytes.orgScan Date: 31/12/2015Scan Time: 10:30Logfile: mbamWindoWeather.txtAdministrator: YesVersion: 2.2.0.1020Malware Database: v2015.12.31.02Rootkit Database: v2015.12.26.01License: PremiumMalware Protection: EnabledMalicious Website Protection: EnabledSelf-protection: DisabledOS: Windows 7 Service Pack 1CPU: x64File System: NTFSUser: {username}Scan Type: Threat ScanResult: CompletedObjects Scanned: 313895Time Elapsed: 5 min, 27 secMemory: EnabledStartup: EnabledFilesystem: EnabledArchives: EnabledRootkits: EnabledHeuristics: EnabledPUP: EnabledPUM: EnabledProcesses: 0(No malicious items detected)Modules: 0(No malicious items detected)Registry Keys: 1PUP.Optional.WindoWeather, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\WindoWeather, Quarantined, [841a1f8ce5a61422283000c930d120e0], Registry Values: 1PUP.Optional.WindoWeather, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|WindoWeather, "C:\Program Files (x86)\WindoWeather\WindoWeather.exe" monetize, Quarantined, [108e58533e4d55e13678252ed828ca36]Registry Data: 0(No malicious items detected)Folders: 1PUP.Optional.WindoWeather, C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WindoWeather, Quarantined, [227c0d9e543786b0711f63b71ce815eb], Files: 4PUP.Optional.WindoWeather, C:\Program Files (x86)\WindoWeather\WindoWeather.exe, Quarantined, [108e58533e4d55e13678252ed828ca36], PUP.Optional.WindoWeather, C:\Users\{username}\Desktop\WindoWeather_Setup.exe, Quarantined, [eeb03873711ae84e3d1bc603c63b7e82], PUP.Optional.WindoWeather, C:\Program Files (x86)\WindoWeather\uninst.exe, Quarantined, [841a1f8ce5a61422283000c930d120e0], PUP.Optional.WindoWeather, C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WindoWeather\WindoWeather.lnk, Quarantined, [227c0d9e543786b0711f63b71ce815eb], Physical Sectors: 0(No malicious items detected)(end)
As mentioned before the full version of Malwarebytes Anti-Malware could have protected your computer against this threat.

We use different ways of protecting your computer(s):

  • Dynamically Blocks Malware Sites & Servers
  • Malware Execution Prevention
Save yourself the hassle and get protected.
Link to post
Share on other sites

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.