DailyWinner Spyware Profile
Title: DailyWinner
Also Known as: InvisiblePop, Burnaby
Severity scale:
DailyWinner is a Trojan Downloader spyware program created by dailywinner.net. It was first discovered on August 16 in 2004.
DailyWinner tracks your browsing activity and sends your information to dailywinner.net. This website will analyze this data and send you pop-up ads based on your browsing history. It scans each site you visit while you’re there and looks for keywords related to their ads.
It is also set to start when Internet Explorer is started and when Windows is booted. This can make it difficult for some antispyware programs to remove it completely.
The complexity and potential for ruining your computer is too high to try to manually remove DailyWinner. Unless you know what to look for and how to remove it, you may not remove DailyWinner, and it can reinfect your computer this way.
Instead, you should use SpyZooka to remove DailyWinner. It can quickly and completely remove such programs from your computer. You will also not have to worry about a future visit from DailyWinner.
Also Known As:
InvisiblePop, Burnaby,
TargetingSource,
Troj/Ortyc, Cytron,
Trojan-Downloader.Win32.Miewer.d
Associated Files:
systemroot+system32vernn16.dll,
vern16.exe, vernn16.dll, systemroot+systeminvisiblepop.dll,
systemroot+systemprint32.dll, systemroot+systemveg32.dll,
systemroot+system32invisiblepop.dll, systemroot+system32kvern16.dll,
systemroot+system32print32.dll, systemroot+system32veg32.dll,
veg32.dll, vern16.dll, systemroot+system32vernn16.dll,
systemroot+system32veg32.dll, systemroot+system32print32.dll,
systemroot+system32kvern16.dll, systemroot+system32invisiblepop.dll,
systemroot+systemveg32.dll, systemroot+systemprint32.dll,
systemroot+systeminvisiblepop.dll,
HKEY_CLASSES_ROOTclsid {7dd896a9-7aeb-430f-955b-cd125604fdcb},
HKEY_CLASSES_ROOTsoftwaremicrosoftwindowscurrentversionexplorerbrowser helper objects {7dd896a9-7aeb-430f-955b-cd125604fdcb},
HKEY_LOCAL_MACHINEsoftwareclassesclsid {7dd896a9-7aeb-430f-955b-cd125604fdcb},
HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionexplorerbrowser helper objects {7dd896a9-7aeb-430f-955b-cd125604fdcb}
Whenever I launched a site and it was down (e.g. I get that “Cannot find server… The Page Cannot be Displayed” message), a default address automatically populated (www.dailywinner.net/ads/ins.html or similar — sometimes address repeated across the top) repeatedly, creating a flashing effect. Ad-watch/Zone Labs pop-up blockers then eventually shut it down, but then I needed to re-launch explorer. I try to remove it by myself but I cannot locate anyplace to delete that “auto-population” of the “dailywinner” address. Thanks to SpyZooka the things are looking better now.