What is WindowPolicies 2.0.2.1?
The Malwarebytes research team has determined that WindowPolicies 2.0.2.1 is adware. These adware applications display advertisements not originating from the sites you are browsing.
How do I know if my computer is affected by WindowPolicies 2.0.2.1?
You may see this warning during install:
How did WindowPolicies 2.0.2.1 get on my computer?
Adware applications use different methods for distributing themselves. This particular one was bundled with other software.
How do I remove WindowPolicies 2.0.2.1?
Our program Malwarebytes Anti-Malware can detect and remove this potentially unwanted program.
- Please download Malwarebytes Anti-Malware to your desktop.
- Double-click mbam-setup-version.exe and follow the prompts to install the program.
- At the end, be sure a check-mark is placed next to the following:
- Enable free trial of Malwarebytes Anti-Malware Premium
- Launch Malwarebytes Anti-Malware
- Then click Finish.
- If an update is found, you will be prompted to download and install the latest version.
- Once the program has loaded, select Scan now. Or select the Threat Scan from the Scan menu.
- When the scan is complete , make sure that everything is set to "Quarantine", and click Apply Actions.
- Reboot your computer if prompted.
- No, Malwarebytes' Anti-Malware removes WindowPolicies 2.0.2.1 completely.
We hope our application and this guide have helped you eradicate this adware application.
As you can see below the full version of Malwarebytes Anti-Malware would have protected you against the WindowPolicies 2.0.2.1 adware. It would have warned you before the application could install itself, giving you a chance to stop it before it became too late.
and it blocks some of the outgoing connections:
Technical details for experts
You may see these signs in FRST logs:
(Policies ) C:\Windows\Temp\PoliciesSetup.exe
() C:\Windows\Temp\is-A8HMT.tmp\PoliciesSetup.tmp
C:\Windows\SysWOW64\Policies2022
C:\Program Files (x86)\WindowPolicies
C:\Windows\SysWOW64\Policies2021
(hxxp://hahomedia.com ) C:\Users\{username}\Desktop\Vinayupdater.exe
Alterations made by the installer:
File system details [View: All details] (Selection)
---------------------------------------------------
In the existing folder C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CONFIG
Adds the file enterprisesec.config.cch"="3/21/2016 8:25 AM, 946 bytes, A
Adds the file security.config.cch"="3/21/2016 8:25 AM, 946 bytes, A
Adds the folder C:\Windows\SysWOW64\Policies2021
Adds the file Policies.exe"="2/11/2016 4:49 PM, 43520 bytes, A
Adds the file Policies.exe.config"="2/10/2016 6:02 PM, 2389 bytes, A
Registry details [View: All details] (Selection)
------------------------------------------------
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Policies_RASAPI32]
"ConsoleTracingMask"="REG_DWORD", -65536
"EnableConsoleTracing"="REG_DWORD", 0
"EnableFileTracing"="REG_DWORD", 0
"FileDirectory"="REG_EXPAND_SZ, "%windir%\tracing"
"FileTracingMask"="REG_DWORD", -65536
"MaxFileSize"="REG_DWORD", 1048576
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Policies_RASMANCS]
"ConsoleTracingMask"="REG_DWORD", -65536
"EnableConsoleTracing"="REG_DWORD", 0
"EnableFileTracing"="REG_DWORD", 0
"FileDirectory"="REG_EXPAND_SZ, "%windir%\tracing"
"FileTracingMask"="REG_DWORD", -65536
"MaxFileSize"="REG_DWORD", 1048576
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\eventlog\Application\Policies]
"EventMessageFile"="REG_EXPAND_SZ, "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\EventLogMessages.dll"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Policies]
"DisplayName"="REG_SZ", "Windows Policies"
"ErrorControl"="REG_DWORD", 1
"ImagePath"="REG_EXPAND_SZ, "C:\Windows\system32\Policies2021\Policies.exe"
"ObjectName"="REG_SZ", "LocalSystem"
"Start"="REG_DWORD", 2
"Type"="REG_DWORD", 16
"WOW64"="REG_DWORD", 1
Malwarebytes Anti-Malware log:Malwarebytes Anti-Malware
www.malwarebytes.org
Scan Date: 3/21/2016
Scan Time: 8:32 AM
Logfile: mbamWindowPolicies2021.txt
Administrator: Yes
Version: 2.2.0.1024
Malware Database: v2016.03.21.01
Rootkit Database: v2016.03.12.01
License: Premium
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled
OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: {username}
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 371311
Time Elapsed: 4 min, 49 sec
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled
Processes: 0
(No malicious items detected)
Modules: 0
(No malicious items detected)
Registry Keys: 3
PUP.Optional.HahoMedia, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{746390A3-6C32-4253-ADDF-8F235AE19E7A}_IS1, Quarantined, [22438703a5f40a2cf349f0a1996be41c],
PUP.Optional.HahoMedia, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\POLICIES, Quarantined, [5b0aacde980151e5865099f227dd8080],
PUP.Optional.HahoMedia, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\SYSSECURE, Quarantined, [8cd9c5c5a2f7de58023b028f07fd2ed2],
Registry Values: 3
PUP.Optional.HahoMedia, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{746390A3-6C32-4253-ADDF-8F235AE19E7A}_is1|URLInfoAbout, http://hahomedia.com, Quarantined, [22438703a5f40a2cf349f0a1996be41c]
PUP.Optional.HahoMedia, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\POLICIES|ImagePath, C:\Windows\system32\Policies2022\Policies.exe, Quarantined, [5b0aacde980151e5865099f227dd8080]
PUP.Optional.HahoMedia, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\SYSSECURE|ImagePath, C:\Windows\SysSecure1.0.0.4\SysSecure.exe, Quarantined, [8cd9c5c5a2f7de58023b028f07fd2ed2]
Registry Data: 0
(No malicious items detected)
Folders: 3
PUP.Optional.Policies, C:\Windows\SysWOW64\Policies2021, Quarantined, [f86d8bffa4f5da5c36807a1792729868],
PUP.Optional.Policies, C:\Windows\SysWOW64\Policies2022, Quarantined, [164f19711188b77fb7ffeca5ed17a957],
PUP.Optional.HahoMedia, C:\Windows\SysSecure1.0.0.4, Quarantined, [3f261e6c3d5cde5855b7a9a41ce98779],
Files: 15
PUP.Optional.HahoMedia, C:\Users\{username}\Desktop\Vinayupdater.exe, Quarantined, [bda824662871ac8a37172fe17c861ae6],
PUP.Optional.Policies, C:\Windows\SysWOW64\Policies2021\Policies.exe.config, Quarantined, [f86d8bffa4f5da5c36807a1792729868],
PUP.Optional.Policies, C:\Windows\SysWOW64\Policies2021\Policies.exe, Quarantined, [f86d8bffa4f5da5c36807a1792729868],
PUP.Optional.Policies, C:\Windows\SysWOW64\Policies2022\Policies.exe.config, Quarantined, [164f19711188b77fb7ffeca5ed17a957],
PUP.Optional.Policies, C:\Windows\SysWOW64\Policies2022\Policies.exe, Quarantined, [164f19711188b77fb7ffeca5ed17a957],
PUP.Optional.HahoMedia, C:\Windows\SysSecure1.0.0.4\SysSecure.exe, Quarantined, [8cd9c5c5a2f7de58023b028f07fd2ed2],
PUP.Optional.HahoMedia, C:\Windows\SysSecure1.0.0.4\SysUtil.dll.config, Quarantined, [3f261e6c3d5cde5855b7a9a41ce98779],
PUP.Optional.HahoMedia, C:\Windows\SysSecure1.0.0.4\msvcr110.dll, Quarantined, [3f261e6c3d5cde5855b7a9a41ce98779],
PUP.Optional.HahoMedia, C:\Windows\SysSecure1.0.0.4\SysSecure.exe.config, Quarantined, [3f261e6c3d5cde5855b7a9a41ce98779],
PUP.Optional.HahoMedia, C:\Windows\SysSecure1.0.0.4\SysUtil.dll, Quarantined, [3f261e6c3d5cde5855b7a9a41ce98779],
PUP.Optional.HahoMedia, C:\Windows\SysSecure1.0.0.4\unins000.dat, Quarantined, [3f261e6c3d5cde5855b7a9a41ce98779],
PUP.Optional.HahoMedia, C:\Windows\SysSecure1.0.0.4\unins000.exe, Quarantined, [3f261e6c3d5cde5855b7a9a41ce98779],
PUP.Optional.HahoMedia, C:\Windows\SysSecure1.0.0.4\Util.dll, Quarantined, [3f261e6c3d5cde5855b7a9a41ce98779],
PUP.Optional.HahoMedia, C:\Windows\SysSecure1.0.0.4\WinDivert.dll, Quarantined, [3f261e6c3d5cde5855b7a9a41ce98779],
PUP.Optional.HahoMedia, C:\Windows\SysSecure1.0.0.4\WinDivert64.sys, Quarantined, [3f261e6c3d5cde5855b7a9a41ce98779],
Physical Sectors: 0
(No malicious items detected)
(end)As mentioned before the full version of Malwarebytes Anti-Malware could have protected your computer against this threat.We use different ways of protecting your computer(s):
- Dynamically Blocks Malware Sites & Servers
- Malware Execution Prevention
Back to top
Sign In
Create Account
