Trojans are malicious applications that pose themselves as legitimate software in order to trick users to install them. Once on the victim's machine, it may run any number of malicious process to steal vital information or inflict damage to other software.
Official
Description:
Surferbar is an Internet Explorer toolbar that might be associated with a new version of a trojan horse program called AFlooder. It appears to be an ActiveX drive-by download. Isets your homepage to their website along with displaying popup ads.
Comment:
- The old homepage at surferbar.com seems to have died.
- The new AFlooder variant is an irc trojan/spybot that uses worm techniques to spread to machines via web pages. It is apparently coded to have qualities of remote access trojans, IRC bots, keyloggers, and even seems to have the capability to carry out DDoS attacks if the owner orders it to. It uses an exploit to write and execute its' injector program to machines without the user's acceptance or knowledge, then it uses NTFS's alternate file streams to hide itself where there's very little chance of finding it -- in the actual windows folder system32.
Information
URL:
http://www.adbars.com
Manual
removal:
Follow these steps in removing the Surferbar toolbar. To complete these steps you may have to Start in Safe Mode, however by terminating the running program you should be able to complete the steps normally.
1) Terminate the running program
Open the Windows Task Manager by either pressing CTRL+ALT+DEL on Win9x machines or CTL+Shift+Tab and clicking on the Processes tab on WinNT/2000/XP machines.
Locate the following program, click on it and End Task or End Process
winsrv32.exe
or
wins32.exe (2nd variation)
Close Task Manager
2) Remove the Registry entries
Click on Start, Run, Regedit
In the left panel go to
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
In the right panel, right-click and delete the following entry
c:\program files\winsrv32.exe
or
c:\program files\wins32.exe
Close the Registry Editor
3) Delete the infected files (for Windows ME and XP remember to turn off System Restore before searching for and deleting these files to remove infected backed up files as well).
Click Start, point to Find or Search, and then click Files or Folders.
Make sure that "Look in" is set to (C:\WINDOWS).
In the "Named" or "Search for..." box, type, or copy and paste, the file names:
win32.dll (in the Program Files directory)
winsrv32.exe (in the Program Files directory)
drg.exe (in the root directory)
or
win32.dll (in the Program Files directory)
wins32.exe (in the Program Files directory)
sfbar.exe (in the root directory)
Click Find Now or Search Now.
Delete the displayed files.
4) Change your default Internet home page in Internet Explorer:
Open Internet Explorer
Click on Tools
Click on Internet Options
Click in the Homepage section and reset your homepage to whatever page you would like
Click OK
5) Open Regedit and search for registry keys containing "surferbar", "adplus", and "adbar", and delete these keys.
8 [