Full
Name: |
SurferBar Websearch Read More |
| Type: |
Trojan |
| Also
Known as: |
AdPlus
AdBar
AFlooder
JunkSurf.A
Trojan.Win32.Dialer.c [Kaspersky], Win32/Dialer.C trojan [Eset] |
| Created
by: |
Ruboskizo SL |
| SG Index: |
8 [Explain] |
| Removal tools: |
List
of products that detect/remove/protect against SurferBar:
Control IM and P2P use, block spyware and other malware: RTGuardian
Endpoint Spyware Remediation: Greynet Enterprise Manager
IM, P2P control, malware prevention and web filtering in single appliance: Unified Security Gateway
|
|
|
| Category Description: |
A Trojan is a program that enables an attacker to get nearly complete control over an infected PC. Frequently used tool by malicious hackers. When this program executes, the program performs a specific set of actions. This usually works toward the goal of allowing the trojan to survive on a system and open up a backdoor.
|
| Official
Description: |
Surferbar is an Internet Explorer toolbar that might be associated with a new version of a trojan horse program called AFlooder. It appears to be an ActiveX drive-by download. Isets your homepage to their website along with displaying popup ads. |
| Comment: |
- The old homepage at surferbar.com seems to have died.
- The new AFlooder variant is an irc trojan/spybot that uses worm techniques to spread to machines via web pages. It is apparently coded to have qualities of remote access trojans, IRC bots, keyloggers, and even seems to have the capability to carry out DDoS attacks if the owner orders it to. It uses an exploit to write and execute its' injector program to machines without the user's acceptance or knowledge, then it uses NTFS's alternate file streams to hide itself where there's very little chance of finding it -- in the actual windows folder system32. |
| Information
URL: |
http://www.adbars.com |
| |
|
| Manual
removal: |
Follow these steps in removing the Surferbar toolbar. To complete these steps you may have to Start in Safe Mode, however by terminating the running program you should be able to complete the steps normally.
1) Terminate the running program
Open the Windows Task Manager by either pressing CTRL+ALT+DEL on Win9x machines or CTL+Shift+Tab and clicking on the Processes tab on WinNT/2000/XP machines.
Locate the following program, click on it and End Task or End Process
winsrv32.exe
or
wins32.exe (2nd variation)
Close Task Manager
2) Remove the Registry entries
Click on Start, Run, Regedit
In the left panel go to
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
In the right panel, right-click and delete the following entry
c:\program files\winsrv32.exe
or
c:\program files\wins32.exe
Close the Registry Editor
3) Delete the infected files (for Windows ME and XP remember to turn off System Restore before searching for and deleting these files to remove infected backed up files as well).
Click Start, point to Find or Search, and then click Files or Folders.
Make sure that "Look in" is set to (C:\WINDOWS).
In the "Named" or "Search for..." box, type, or copy and paste, the file names:
win32.dll (in the Program Files directory)
winsrv32.exe (in the Program Files directory)
drg.exe (in the root directory)
or
win32.dll (in the Program Files directory)
wins32.exe (in the Program Files directory)
sfbar.exe (in the root directory)
Click Find Now or Search Now.
Delete the displayed files.
4) Change your default Internet home page in Internet Explorer:
Open Internet Explorer
Click on Tools
Click on Internet Options
Click in the Homepage section and reset your homepage to whatever page you would like
Click OK
5) Open Regedit and search for registry keys containing "surferbar", "adplus", and "adbar", and delete these keys.
This should remove SurferBar from your computer.
|
| Properties: |
Autostarts/Stays Resident
Changes browser
Connects to the internet
Shows Advertisements
Stealth Tactics
|
Click here to leave feedback for this product
|
|
| Help with the BUST! |
|
| Click here and give us what details you
have and let our international research
team take it from there. If you desire
your report will remain anonymous. |
|
|
|
|
|
