Internet Explorer [surferbar]

chernobyl

I have no idea how this fuking annoyance was installed but does anyone know how to get rid of it?

[adaware does not do it]

Eurorunner

Have a look through the running processes in the taskbar..any weird sounding dot exe running? Anything that sounds suspicious just run its name through google groups to get further info. If you get the info on the process thats responsible for this crap on google, there should be details on how to proceed with regard to its removal. Otherwise, do a search on the dot exe and delete it...

BoB_BoT

if adaware isn't picking up anything, give spybot search and destroy. picks up just about any sort of spyware, don't forget to run the update on it though . this may sound stupid, but did you try the add/remove feature? close any programs that arn't relevant to your os running, see if there's anything doggy running in the background. as suggested in Eurorunners post. if you right click an empty space around the buttons on I.E. you will have some options with ticks next to them "Standard Buttons, Address Bar, Links, Radio, Surfer Bar" unclick the surferbar or what ever it's named under and it should close unless it's spyware, or a doggy program. give spybot a try, removes most bars on comps at work, such as gator etc...

gl

Stephen

Doggy programs?

BoB_BoT

Originally posted by Stephen
Doggy programs?

screentracker.exe
surfer.exe
windowss.exe
explorerr.exe
etc... somethign along these lines, something that might look a bit out of place compared to a normal configuration.

swiss

Weird, exactly the same thing happened to me only a few days ago. I leave my PC unattended for a night, and surferbar gets installed. I've tried Adaware, spybot search and destroy, and spyware blaster (that will prevent a reoccurance). The surferbar is inactive at the moment, but I can't seem to find an uninstall for it.

I had a look through my registry, and found a mention of surferbar in [My Computer\HKEY_CLASSES_ROOT\AdPlus.AdBar.1] and [My Computer\HKEY_CLASSES_ROOT\AdPlus.AdBar], as well as [My Computer\HKEY_CLASSES_ROOT\CLSID\{Hexidecimal values}]. I'm a little bit iffy about deleting registry keys I don't know about, so does anyone know whether it is safe to delete them or not?

Alternatively, there may be a custom uninstall for it that someone might know about (although google threw up a negative for me). Now heres the thing, I have two PC's in my room, and both are affected. I don't know whether <insert person's name here> was messing on both PC's or not, so I'm beginning to wonder if it copied itself onto other computers on my home network :S. I can find out tomorrow afternoon sometime.

Originally posted by Bot_Bot:

you right click an empty space around the buttons on I.E. you will have some options with ticks next to them "Standard Buttons, Address Bar, Links, Radio, Surfer Bar" unclick the surferbar or what ever it's named under and it should close unless it's spyware

Did that, and yes indeed it did close, although it cropped back up again a few times automatically until I ran a thorough adaware check. I want it gone completely though. BTW, a system restore to the previous day didn't help either .

magick

lol and you blamed me for installing it the other night!

I told ya , i wouldnt install any of that spyware crap onto your pc

Fabre

best solution is not to use IE
Firebird is an excellent alternative.

swiss

Yes, I also use Opera 7.11, which is "teh win". However, I am so familiar with IE that I will still continue to use it for certain websites. I'm going to format my hard drive and reinstall my operating system fairly soon anyway (this is just for regular maintenance and unrelated to this particular instance) so the problem will be sorted out anyway when that happens.

flanno

You must delete three files from the pc....

c:\drg.exe
c:\program files\win32.ini
c:\program files\winsrv32.dll

IE will need to be closed before you can delete win32.ini and a process called winsrv32 will have to be stopped before you can delete the winsrv32.dll.

There are also three entries added to the registry......as far as i can recall they are

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

delete the string that has winsrv32.dll in it.

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]

change the default homepage back

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

Remove the toolbar from IE (can't remember which value it is)

Other than that, the shortcuts have to be removed from the desktop, the start menu and the favouries folder.

Microsoft do have a patch do resolve this vulnerability (MS03-032)
http://support.microsoft.com/default.aspx?scid=kb;en-us;822925

I hope this is of some use to you. Also, lavasoft's Adaware is very good at detecting/removing a lot of similar problems.

Cheers,

Flanno.