Manual Spy Bot Removal > SmartBrowser
SmartBrowser is a browser hijacker controlled by smart-browser.com. It opens pop-up porn advertising from extremelybabes.com and extremelyamateurs.com, and redirects attempted use of other porn sites to these sites instead. (Caution: these sites may attempt to load premium-rate diallers.)
It also sends spam messages from your computer to Yahoo! Chat using automatically generated account names. Currently these messages are promoting the same two porn sites.
SmartBrowser cannot currently be detected by the script at this site, because attempting to do so may crash Internet Explorer.
Also known as
YBD , its internal name.
Distribution
Unknown, but suspected to be loaded by porn-related pages. An installer has been seen which also installs a tibsystems.com dialler.
Advertising
Yes. Can open pop-ups or redirect the browser to a different page when a targeted URL is visited.
Privacy violation
No.
Security issues
Yes. Can download and install arbitrary code from its controlling server, as an update feature.
Stability problems
None known.
Removal
Open the registry (click 'Start', choose 'Run', and type 'regedit'). Find and delete the following keys:
HKEY_CLASSES_ROOT\BHO.iBHO
HKEY_CLASSES_ROOT\CLSID\{00000185-B716-11D3-92F3-00D0B709A7D8}
HKEY_CLASSES_ROOT\CLSID\{00000186-B716-11D3-92F3-00D0B709A7D8}
HKEY_CLASSES_ROOT\Interface\{00000183-B716-11D3-92F3-00D0B709A7D8}
HKEY_CLASSES_ROOT\TypeLib\{00000182-B716-11D3-92F3-00D0B709A7D8}
HKEY_CURRENT_USER\Software\System\lastversion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00000185-B716-11D3-92F3-00D0B709A7D8}
Restart the computer and open an Explorer window. Enter “%Temp%” (without quotes) into the address bar. Inside this folder you may find files with names such as BHO.0.1.0.135.dll (or some other number), ybd.dll, regme.exe, logo.ico, IYBD.5.exe, thingies.lish.enctext, YBDversion.5 and system.htm. You can delete them all to clean up. (It may be a good idea to clean up everything in the Temp directory as a matter of course.)
|
