Manual Spy Bot Removal > StripPlayer
A downloader for a premium-rate phone dialler providing access to the porn site strip-player.com.
Distribution
Installed by ActiveX drive-by-download on porn-related pages from strip-player.com (which might be opened by pop-up advertising).
Installation can happen totally automatically on versions of Internet Explorer older than IE6 Service Pack 1, as a security hole is exploited to add the manufacturers, 'Electronic Group', to the list of publishers you trust, allowing them to install any software they like.
Electronic Group are known to install at least two other types of dialler software this way, IEAccess and DialerOffline . The dialler itself may also be installed by a simpler EXE file for non-IE browsers, but this is not detected by the script at this site and does not present the same risk.
Advertising
No.
Privacy violation
No.
Security issues
Yes, critical. The 'StripSetup' ActiveX control can be used on any web page, by any author, to download and run any executable file. There are no security checks whatsoever.
Stability problems
None known.
Removal
Open the registry (Start->Run->regedit) and delete the following keys:
HKEY_CLASSES_ROOT\ActiveStripSetup.EGStripDownload
HKEY_CLASSES_ROOT\ActiveStripSetup.EGStripDownload.1
HKEY_CLASSES_ROOT\CLSID\{E3F7205F-2AE0-4BF0-816B-2D24A5F20EC7}
HKEY_CLASSES_ROOT\TypeLib\{357AA41A-B7A8-4632-A27D-5B980B25CF43}
HKEY_CLASSES_ROOT\Interface\{BC23F736-C5BE-47FB-B459-1757933E5DF3}
Then open the System folder (in the Windows folder, 'System32' under Windows XP/2000/NT, or 'System' under Windows Me/98/95), and delete the ActiveStripSetup.dll file.
To remove the dialler itself, delete the folder 'C:\Program Files\strip-player' and any links to it on the desktop and/or Start menu.
Finally, if you fell victim to the exploit used to load StripPlayer automatically, you will need to remove Electronic Group from your trusted publishers, or they will still be able to install their software in the future. Check the registry key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing\Trust Database\0 for an entry with the value 'Electronic Group'. Delete it if it exists, if so, patching/updating IE is probably a very good idea.
You can also go to HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates and delete Electronic Group's key. It should begin '08F573...'.
|
