Adware - Ads by BlockAndSurf - anyone know how to remove it?

My PC is "infected" by adware that creates pop-up ads on sites (not display ads) with "ADS BY BlockAndSurf" proudly displayed in the bottom corner. It also creates new browser tabs and sometimes new windows when the I click on, for example, the scroll bar area of the browser window, or in a data collection area of the screen (e.g. on this very herdProtect site when I clicked to add the title of this post I was taken to a newly generated browser tab containing an ad). My question is: How can I disable this behaviour? I have had 6 hours with Norton on-line technicians who tried to reset browsers etc. to absolutely no avail. Notes:

- No browsers show any trace of plug-ins, extensions etc. that would belie the hijack

- I do not see the behaviour on secure sites (https://)

- I can find no blockandsurf.exe file

- Adaware, Norton, Malwarebytes do not detect this

- IE, Chrome and FireFox are all affected

- I tried a brand new install of Opera, never before installed on this PC, installed it in a non-default directory, and it too had the same symptoms.

Any suggestions anyone?

Many thanks!

Asked Nov 5 '14 at 4:52

Ross

Add a comment

2 Answers

I've not seen that one personally but try a site like this for advice:

http://malwaretips.com/blogs/blockandsurf-virus-removal/

I just did a Google search for "ADS by Bl;ockAndSurf".

You may want to consider using an AdBlocker in your browser? I use the Firefox "Ad Blocker" addon. I would assume that IE has the same or similar addon.

Do you run software such as Malwarebytes?

K

Answered Nov 7 '14 at 8:51

kevmeist

Thanks K. I'd already found several sites like that, containing instructions for removing unwanted programs, and they all follow the same pattern of advice - remove program(s), remove extensions/reset browsers, use Adaware and other recommended software etc. I think someone has created a template that all the anti-malware vendors have adopted, I've found quite a few such sites :-) Unfortunately I have still not been successful - this seems to have hidden itself rather well. One update: On a whim I installed a lesser-known browser called Torch, and I do not get the blockandsurf ads with this browser. So the malware is not clever enough to hijack all browsers. Ironically Torch is ad funded so I do see the occasional "Torch" ad, but this is acceptable and far far less intrusive and disabling than the blockandsurf. And yes, am running Norton, have installed and run adaware and malwarebytes, but they don't find anything to report. Part of the problem is this is not a virus, rather it's an unwanted program (that has maliciously hidden itself, quite aside from the odious effect that it has on the user's browsing experience). Thanks again, will update here once I get to the bottom of it. Ross - Ross 115 months ago

Add a comment

Sometimes ads like these are shown by programs that might have installed on your computer without you knowing. You might want to have a look at what programs are currently installed and remove the suspicious ones.

To look up a list of legitimate programs try http://www.shouldiremoveit.com/. That site will tell you if a program is legitimate or if its crapware/adware/malware.

I've had a lot of experience with the site and it's proven to help me a lot.

Answered Nov 8 '14 at 10:51

Teitoku

Thanks Teitoku, I'm pretty sure I've cleaned out all unnecessary programs as I've been trying to root this one out, but that site looks handy, I'll check it out. I do know exactly when the behaviour started, and what "the user" was doing at the time when he must have inadvertently installed this thing. It's hidden itself very well though, as I've certainly removed/uninstalled everything I can find that was added/installed at that time. It's interesting to me that the ads do not appear when browsing secure sites, and, as above, I've found a browser that is not affected (Torch). Should these 2 facts help to narrow the search down? - Ross 115 months ago

Add a comment

Know someone who can answer? Share a link to this question via email, Google+, Twitter, or Facebook.

Your Answer

Not the answer you're looking for? Ask your own question.

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.