To all: What a great big pain in the arse. Ad Aware and HiJack did not work for me either and neither did most of the other tips/tricks here. Although they did lead to the right direction. Here's what I did to remove this piece of work... 1) CTRL/ALT/Del once to bring up a list of running progs. 2) End winsrv32.exe if it is running. 3) Delete the files c:\drg.exe; c:\program files\win32.dll (not a system file, actually a trojan) and c:\program files\winsrv32.exe 4) Use regedit to delete any registry keys containing 'surferbar, 'adplus,' and 'adbar.' (Use Edit, Find, then Find Next) 5) Check your internet options to make sure your home page is what you want it to be. I got most of this from http://ban.joh.cam.ac.uk/~sgf.surferbar.html and the winsrv32.exe part from noisome above. Whew

0

Thanks for the advice! I have also been blindsided by this surferbar thing. ANNOYING! I found the winsrv files you spoke of, but I can not delete them. It says "access denied". i tried closing all programs - still wouldn't let me. Anyone get this message when trying to delete? Thanks!

0

You need to delete drg.exe and win32.dll. Search Google=surferbar and click on the first link. It's another post on this site that details more users hassle with this piece of crap software. I wonder though how did everyone become infected with this disease? Were you also downloading things using Bit Torrent or other P2P? For me it was BT that prompted such! These nazi programmers need to be DDosed and then prosecuted!

0

I'm so glad I found this website because I was really going crazy. I just reformatted my hard drive and I'm already having this problem. The only thing I can think of that led to this was the downloading of pop-up stopper or kazaa lite. Anyway, I think I have gotten rid of the damn surferbar. Here's what I did. First I tried to delete those programs stated above. Yes, I had a problem at first with deletion because it said they were in use. But I restarted my computer and immediately deleted them after the restart and I was successful. I got rid of both the c:\drg.exe and c:\program files\win32.dll (or something similar to this) Then I ran the "hijack this" program and deleted a couple of the unfamiliar things. (hope I didnt' screw up anything) And finally I went into my registry and deleted the surferbar stuff like one poster mentioned. That seems to have gotten rid of the problem. It is now finally removed from my toolbar menu, although I have a no-name slot in my toolbar menu that is a mystery. Hopefully it will never come back - good luck to all of you - hope this helps.

0

Can anyone help? I am trying to remove surferbar by following response 7 (m hughes) but i can't seem to find win32.dll. Where do i look? Help would be appreciated as i have no clue whaat i am doing.Thanks

0

I need help. I'm trying to get rid of this thing. I'm not real great with computers. If someone could help me with plain english I would really appreciate it.

0

i have another question. When i delete anything it goes into the recycle bin. Do i leave it there or do i delete it from there as well? please help, this surferbar is really bugging me.

0

Delete it completely. The Win32.dll is the trojan!

0

To find both of these files, go to windows explorer or in Windows 2000, right click on the start button and choose explore. Click on the C drive (local disk) folder on the left. YOu should see a bunch of folders on the right. Go to the menu at the top of the page and click on View and then make sure the "list" option is chosen. That way you can see everything on there. At this point you should see the drg program and remove it. Then you will find the "program files" folder underneath the C drive folder you just opened and double click on that. Click on the show files button and find the win32.dll file everyone is talking about. Delete that, along with any other winserv type files you see. (I only had the win32.dll folder in mine) After you do that, reboot your computer and run hijack it and a registry cleaner if you have one. To change your homepage back to what it was, go to Tools-internet options while in internet explorer. In the first box, you'll see where you can input a new URL. Hope this helps. I'm pretty good at this computer thing, but not as advanced as many of these people on here. Thanks to all who helped me!

0

In response to queries above as to the source of this horrible infestation, I had an email with a control embedded in it. Email came from a bogus aol address (surprise). Message source: Return-Path: Received: from mk-rewrite-3.mail.uk.tiscali.co (212.74.114.134) by mk-cpfrontend.uk.tiscali.com (6.7.018) id 3F547F72001C92A8 for vibe@screaming.net; Wed, 3 Sep 2003 10:34:54 +0100 Received: from [68.53.89.223] (helo=pcp03151770pcs.rocsth01.mi.comcast.net) by mk-rewrite-3.mail.uk.tiscali.co with smtp (Exim 3.33 #1) id 19uTzz-000KRo-00 for matt@vibe.screaming.net; Wed, 03 Sep 2003 10:32:27 +0100 Received: from [120.14.51.97] by pcp03151770pcs.rocsth01.mi.comcast.net SMTP id 0GMShGXoy8X2WZ; Wed, 03 Sep 2003 11:32:28 +0600 Message-ID: From: "Damon Molina" Reply-To: "Damon Molina" To: Subject: Hello Date: Wed, 03 Sep 03 11:32:28 GMT X-Mailer: AOL 7.0 for Windows US sub 118 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="_797A38DBF9F4B___B" X-Priority: 3 X-MSMail-Priority: Normal --_797A38DBF9F4B___B Content-Type: text/html; Content-Transfer-Encoding: quoted-printable Hey, Want to go to the pub on Saturday? Last Saturday was a blast! Let me know! --_797A38DBF9F4B___B-- Strangely, OE asks whether I want to run activeX controls, I click no, and it runs anyway. :(

0

This is the most annoying hijack I have ever seen, ARGH!!! I don't even know how I got it, suddenly it was there. Never got any kind of announcement or confirmation and suddenly I had this annoying bar in my IE and porn links all over my computer *sigh* I assume it must have entere through an email or so. As for getting rid of it, I tried the suggestion as stated above (removing those files on the HD and in the registry), and it worked! But... I had also sent an email to these surferbar morons and got an automated reply back. That included an email address to which you have to write in order to get an uninstall programme. To cut a long story short, here is the url for the uninstall programme: http://www.surferbar.com/uninstall.exe I didn't get the chance to try it out myself since I had already removed it manually, but if it works, so much the better! Hope this is of any help to someone ;-)

0

Response Number 3 from Jeff worked for me. Here it is: Date: September 01, 2003 at 05:34:55 Pacific Subject: removing surferbar Reply: This is how I did it. Ad-aware and HiJack this seem not to have worked for me. In your background you may have winsrv32.exe running. You will need to stop this. If CTRL-ALT-DEL does not detect it, get WinTasks Pro (evaluation) and stop it from running. Second, go to C:\Program File or whatever is relational and delete win32.dll and winsrv32.dll. Use DLL Show to tell if you have anything else running. Then Right click on IE before opening it and go to Properties and change your homepage to something other than SurferBar.com. I hope this works for you. ---------------------- It worked for me in windows XP. Soto51

0

I got this beast at work this morning. I got rid of it by following the instructions here: http://www.pchell.com/support/surferbar.shtml

0

Hi I went to this http://www.pchell.com/support/surferbar.shtml and it worked HOWEVER Now when ever i load up I.E. i have to display teh address bar and stuff etc Eg I have to go to View/Toolbars/Address Bar i have to do this EVERYTIME.... Is there a way of getting it to stay check etc Please Reply to Email Address if Possible Thanks

0

To remove this f***** prog from your computer, please follow the instructions in Reply 7, written by Hughes. It worked for me (Windows Millennium). If Windows doesn't let you delete win32.dll, restart the computer and try again. I checked the register (with Regedit) before and after and found some more Surferbar, Adplus and Adbar stuff. Be sure nothing is left there. After having followed the instructions, I started IE and it started with Surferbar again. Stop it and change the standard home page to whatever you like, and you're ready. Hughes, thank you so much for your detailed help instructions. If I get my hands on the #$@@&%!*^$%$ who made this prog, I'll hang them by the balls !! Cheers, El Kapitan

0

http://securityresponse.symantec.com/avcenter/venc/data/download.aduent.trojan.html Get critical windows updates! Microsoft Security Bulletin MS03-032

0

hello, i followed dave02's instructions in post number two and now i am unable to change my homepage at all... the bar is locked. does anyone know of a way to unlock it? any help would be really appreciated. thanks.

0

Thanks for the posts providing help! I found a variant to the instructions given before. In my case the winsrv32.dll and exe file were named wins32.dll and wins32.exe. The root did not contain drg.exe but sfbar.exe instead. When stopping the process in memory through task manager look for wins32 instead. Hope this helps.. David

0

This is how I finally got rid of mine. I did the CTRLALTDELETE and when that came up I shut down WINS32. I then went to the find files or folders and entered WINS32. Everything that came up, I deleted. I kept them in my recycle bin just incase something doesn't run right. I then rebooted and bingo my toolbar was what I had before and wanted to keep. As far as surfer bar being a start page, I downloaded a program some time ago called start page guard that you set to the home page you want and it can never be changed except by you. Good luck!!!

0

You're all too fabulous, those of you who posted instructions to remove this piece of whatever. I had previously found the sfbar.exe file and got rid of that, but I couldn't figure out why I couldn't get rid of the pop-ups and thought maybe it had to do with my IE 6. I have Windows NT and Office XP and the culprit files were also wins32.dll and wins32.exe. Look for these and KILL THEM! Thanks all, appreciate you sharing the knowledge.

0