Limited Time!
Totally FREE Web Design!
Click here!

Parasite: AdultLinks

This record last updated Tue Sep 20 2005 00:34:14

PLEASE NOTE: Due to the overwhelming extent of this problem and the unbelievable volume of email we have received, we regret that we cannot respond to questions about browser parasites at this time. If you have attempted to contact us about this parasite please accept our apology for not responding. "Thank you's" are always appreciated ;-)

Description

An program that adds links to porn and other sites to the Internet Explorer Favorites menu. Whilst it is installed, it can add more links when directed to do so by a web page.

Distribution

Installed by ActiveX drive-by-download from its controlling servers, mainentrypoint.com. This may be triggered by some pop-up ads.

Variants

AdultLinks/LinkZZ also adds links in the ‘Links’ folder/toolbar. AdultLinks/QcBar provides a separate AdultLinks toolbar instead.

AdultLinks/QaBar is a development of QcBarS with small porny icons for the links, and a home page link that is added to the Desktop and Start Menu.

What it does

Advertising

No. (Other than the links themselves being advertising.)

Privacy violation

No.

Security issues

No.

Stability problems

No.

Removal

The QcBar variant should have an ‘uninstall’ option on the ‘Adult Links’ toolbar menu.

Manual removal

LinkZZ variant

Open the ‘Downloaded Program Files’ folder in the Windows folder, right-click the ‘NullCtrl Class’ entry, and remove it. You can also delete the key ‘HKEY_CURRENT_USER\Software\LinkZZ’ from the registry to clean up if you like.

QcBar variant

Open the registry (click ‘Start’, choose ‘Run’ and enter ‘regedit’) and delete the following keys:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{765E6B09-6832-4738-BDBE-25F226BA2AB0}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{765E6B09-6832-4738-BDBE-25F226BA2AB0}
HKEY_CURRENT_USER\Software\QcBar
HKEY_CLASSES_ROOT\QcBar
HKEY_CLASSES_ROOT\QcBar.1
HKEY_CLASSES_ROOT\Allch.IEObj
HKEY_CLASSES_ROOT\Allch.IEObj.1
HKEY_CLASSES_ROOT\CLSID\{765E6B09-6832-4738-BDBE-25F226BA2AB0}
HKEY_CLASSES_ROOT\CLSID\{D6FC35D1-04AB-4D40-94CF-2E5AE4D0F8D2}
HKEY_CLASSES_ROOT\Interface\{ED7D1356-F7C2-4A27-A87C-C0DFEB3A628F}
HKEY_CLASSES_ROOT\Interface\{242CA913-1637-4F74-9729-EA349AF3ECAC}
HKEY_CLASSES_ROOT\TypeLib\{C02EE3A0-1881-419F-A5ED-737223463292}
HKEY_CLASSES_ROOT\TypeLib\{60381D4B-8129-449A-A5F2-5417AD0571CC}

Restart Windows. You can now delete the program files to clean up: open a DOS command prompt window (from Start->Programs->Accessories) and enter the following commands:

del "%WinDir%\Downloaded Program Files\allch.dll"
del "%WinDir%\Downloaded Program Files\QcBar.dll"

QaBar variant

Open a DOS command prompt window (from Start->Programs->Accessories) and enter the following commands:

cd "%WinDir%\System"
regsvr32 /u "..\Downloaded Program Files\QaBar.dll"
del "..\Downloaded Program Files\QaBar.inf"

You can then delete the file ‘insqcb.ins’ in the System folder (inside the Windows folder, called ‘System32’ on Windows NT, 2000 and XP or just ‘System’ under Windows 95, 98 and Me), and the ‘Adult Links Daily’ icons on the Start Menu and Desktop, plus the ‘QcBar’ folder inside the Application Data folder. (Application Data can be found in the Windows folder under Windows 95, 98 and Me, or in your user ‘Profiles’ folder in the Windows folder under Windows NT, or in your user ‘Documents and Settings’ folder in 2000 and XP.) You can also delete the registry key ‘HKEY_LOCAL_MACHINE\Software\QcBar’ to clean up if you like.

All variants

The ‘Adult Links’, ‘Adult Search’, ‘Sports’ and ‘Instant Viagra’ folders can be deleted from the Favorites folder. Then, if your search settings have been hijacked

QaBar and some releases of QcBar also hijack address bar searches to point to search-itnow.com. To stop this happening, go to the Programs tab in Internet Options and click ‘Reset web settings’.

Links

AdultLinks official site