Parasite: Bulla

This record last updated Tue Sep 20 2005 00:34:15

PLEASE NOTE: Due to the overwhelming extent of this problem and the unbelievable volume of email we have received, we regret that we cannot respond to questions about browser parasites at this time. If you have attempted to contact us about this parasite please accept our apology for not responding. "Thank you's" are always appreciated ;-)

Description

Bulla is a Browser Helper Object for Internet Explorer. It tries to search all pages you view in IE and replaces banner adverts from the page with adverts from its controlling servers.

Also known as

IEPlugin, from the filename of the BHO DLL. This is a generic name; Bulla has nothing to do with the parasite known as IEPlugin.

Distribution

Some (unconfirmed) reports of Bulla installing through ActiveX drive-by-download on pop-up ad windows.

What it does

Advertising

Yes. Whenever a new page is displayed, Bulla connects to its servers at 1110100011o1window.info and downloads a piece of JavaScript that searches a document for <iframe>s sized at 468x60 (the typical banner ad size), and replaces them with ads served from ad.bulla.com.

Bulla also sets your home page to ‘startpage.ms’ the first time it is run.

Privacy violation

Yes. Each connection includes the URL of the page being viewed and a unique ID to allow Bulla to track sites being viewed.

Security issues

None known.

Stability problems

The JavaScript currently being served is incompatible with IE4. This might cause JavaScript on targeted pages to stop working and/or spurious error messages to appear.

Removal

There is no uninstall feature. Spybot S&D update 06-21 and Ad-Aware reflist 032-23.06.02 can remove Bulla.

Manual removal

Bulla installs a file called IEPlugin.dll into your System directory. Before you can delete it you must deregister it. Enter the following command in a command (DOS) window, for Windows 95/98/Me:

"%WinDir%\SYSTEM\regsvr32.exe" /u "%WinDir%\System\IEPlugin.dll"

Or, for Windows NT/2000/XP:

regsvr32 /u "%WinDir%\System32\IEPlugin.dll"

Then restart the computer and open the System(32) directory in the Windows folder. Delete the IEPlugin.dll file. You can also delete the key HKEY_LOCAL_MACHINE\Software\IEPlugin from the registry (run’regedit’) to clean up if you wish.