Adware-DoubleD

Updated: September 20, 2011 Adware 9 Comments

Potentially unwanted program that goes by the name of Adware-DoubleD will spread from various locations that are reachable with Internet connection. By monitoring user’s web browsing habit, Adware-DoubleD will display different kinds of advertisements in the form of pop-up window. The adware will also redirect your Internet browser to other malicious web pages and intercept your online search result.

Damage Level: Medium

Systems Affected: Windows 9x, 2000, XP, Vista

How to Remove Adware-DoubleD:

FIRST AID TO STOP Adware-DoubleD:
If this virus have infected the system, registry and legitimate Windows files are also compromised. System Restore can reinstate clean system files by restoring the configuration to an earlier date. If a restore point was created before you got infected with Adware-DoubleD, please restore Windows to previous configuration.

How to remove Adware-DoubleD:

1. Click here to download removal tool. Save it on your Desktop.
2. After downloading, double-click on the file to install the application.
3. Follow the prompts and install as “default” only
4. If it prompts to update the database after installation, please proceed.

5. Click “Finish.” Program will run automatically and you will be prompt to update the program before doing a scan. Please update.
6. Scan your computer thoroughly.
7. When scanning is finished, click on the “Show Results”
8. Make sure that all detected threats are marked, click on Remove Selected.
9. Restart your Windows.

ADDITIONAL TOOLS AND PROGRAMS:

Scan with Norton Power Eraser:
A free removal tool from Norton Antivirus was developed to remove virus and unfamiliar threats without using the traditional AV signatures. Download the tool from this location and start scanning the computer for viruses.

Technical Details and Additional Information:

Other functionalities of this Adware:
- Adware-DoubleD employs browser redirection to promote online products.
- This malware will install toolbar on Internet Explorer and Firefox browsers.
- It will install various emoticons for your Instant messaging program.

Malicious Files Added by Adware-DoubleD:
%UserProfile%\Favorites\home.desktopsmiley.com.url
%UserProfile%\Local Settings\Application Data\DoubleD\Desktop Smiley Toolbar\4.2.0.11210\bin\stbup.exe
C:\Documents and Settings\All Users\Application Data\{5FBDCA6E-055E-4083-89AA-123FF33DCB7F}\OFFLINE\B75FA91E\3E688669\stbsvc.exe
C:\Documents and Settings\All Users\Application Data\{5FBDCA6E-055E-4083-89AA-123FF33DCB7F}\OFFLINE\BED3DEFB\3E688669\stbasst.exe
C:\Documents and Settings\All Users\Application Data\{5FBDCA6E-055E-4083-89AA-123FF33DCB7F}\OFFLINE\mFileBagIDE.dll\bag\stbpx.exe
C:\Documents and Settings\All Users\Application Data\{5FBDCA6E-055E-4083-89AA-123FF33DCB7F}\OFFLINE\mFileBagIDE.dll\bag\stbreaim.exe
C:\Documents and Settings\All Users\Application Data\{5FBDCA6E-055E-4083-89AA-123FF33DCB7F}\OFFLINE\mFileBagIDE.dll\bag\stbrewlm.exe
C:\Documents and Settings\All Users\Application Data\{5FBDCA6E-055E-4083-89AA-123FF33DCB7F}\OFFLINE\mFileBagIDE.dll\bag\stbrunwlm.exe
C:\Documents and Settings\All Users\Application Data\{5FBDCA6E-055E-4083-89AA-123FF33DCB7F}\OFFLINE\mFileBagIDE.dll\bag\stbsh.dll
C:\Documents and Settings\All Users\Application Data\{5FBDCA6E-055E-4083-89AA-123FF33DCB7F}\OFFLINE\mFileBagIDE.dll\bag\stbterm.exe
C:\Documents and Settings\All Users\Application Data\{5FBDCA6E-055E-4083-89AA-123FF33DCB7F}\Setup.exe
%ProgramFiles%\DoubleD\Desktop Smiley Toolbar\4.2.0.11210\stbappHelper.exe
%ProgramFiles%\DoubleD\Desktop Smiley Toolbar\4.2.0.11210\stbasst.exe
%ProgramFiles%\DoubleD\Desktop Smiley Toolbar\4.2.0.11210\stbdl.exe
%ProgramFiles%\DoubleD\Desktop Smiley Toolbar\4.2.0.11210\stbsvc.exe
%ProgramFiles%\DoubleD\Desktop Smiley Toolbar\4.2.0.11210\stbYahoo8.dll
%ProgramFiles%\DoubleD\Desktop Smiley Toolbar\4.2.0.11210\stbYahoo9.dll

File Location for Windows Versions:

• %UserProfile% for Vista/7 user is C:\Users\<Current User> for Windows Vista/7, for Windows XP/2000 this is C:\Documents and Settings\<Current User>.

Associated Windows Registry Entries:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\”SmileyApp” = “%ProgramFiles%\DoubleD\Desktop Smiley Toolbar\4.2.0.11210\stbapp.exe”