Adware Alert – BOLGER.DLL

Bolger.dll installs with the BetterInternet variant of the Transponder adware program. A file called thnall1ac.html may also appear on your system. Although this filename appears to be a web page with the .html extension, it runs as an exe file. This file 'calls home' to its controlling server (currently abetterinternet.com) then downloads additional files. These can include poller.exe, uacupg.exe, nail.exe, drpmon.dll, aurora.exe, and svcproc.exe.

The nail.exe file, when run, generates random filenames. Here are some of the common ones we've seen: Mywceedb.exe, waduhu.exe, wpjuhmo.exe, wtajmb.exe, nflzkfmg.exe, hywaxis.exe, ugiygi.exe, zsxcwiac.exe, akirgz.exe, rchzkoc.exe, and pdnulqj.exe. These random filenames will show "TODO" in their company/copyright information. This can make them easier to remove.

This pest also seems to install other adware programs including bookedspace, admass, and coolwebsearch variants. So these files may also appear on your system. bxxs5.dll, wstart.dll, nnx32.dll, toolbar.dll, cfgmgr51.dll, svchost.dll, ietoolbar.dll, and svchost2.dll.

We'd recommend removing all of these files using WinPatrol. First, we'd recommend taking inventory to see which files you have. To do this, start with your Active Tasks. Note each of the files we've described by name. Then look for any files that appear to be a random collection of letters. Click on the INFO button for each file. If the company and copyright information come back as "TODO" add that file to the list. There's one exception: mmtask.exe is installed with MusicMatch Jukebox. That's a legitimate file that will be labeled TODO. So leave that one alone. Next, repeat this process in your Startup Programs and IE Helpers.

Now that you have a list of the files, we're ready to remove them. Go back to your Active Tasks. You'll need to stop all of these files at the same time. If you don't, they'll restart each other. So hold down the CTRL key on your keyboard and click each file you want removed. As you do this, the filename will be highlighted. When all are highlighted, click the KILL button. If there's a file called "todo" there, kill it as well. Next, go to your Startup Programs and IE Helpers and remove all of the files. If you're running WinPatrol 8.x or later, right click each file then select "Delete file on reboot". When you've done this for all of the files, reboot your system. Then check to see if all of the files are gone and make sure there are no newly generated random filenames.

Additional background information on the Transponder adware program can be found at http://www.doxdesk.com/parasite/Transponder.html.

Adware

Remove