Ads By BlockAndSurf – Removal Instructions

Do you see ads, like the ones shown below, labeled Ads by BlockAndSurf, brought by BlockAndSurf or Powered by BlockAndSurf while browsing the web, and two files named BlockAndSurf158.exe and BlockAndSurf_wd.exe in the Windows Task Manager?

brought by BlockAndSurf ads

Ads by BlockAndSurf Nav-LinksAds by BlockAndSurf bannerAds by BlockAndSurfPowered by blockandsurf


When I scanned one of the BlockAndSurf files over at VirusTotal, it was detected as “AddLyrics” and “Lyckricks“.

Here’s a quick video guide how to remove the ads and fix the proxy settings if necessary:

Hope you found the video useful.

Update 2014-10-27: A few users have reported that the Add/Remove uninstall for BlockAndSurf does not work. The BlockAndSurf ads remained after running the uninstaller, so I thought I should follow up on how to remove BlockAndSurf with FreeFixer. The BlockAndSurf adware has also updated its file names since I first published this blog post. Anyway, to remove BlockAndSurf, download FreeFixer and start the scan. Here’s the files I checked to remove BlockAndSurf:

First the webinstrnew.sys driver:BlockAndSurf webinstrnew.sys remove

Then the updater.exe scheduled tasks:BlockAndSurf tasks remove

Followed by bservice.exe, bservice64.exe and wd.exe:BlockAndSurf startup remove

Then the BlockAndSurf Internet Explorer files, 180_x64.dll and 180.dll:BlockAndSurf remove Internet Explorer

And here’s I’m removing BlockAndSurf from Firefox. The 180.xpi file:BlockAndSurf firefox remove

BlockAndSurf is also loaded into Explorer.exe, with the bhelper64.dll file:BlockAndSurf bhelper64.dll remove

I’m also removing the BlockAndSurf.exe file and a few other processes as shown in the screenshot:Block And Surf processes remove

And to remove the BlockAndSurf Chrome extension, type in chrome://extensions in Chrome and remove BlockAndSurf.

Then fix your proxy settings as shown in the video. FreeFixer v1.13 will be able to repair proxy settings 😉

Last step: Reboot.

That’s it. Thanks for reading. Hope this helped you solve the problem.