{"id":269,"date":"2014-04-17T13:06:47","date_gmt":"2014-04-17T13:06:47","guid":{"rendered":"http:\/\/www.freefixer.com\/b\/?p=269"},"modified":"2018-05-29T12:02:56","modified_gmt":"2018-05-29T12:02:56","slug":"ads-by-blockandsurf-removal","status":"publish","type":"post","link":"https:\/\/www.freefixer.com\/b\/ads-by-blockandsurf-removal\/","title":{"rendered":"Ads By BlockAndSurf &#8211; Removal Instructions"},"content":{"rendered":"<p>Do you see ads, like the ones shown below, labeled <strong>Ads by BlockAndSurf, brought by BlockAndSurf<\/strong>\u00a0or <strong>Powered by BlockAndSurf<\/strong> while browsing the web, and two files named <strong>BlockAndSurf158.exe<\/strong> and <strong>BlockAndSurf_wd.exe<\/strong> in the Windows Task Manager?<\/p>\n<p><a href=\"http:\/\/www.freefixer.com\/b\/wp-content\/uploads\/2014\/04\/brought-by-BlockAndSurf.png\"><img loading=\"lazy\" class=\"alignnone wp-image-2418 size-full\" src=\"http:\/\/www.freefixer.com\/b\/wp-content\/uploads\/2014\/04\/brought-by-BlockAndSurf.png\" alt=\"brought by BlockAndSurf ads\" width=\"362\" height=\"186\" srcset=\"https:\/\/www.freefixer.com\/b\/wp-content\/uploads\/2014\/04\/brought-by-BlockAndSurf.png 362w, https:\/\/www.freefixer.com\/b\/wp-content\/uploads\/2014\/04\/brought-by-BlockAndSurf-300x154.png 300w\" sizes=\"(max-width: 362px) 100vw, 362px\" \/><\/a><\/p>\n<p><img loading=\"lazy\" class=\"alignnone size-full wp-image-272\" style=\"line-height: 1.5;\" src=\"http:\/\/www.freefixer.com\/b\/wp-content\/uploads\/2014\/04\/ads-by-blockandsurf-3.png\" alt=\"Ads by BlockAndSurf Nav-Links\" width=\"518\" height=\"233\" srcset=\"https:\/\/www.freefixer.com\/b\/wp-content\/uploads\/2014\/04\/ads-by-blockandsurf-3.png 518w, https:\/\/www.freefixer.com\/b\/wp-content\/uploads\/2014\/04\/ads-by-blockandsurf-3-300x134.png 300w\" sizes=\"(max-width: 518px) 100vw, 518px\" \/><img loading=\"lazy\" class=\"alignnone size-full wp-image-271\" style=\"line-height: 1.5;\" src=\"http:\/\/www.freefixer.com\/b\/wp-content\/uploads\/2014\/04\/ads-by-blockandsurf-2.png\" alt=\"Ads by BlockAndSurf banner\" width=\"750\" height=\"117\" srcset=\"https:\/\/www.freefixer.com\/b\/wp-content\/uploads\/2014\/04\/ads-by-blockandsurf-2.png 750w, https:\/\/www.freefixer.com\/b\/wp-content\/uploads\/2014\/04\/ads-by-blockandsurf-2-300x46.png 300w\" sizes=\"(max-width: 750px) 100vw, 750px\" \/><a style=\"line-height: 1.5;\" href=\"http:\/\/www.freefixer.com\/b\/wp-content\/uploads\/2014\/04\/ads-by-blockandsurf.png\"><img loading=\"lazy\" class=\"alignnone size-full wp-image-270\" src=\"http:\/\/www.freefixer.com\/b\/wp-content\/uploads\/2014\/04\/ads-by-blockandsurf.png\" alt=\"Ads by BlockAndSurf\" width=\"1051\" height=\"165\" srcset=\"https:\/\/www.freefixer.com\/b\/wp-content\/uploads\/2014\/04\/ads-by-blockandsurf.png 1051w, https:\/\/www.freefixer.com\/b\/wp-content\/uploads\/2014\/04\/ads-by-blockandsurf-300x47.png 300w, https:\/\/www.freefixer.com\/b\/wp-content\/uploads\/2014\/04\/ads-by-blockandsurf-1024x160.png 1024w\" sizes=\"(max-width: 1051px) 100vw, 1051px\" \/><\/a><a href=\"http:\/\/www.freefixer.com\/b\/wp-content\/uploads\/2014\/04\/powered-by-blockandsurf.png\"><img loading=\"lazy\" class=\"alignnone wp-image-2080 size-full\" src=\"http:\/\/www.freefixer.com\/b\/wp-content\/uploads\/2014\/04\/powered-by-blockandsurf.png\" alt=\"Powered by blockandsurf\" width=\"571\" height=\"172\" srcset=\"https:\/\/www.freefixer.com\/b\/wp-content\/uploads\/2014\/04\/powered-by-blockandsurf.png 571w, https:\/\/www.freefixer.com\/b\/wp-content\/uploads\/2014\/04\/powered-by-blockandsurf-300x90.png 300w\" sizes=\"(max-width: 571px) 100vw, 571px\" \/><\/a><\/p>\n<p>&nbsp;<\/p>\n<p>When I scanned one of the BlockAndSurf files over at <a href=\"http:\/\/www.freefixer.com\/b\/scan-files-for-viruses-virustotal\/\">VirusTotal<\/a>, it was detected as &#8220;<strong>AddLyrics<\/strong>&#8221; and &#8220;<strong>Lyckricks<\/strong>&#8220;.<\/p>\n<p>Here&#8217;s a quick video guide how to remove the ads and fix the proxy settings if necessary:<\/p>\n<p><iframe loading=\"lazy\" src=\"\/\/www.youtube.com\/embed\/9n-2NUAXA2c\" width=\"640\" height=\"360\" frameborder=\"0\" allowfullscreen=\"allowfullscreen\"><\/iframe><\/p>\n<p>Hope you found the video useful.<\/p>\n<p><strong>Update 2014-10-27<\/strong>: A few users have reported that the Add\/Remove uninstall for BlockAndSurf does not work. The BlockAndSurf ads remained after running the uninstaller, so I thought I should follow up on how to remove BlockAndSurf with <a title=\"About FreeFixer\" href=\"http:\/\/www.freefixer.com\/b\/about-freefixer\/\">FreeFixer<\/a>. The BlockAndSurf adware has also updated its file names since I first published this blog post. Anyway, to remove BlockAndSurf\u0003, download\u00a0FreeFixer and\u00a0start the scan. Here&#8217;s the files I checked to remove BlockAndSurf:<\/p>\n<p>First the <strong>webinstrnew.sys<\/strong> driver:<a href=\"http:\/\/www.freefixer.com\/b\/wp-content\/uploads\/2014\/04\/BlockAndSurf-webinstrnew.sys-remove.png\"><img loading=\"lazy\" class=\"alignnone size-full wp-image-2446\" src=\"http:\/\/www.freefixer.com\/b\/wp-content\/uploads\/2014\/04\/BlockAndSurf-webinstrnew.sys-remove.png\" alt=\"BlockAndSurf webinstrnew.sys remove\" width=\"685\" height=\"203\" srcset=\"https:\/\/www.freefixer.com\/b\/wp-content\/uploads\/2014\/04\/BlockAndSurf-webinstrnew.sys-remove.png 685w, https:\/\/www.freefixer.com\/b\/wp-content\/uploads\/2014\/04\/BlockAndSurf-webinstrnew.sys-remove-300x88.png 300w\" sizes=\"(max-width: 685px) 100vw, 685px\" \/><\/a><\/p>\n<p>Then the <strong>updater.exe<\/strong> scheduled tasks:<a href=\"http:\/\/www.freefixer.com\/b\/wp-content\/uploads\/2014\/04\/BlockAndSurf-tasks-remove.png\"><img loading=\"lazy\" class=\"alignnone size-full wp-image-2445\" src=\"http:\/\/www.freefixer.com\/b\/wp-content\/uploads\/2014\/04\/BlockAndSurf-tasks-remove.png\" alt=\"BlockAndSurf tasks remove\" width=\"742\" height=\"276\" srcset=\"https:\/\/www.freefixer.com\/b\/wp-content\/uploads\/2014\/04\/BlockAndSurf-tasks-remove.png 742w, https:\/\/www.freefixer.com\/b\/wp-content\/uploads\/2014\/04\/BlockAndSurf-tasks-remove-300x111.png 300w\" sizes=\"(max-width: 742px) 100vw, 742px\" \/><\/a><\/p>\n<p>Followed by <strong>bservice.exe<\/strong>, <strong>bservice64.exe<\/strong> and <strong>wd.exe<\/strong>:<a href=\"http:\/\/www.freefixer.com\/b\/wp-content\/uploads\/2014\/04\/BlockAndSurf-startup-remove.png\"><img loading=\"lazy\" class=\"alignnone size-full wp-image-2444\" src=\"http:\/\/www.freefixer.com\/b\/wp-content\/uploads\/2014\/04\/BlockAndSurf-startup-remove.png\" alt=\"BlockAndSurf startup remove\" width=\"788\" height=\"282\" srcset=\"https:\/\/www.freefixer.com\/b\/wp-content\/uploads\/2014\/04\/BlockAndSurf-startup-remove.png 788w, https:\/\/www.freefixer.com\/b\/wp-content\/uploads\/2014\/04\/BlockAndSurf-startup-remove-300x107.png 300w\" sizes=\"(max-width: 788px) 100vw, 788px\" \/><\/a><\/p>\n<p>Then the BlockAndSurf Internet Explorer files, <strong>180_x64.dll<\/strong> and <strong>180.dll<\/strong>:<a href=\"http:\/\/www.freefixer.com\/b\/wp-content\/uploads\/2014\/04\/BlockAndSurf-remove-Internet-Explorer.png\"><img loading=\"lazy\" class=\"alignnone size-full wp-image-2443\" src=\"http:\/\/www.freefixer.com\/b\/wp-content\/uploads\/2014\/04\/BlockAndSurf-remove-Internet-Explorer.png\" alt=\"BlockAndSurf remove Internet Explorer\" width=\"681\" height=\"226\" srcset=\"https:\/\/www.freefixer.com\/b\/wp-content\/uploads\/2014\/04\/BlockAndSurf-remove-Internet-Explorer.png 681w, https:\/\/www.freefixer.com\/b\/wp-content\/uploads\/2014\/04\/BlockAndSurf-remove-Internet-Explorer-300x99.png 300w\" sizes=\"(max-width: 681px) 100vw, 681px\" \/><\/a><\/p>\n<p>And here&#8217;s I&#8217;m removing BlockAndSurf from Firefox. The <strong>180.xpi<\/strong> file:<a href=\"http:\/\/www.freefixer.com\/b\/wp-content\/uploads\/2014\/04\/BlockAndSurf-firefox-remove.png\"><img loading=\"lazy\" class=\"alignnone size-full wp-image-2442\" src=\"http:\/\/www.freefixer.com\/b\/wp-content\/uploads\/2014\/04\/BlockAndSurf-firefox-remove.png\" alt=\"BlockAndSurf firefox remove\" width=\"790\" height=\"234\" srcset=\"https:\/\/www.freefixer.com\/b\/wp-content\/uploads\/2014\/04\/BlockAndSurf-firefox-remove.png 790w, https:\/\/www.freefixer.com\/b\/wp-content\/uploads\/2014\/04\/BlockAndSurf-firefox-remove-300x88.png 300w\" sizes=\"(max-width: 790px) 100vw, 790px\" \/><\/a><\/p>\n<p>BlockAndSurf is also loaded into Explorer.exe, with the <strong>bhelper64.dll<\/strong> file:<a href=\"http:\/\/www.freefixer.com\/b\/wp-content\/uploads\/2014\/04\/BlockAndSurf-bhelper64.dll-remove.png\"><img loading=\"lazy\" class=\"alignnone size-full wp-image-2441\" src=\"http:\/\/www.freefixer.com\/b\/wp-content\/uploads\/2014\/04\/BlockAndSurf-bhelper64.dll-remove.png\" alt=\"BlockAndSurf bhelper64.dll remove\" width=\"563\" height=\"196\" srcset=\"https:\/\/www.freefixer.com\/b\/wp-content\/uploads\/2014\/04\/BlockAndSurf-bhelper64.dll-remove.png 563w, https:\/\/www.freefixer.com\/b\/wp-content\/uploads\/2014\/04\/BlockAndSurf-bhelper64.dll-remove-300x104.png 300w\" sizes=\"(max-width: 563px) 100vw, 563px\" \/><\/a><\/p>\n<p>I&#8217;m also removing the <strong>BlockAndSurf.exe<\/strong> file and a few other processes as shown in the screenshot:<a href=\"http:\/\/www.freefixer.com\/b\/wp-content\/uploads\/2014\/04\/Block-And-Surf-processes-remove.png\"><img loading=\"lazy\" class=\"alignnone size-full wp-image-2440\" src=\"http:\/\/www.freefixer.com\/b\/wp-content\/uploads\/2014\/04\/Block-And-Surf-processes-remove.png\" alt=\"Block And Surf processes remove\" width=\"663\" height=\"354\" srcset=\"https:\/\/www.freefixer.com\/b\/wp-content\/uploads\/2014\/04\/Block-And-Surf-processes-remove.png 663w, https:\/\/www.freefixer.com\/b\/wp-content\/uploads\/2014\/04\/Block-And-Surf-processes-remove-300x160.png 300w\" sizes=\"(max-width: 663px) 100vw, 663px\" \/><\/a><\/p>\n<p>And to remove the BlockAndSurf Chrome\u00a0extension, type in\u00a0<strong>chrome:\/\/extensions<\/strong>\u00a0in Chrome and remove BlockAndSurf.<\/p>\n<p>Then fix your proxy settings as shown in the video. FreeFixer v1.13 will be able to repair proxy settings \ud83d\ude09<\/p>\n<p>Last step: Reboot.<\/p>\n<p>That&#8217;s it. Thanks for reading. Hope this helped you solve the problem.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Do you see ads, like the ones shown below, labeled Ads by BlockAndSurf, brought by BlockAndSurf\u00a0or Powered by BlockAndSurf while browsing the web, and two files named BlockAndSurf158.exe and BlockAndSurf_wd.exe in the Windows Task Manager? &nbsp; When I scanned one of the BlockAndSurf files over at VirusTotal, it was detected as &#8220;AddLyrics&#8221; and &#8220;Lyckricks&#8220;. Here&#8217;s &hellip; <a href=\"https:\/\/www.freefixer.com\/b\/ads-by-blockandsurf-removal\/\" class=\"more-link\">Continue reading <span class=\"screen-reader-text\">Ads By BlockAndSurf &#8211; Removal Instructions<\/span> <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[3],"tags":[35],"_links":{"self":[{"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/posts\/269"}],"collection":[{"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/comments?post=269"}],"version-history":[{"count":12,"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/posts\/269\/revisions"}],"predecessor-version":[{"id":2749,"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/posts\/269\/revisions\/2749"}],"wp:attachment":[{"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/media?parent=269"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/categories?post=269"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/tags?post=269"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}