BrowserModifier.Kerlofost

BrowserModifier.Kerlofost is a browser helper object first released 17 March, 2009. Since its release it has gone on to infect many PCs worldwide, and caused severe damage to its victims’ PCs. This BHO will modify the PC’s browsing behavior, redirect users’ searches, report on user statistics and behavior and will revert all this stolen info to a remote server. What is more, BrowserModifier.Kerlofost will also spam the user with annoying pop up ads.

The BHO will enter the system subversively without the user’s consent, and root itself securely into the system. Because of its clandestine infiltration, users may find it difficult to detect and remove BrowserModifier.Kerlofost from the system. There are a few system changes to be on the lookout for, but mostly the user will be made aware of BrowserModifier.Kerlofost’s presence on the system by notifications of installed security software.

However the presence of the following files and registry subkeys will also indicate the presence of BrowserModifier.Kerlofost on the system:

Files:

\3rs23562.dll

The presence of the following registry subkeys:

HKCR\CLSID\{71E59D37-D7FC-4ED6-BC1D-D13BE02FE6C5}
HKCR\CLSID\{FFFFE708-B832-42F1-BAFF-247753B5E452}
HKCR\TypeLib\{2552632F-867D-4052-B836-7F83A5302534}
HKCR\Interface\{E743CF05-181C-4D72-B4EE-95435ED4B86B}
HKCR\Interface\{F1287389-B2FE-4315-8484-540B2033646D}
HKCR\AppID\rs_adw.DLL
HKCR\AppID\{D96FA298-1BB6-47FC-AD21-72781B744DC3}
HKCR\reklosoft_adw.Helper_Bar
HKCR\rs_adw.Helper_bho

BrowserModifier.Kerlofost will be installed in the system as \3rs23562.dll. It may arrive as a DLL component of a program, such as “Shot it”.

The server BrowserModifier.Kerlofost will connect to, to deliver the stolen data and statistics to is:

Reklosoft.ru

It will also download updates from this websiote. BrowserModifier.Kerlofost will spam the user with pop up ads based on the user’s keyword searches, from the subdomain adv.reklosoft.ru.

In order to restore your PC’s security and privacy, you will need to destroy BrowserModifier.Kerlofost with the help of a powerful security tool which will not only erase BrowserModifier.Kerlofost but also protect against similar attacks in future.