Adware Fastwebfinder Spyware

Type: Adware (Previously called Spyware)

Name: ld.exe

Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows XP

Systems Not Affected: Linux, Macintosh, OS/2, UNIX

This spyware threat can be detected only by free Spyware Scanner software that support expanded threats.

The Spyware's Behavior

Spyware Fastwebfinder hijacks your Internet Explorer Home Page, Search Bar, and Search Assistant, and adds links to your Favorites.

Your Internet Explorer Home Page changes to an undesired Web page each time you start Internet Explorer.

Your firewall program should alert you on the file ld.exe when it tries to access the Web page fastwebfinder.com.

Adware 'Fastwebfinder' is installed by going to fastwebfinder.com or to another Web site, or when you install certain programs.

File names: Ld.exe; Dnse.dll

When Fastwebfinder's Spyware is executed, it does one of the following:

Copies itself as Windir\Ld.exe.

*The adware locates the Windows installation folder (by default, this is C:\Windows or C:\Winnt) and copies itself to that location.

Adds the value:

"Ld"="windir\ld.exe"

to the registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft
\Windows\CurrentVersion\Run

so that the spyware runs each time you start Windows.

If Adware 'Fastwebfinder' is already fully installed in your Windir folder...

If Fastwebfinder's spyware finds the file Windir\Ld.exe, it will do the following:

Connect to fastwebfinder.com.

Downloads information, including the file Dnse.dll, which it copies to the Windir folder.

The spyware uses this information to hijack the following (of Internet Explorer):

Home Page

Search Bar

Search Assistant

Favorites

*Removing the adware from the system will likely cause the spyware program that installed it to not function as intended. Your uninstaller generally identifies the programs that will not work after uninstallation.

Restart your computer in Safe mode or end the adware process.

Close Internet Explorer if it is open.

Delete the spyware value that was added to the registry.

*Make sure you run a full system spyware scan and delete all the spyware files detected as Adware under the file name Fastwebfinder.

Restarting the computer in Safe mode or ending the Spyware's malicious process

Windows 95/98/Me

Shut down your computer and turn off the power. Wait for at least 30 seconds, and then restart the computer in Safe mode.

Windows NT/2000/XP

To end the Adware's malicious process:

Press Ctrl+Alt+Delete once.

Click Task Manager.

Click the Processes tab.

Double-click the Image Name column header to alphabetically sort the processes.

Scroll through the list and look for the spyware file "Ld.exe".

If you find the file, click it, and then click End Process.

Exit the Task Manager.

*Make sure that the Internet Explorer windows are not closed. Do not open Internet Explorer until the spyware's removal is finished, or you may activate the adware.

Deleting the Spyware value from the Registry

Click Start, and then click Run. (The Run dialog box appears.)

Type regedit

Then click OK. (The Registry Editor opens.)

Navigate to the key:

HKEY_LOCAL_MACHINE\Software\Microsoft
\Windows\CurrentVersion\Run

In the right pane, delete the value:

"Ld"="windir\ld.exe""value"="path/file name"

Exit the Registry Editor.

Scanning for and Deleting the Spyware files

Run your free Spyware Scanner program and make sure that it is configured to scan all files.

Run a full system spyware scan.

If any spyware files are detected as being infected with Adware Fastwebfinder, click Delete.

You will find much more on this topic at WorldsLargestNetwork.com