Windows Tutorials - Herong's Tutorial Examples
Dr. Herong Yang, Version 5.00

Spyware: SurfBuddy - sbuddy.dll

This section provides a tutorial example on remove spyware 'SurfBuddy' and related files sbuddy.dll.

Symptom: Unknown.

HijackThis Report: I ran HijackThis on my friend's system and saw this line:

O4 - HKLM\..\Run: [SurfBuddy] rundll32 
   "C:\Program Files\SurfBuddy\sbuddy.dll",run

Quick Research: I did a Google search on "SurfBuddy remove" and located the following related message from http://www.surfapps.com/sbuddydll.html:

"sbuddy.dll" is a spyware package currently circulating the internet.
It was not developed and is not included with any surfapps.com 
software, and it is not part of surfapps.com's SurfBuddy Surf 
Companion software. Please view our Privacy Policy for more 
information about Surfapps.com's policies on spyware.

What I Did:

1. Looked at c:\program files\SurfBuddy, found the file, and failed to delete it directly:

>dir c:\program files\SurfBuddy
   sbuddy.dll
   ...

>rmdir c:\program files\SurfBuddy
   sbuddy.dll in use

2. Run HijackThis > "Open the Misc Tools section" > "Delete a file on reboot", select c:\program files\SurfBuddy\sbuddy.dll, and reboot the system.

Result: SurfBuddy is gone.

Sections in This Chapter

What Is Spyware?

"HijackThis" - Spyware and Browser Hijacker Detector

"HijackThis" Report Entry Types

Spyware: WebBar - htwtb.bin and bar.dll

Spyware: SurfBuddy - sbuddy.dll

Spyware: WebSpecials - webspec.dll

Spyware: DSSAgent - DSSAgent.exe

Transponder: Best Offer - farmmext.exe

Spyware: dinst.exe - dsr.dll

Dr. Herong Yang, updated in 2008
Spyware: SurfBuddy - sbuddy.dll