Adware.BMCentral

SUMMARY

Behavior

Adware.BMCentral is an adware program that downloads and displays popup advertisements.

Symptoms

Your Symantec program detects Adware.BMCentral.

Transmission

Adware.BMCentral must be manually installed.

Protection

• Virus Definitions (LiveUpdate™ Daily) May 9, 2006
• Virus Definitions (LiveUpdate™ Weekly) May 10, 2006
• Virus Definitions (Intelligent Updater) May 9, 2006
• Virus Definitions (LiveUpdate™ Plus) May 9, 2006

TECHNICAL DETAILS

When Adware.BMCentral is executed, it performs the following actions:

1. Creates the following files and directories:
   
   
   • BHaol.dll
   • BHiexplo.dll
   • BHnetsca.dll
   • BMCHook.dll
   • BMClient.exe
   • BMLauncher.exe
   • %Windir%BMCBack
   • %Windir%History
   • %Windir%HistoryIndex
   • %Windir%Search
   • %Windir%Spotlight
   • %Windir%ThumbCache
   • %Windir%About.url
   • %Windir%BMCfile.bmc
   • %Windir%FD.bmc
   • %Windir%Help.url
   • %Windir%QuickStart.url
     
     Note: %Windir% is a variable that refers to the Windows installation folder. By default, this is C:Windows or C:Winnt.
     
     
2. Creates the following registry key:
   
   HKEY_CURRENT_USERSoftwareBookmarkCentral
   
   
3. Downloads and displays popup advertisements.

REMOVAL

The following instructions pertain to all Symantec antivirus products that support security risk detection.

1. Update the definitions.
2. Run a full system scan and delete all the files detected as Adware.BetterInternet.
3. Delete the keys that were added to the registry.

For specific details on each of these steps, read the following instructions.

1. To update the definitions
To obtain the most recent definitions, start your Symantec program and run LiveUpdate.


2. To scan for and delete the files

1. Start Norton AntiVirus and make sure that it is configured to scan all the files. For more information, read the document, "How to configure Norton AntiVirus to scan all files."
2. Run a full system scan.
3. If any files are detected as Adware.BMCentral, write down the path and file names, and then click Delete.
   
   Note: If your Symantec antivirus product reports that it cannot delete a detected file, write down the path and file name. Then use Windows Explorer to locate and delete the file. If you cannot delete the file in Windows Explorer, restart the computer in Safe mode. For instructions, read the document, "How to start the computer in Safe Mode."
   
   
4. Using Windows Explorer, navigate to the following files and delete them, if present:
   
   • BHaol.dll
   • BHiexplo.dll
   • BHnetsca.dll
   • BMCHook.dll
   • BMClient.exe
   • BMLauncher.exe
   • %Windir%BMCBack
   • %Windir%History
   • %Windir%HistoryIndex
   • %Windir%Search
   • %Windir%Spotlight
   • %Windir%ThumbCache
   • %Windir%About.url
   • %Windir%BMCfile.bmc
   • %Windir%FD.bmc
   • %Windir%Help.url
   • %Windir%QuickStart.url

3. To delete the keys from the registry
Important: Symantec strongly recommends that you back up the registry before making any changes to it. Incorrect changes to the registry can result in permanent data loss or corrupted files. Modify the specified keys only. Read the document, "How to make a backup of the Windows registry," for instructions.

1. On the Windows taskbar, click Start > Run.
   
2. In the Run dialog box, type regedit and then click OK.
   
3. In the Register Editor, navigate to and delete the following key:
   
   HKEY_CURRENT_USERSoftwareBookmarkCentral
   
   
4. Exit the Registry Editor.
   
   

Important: If you are unable to start your Symantec antivirus product or the product reports that it cannot delete a detected file, you may need to stop the risk from running in order to remove it. To do this, run the scan in Safe mode. For instructions, read the document, How to start the computer in Safe Mode. Once you have restarted in Safe mode, run the scan again.