Adware.StatBlaster

SUMMARY

Behavior

Adware.StatBlaster is an adware component, and may be used in partnership with other adware packages.

Symptoms

• The files are detected as Adware.StatBlaster.
• Possible interference when shutting down.
• Possible connection via Web browser to ad sites or to statblaster.com.

Transmission

Most likely downloaded from a site that includes adware, or from Statblaster.com, as part of a "Baseball Fantasy" promotion.

Protection

• Virus Definitions (LiveUpdate™ Weekly) November 12, 2003
• Virus Definitions (Intelligent Updater) November 12, 2003

TECHNICAL DETAILS

When Adware.StatBlaster runs, it performs the following actions:

1. Attempts to connect to StatBlaster.com for updates.
   
   
2. Sets or updates the registry key:
   
   HKEY_LOCAL_MACHINESoftwareStatBlaster
   
   and adds subkeys under it.
   

This Adware does not provide an uninstaller. The adware with which it could be bundled would most likely contain the run keys and uninstallers, if any.

REMOVAL

Removal Tool
Symantec Security Response has developed a removal tool for Adware.StatBlaster. Use this removal tool first, as it is the easiest way to remove this risk.

The tool can be found here: http://securityresponse.symantec.com/avcenter/FXStBlst.exe.

The current version of the tool is 1.01 and will have a digital signature timestamp equivalent to 10/05/2005 07:57 AM PDT.

Note: The date and time displayed will be adjusted to your time zone, if your computer is not set to the Pacific time zone.

It has been reported that a computer with this security risk on it may also have other security risks installed. Symantec recommends that the following steps be carried out:

1. Run the Removal Tool.
2. Update the definitions by starting the Symantec program and running LiveUpdate.
3. Run a full system scan to detect any other security risks on the computer.
4. If the scan detects any further security risks, check for removal tools at http://securityresponse.symantec.com/avcenter/security.risks.tools.list.html
5. If there are no removal tools for the security risks that are detected, follow the manual removal instructions listed in the risk report.

Manual Removal
The following instructions pertain to all Symantec antivirus products that support Security Risk detection.

1. Update the definitions.
2. Run a full system scan and delete all the files detected as Adware.StatBlaster.
3. Delete the value that was added to the registry.
   

For specific details on each of these steps, read the following instructions.

1. Updating the definitions
To obtain the most recent definitions, start your Symantec program and run LiveUpdate.

2. Scanning for and deleting the files

1. Start Norton AntiVirus and make sure that it is configured to scan all the files. For more information, read the document, "How to configure Norton AntiVirus to scan all files."
2. Run a full system scan.
3. If any files are detected as Adware.StatBlaster, click Delete.
   
   

3. Deleting the value from the registry

---

WARNING: Symantec strongly recommends that you back up the registry before making any changes to it. Incorrect changes to the registry can result in permanent data loss or corrupted files. Modify the specified keys only. Read the document, "How to make a backup of the Windows registry," for instructions.

---

1. Click Start, and then click Run. (The Run dialog box appears.)
2. Type regedit
   
   Then click OK. (The Registry Editor opens.)
   
   
3. Navigate to the key:
   
   HKEY_LOCAL_MACHINESOFTWAREStatBlaster
   
   
4. In the left pane, delete this key.
   
   
5. Exit the Registry Editor.