AdRotator

Overview

AdRotator, also known as Adware.Clickbank, opens advertisements on your computer. There are indications that AdRotator diplays fake error messages. Users reports:

"Every ten minites I get the "Windows Error Service" Message that, "Windows detected spyware on your computer - three times. Download Free Spyware Scanner and Remover ... Then iexplorer pops up with a nonexistant site = http://hop.clickbank.net/?files/noadware."

"I get this windows system error box that comes up, in sucessions of 3 every 10-15 mins ... Ever 10-15 minutes this little box pops up. The title of the box is: "Windows error service" Windows detected Spyware on your computer download free spyware scanner & remover. If I hit Ok this html comes up but its a blank page at http://hop.clickbank.net/?files/noadware

"Jeg får hele tiden en pop-up, hvor der står, at Windows har observeret Spyware. 'Klik OK for at fjerne det' (når man trykker OK kommer man til Clickbank.net). Samt en, hvor der står, at en tredjepart har fjernet 180search assistant.

The AdRotator files are located in '%SystemDir%\drivers\', '%SystemDir%\inetsrv\' and '%SystemDir%\wbem\'. Note that the AdRotator uses the same file names as legitimate files from Microsoft. The legitimate files, csrss.exe, services.exe and svchost.exe are located in %SystemDir%. Do not delete the legitimate files.

Note: %SystemDir% is a variable (?). By default, this is C:\Windows\System (Windows 95/98/Me), C:\WINNT\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

AdRotator is mentioned at the security forums where its removal is recommended [1] [2] [3] [4] [5].

TrendMicro and Symantec offers more information about AdRotator.

Classification

Adware

Files

csrss.exe, services.exe, svchost.exe

If you have any of the files related to AdRotator on your system, please send them for additional analysis. Generally, I have only analysed a few versions for each software component listed at this web site. With your help I will be able to look at both old and more recent versions of the AdRotator software. Thank you very much for your time!

Log references

Log 530

Vendor

Unknown

Privacy policy

No privacy policy available.

Detection

Bazooka Adware and Spyware Scanner detects AdRotator. Bazooka is freeware and detects spyware, adware, foistware, trojan horses, viruses, worms and other potentially unwanted applications. Read more »

Uninstall AdRotator with FreeFixer

I'm working on a general purpose tool for removing unwanted software. The tool is called FreeFixer and can help you remove unwanted Browser Helper Objects, Internet Explorer toolbars and software that starts automatically when you reboot your computer, so it can offer some assistance while uninstalling AdRotator. The manual removal instructions listed below will help you to identify what to delete with FreeFixer.

Read more about FreeFixer.

Manual removal

Please follow the instructions below if you would like to remove AdRotator manually. Please notice that you must follow the instructions very carefully and delete everything that is mentioned. In most cases the removal will fail if one single item is not deleted. If AdRotator remains on your system after stepping through the removal instructions, please double-check by stepping through them again.

1. Start your computer in safe mode.
2. Start the registry editor. This is done by clicking Start then Run. (The Run dialog will appear.) Type regedit and click OK. (The registry editor will open.)
3. Browse to the key:
   'HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Run'
4. In the right pane, delete the value called 'AdRotator.Application', if it exists.
5. In the right pane, delete the value called 'SuperBar.Component', if it exists.
6. In the right pane, delete the value called '{357AA41A-B7A8-4632-A27D-5B980B25CF43}', if it exists.
7. Exit the registry editor.
8. Start Windows Explorer and delete:
   %SystemDir%\drivers\csrss.exe
   %SystemDir%\wbem\svchost.exe
   %SystemDir%\inetsrv\services.exe
   Note: %SystemDir% is a variable (?). By default, this is C:\Windows\System (Windows 95/98/Me), C:\WINNT\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

Problems uninstalling? Click here.

I'm looking for your help!

Thank you for using my site, I hope you find it useful. I'm looking for help from all users, please read more.

Contact information for AdRotator's vendor

In order to provide correct, accurate and updated information about AdRotator I encourage the vendor to contact me if any part of this write-up needs a revision.