Hi,
Since last November, I've been hit three times with BetterSurf infections. Each time, the Bettersurf trojan installed under a different name. The first time, it was called Bettersurf. I forget what it was called on the second occasion, but the effects were identical as was the structure of the program in its install directory. The third time, yesterday, it installed itself as something called "Video Player". Each time, it installed plug-ins in Chrome, Firefox, and IE and started serving up Bettersurf adds. Each time, I disabled the plug-ins and deleted the install directory. Yesterday, I also deleted all the Bettersurf-associated registry keys that I could find.
I'm running Windows 8 and I do most of my web browsing with Chrome. I'm a reasonably sophisticated user and this is the first recurring infection I've had in 20 years on the internet. After the second attack, I installed Avast. Yesterday, I also changed the settings in Chrome so that plug-ins will not start until the user clicks permission.
How does this keep happening? Googling for info suggests that Bettersurf is installed as an add-on during program installation, but I'm pretty careful about that kind of thing and the infections didn't seem to happen when I was installing things. The Bettersurf attacks seem to correlate with visiting certain websites, although I can't be certain. I think the first one happened after I clicked on one of those skeevy click-bait links served below the article on a reputable website. Yesterday, it happened after I hit a site looking for song lyrics. Neither of those are things that I do very often, but correlation isn't causation. Still, in none of the cases do I remember clicking on anything in the suspect web page or giving permission for something to run. Does anybody have any idea how the Bettersurf infection actually works?
Thanks.
