Remove AdultLinks

What is AdultLinks ?

AdultLinks is a spyware that adds links to porn and other sites to the Internet Explorer Favorites menu. Whilst it is installed, it can add more links when directed to do so by a web page. It is Installed by ActiveX drive-by-download from its controlling servers, mainentrypoint.com. This may be triggered by some pop-up ads.

AdultLinks variants

Open the 'Downloaded Program Files' folder in the Windows folder, right-click the 'NullCtrl Class' entry, and remove it. You can also delete the key 'HKEY_CURRENT_USER\Software\LinkZZ' from the registry to clean up if you like.

AdultLinks behavior

Stealth Tactics
Changes browser
Stays Resident
Connects to the internet
Shows ads

AdultLinks Removal Instructions:

The QcBar variant should have an 'uninstall' option on the 'Adult Links' toolbar menu.

LinkZZ variant
Open the 'Downloaded Program Files' folder in the Windows folder, right-click the 'NullCtrl Class' entry, and remove it. You can also delete the key 'HKEY_CURRENT_USER\Software\LinkZZ' from the registry to clean up if you like.

QcBar variant
Open the registry (click 'Start', choose 'Run' and enter 'regedit') and delete the following keys:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\
HKEY_CURRENT_USER\Software\QcBar
HKEY_CLASSES_ROOT\QcBar
HKEY_CLASSES_ROOT\QcBar.1
HKEY_CLASSES_ROOT\Allch.IEObj
HKEY_CLASSES_ROOT\Allch.IEObj.1
HKEY_CLASSES_ROOT\CLSID\
HKEY_CLASSES_ROOT\CLSID\
HKEY_CLASSES_ROOT\Interface\
HKEY_CLASSES_ROOT\Interface\
HKEY_CLASSES_ROOT\TypeLib\
HKEY_CLASSES_ROOT\TypeLib\
Restart Windows. You can now delete the program files to clean up: open a DOS command prompt window (from Start->Programs->Accessories) and enter the following commands:

del "%WinDir%\Downloaded Program Files\allch.dll"
del "%WinDir%\Downloaded Program Files\QcBar.dll"
QaBar variant
Open a DOS command prompt window (from Start->Programs->Accessories) and enter the following commands:

cd "%WinDir%\System"
regsvr32 /u "..\Downloaded Program Files\QaBar.dll"
del "..\Downloaded Program Files\QaBar.inf"
You can then delete the file 'insqcb.ins' in the System folder (inside the Windows folder, called 'System32' on Windows NT, 2000 and XP or just 'System' under Windows 95, 98 and Me), and the 'Adult Links Daily' icons on the Start Menu and Desktop, plus the 'QcBar' folder inside the Application Data folder. (Application Data can be found in the Windows folder under Windows 95, 98 and Me, or in your user 'Profiles' folder in the Windows folder under Windows NT, or in your user 'Documents and Settings' folder in 2000 and XP.) You can also delete the registry key 'HKEY_LOCAL_MACHINE\Software\QcBar' to clean up if you like.

All variants
The 'Adult Links', 'Adult Search', 'Sports' and 'Instant Viagra' folders can be deleted from the Favorites folder. Then, if your search settings have been hijacked

QaBar and some releases of QcBar also hijack address bar searches to point to search-itnow.com. To stop this happening, go to the Programs tab in Internet Options and click 'Reset web settings'.

AdultLinks Removal