Downloader.Surf and Keep

Posted: January 2, 2014

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Ranking:	8,140
Threat Level:	2/10
Infected PCs:	9,870

First Seen:	October 2, 2013
Last Seen:	March 9, 2025
OS(es) Affected:	Windows

Surf and Keep is adware that claims to provide advantages to help your Web-browsing experience, when its real primary functions are to display advertisements in your browser – whether or not you appreciate it. Although displaying advertisements isn't sufficiently risky to make it viable to categorize Surf and Keep as a threat, malware researchers still find most adware programs to include habitual security issues that may harm your computer indirectly. Until deleting Surf and Keep completely has been verified, your PC could be at risk for common advertising-based threats.

The Content that Surf and Keep Makes You Keep on Surfing

Surf and Keep is one of the most recent cases of advertising-based browser add-ons that act as if they provide tangible benefits to your browser but actually have extremely limited functions, most of which are based on loading advertisements. Advertisements from Surf and Keep may be designed to affect more than one browser, regardless of whether you see the Surf and Keep add-on's interface additions in just one browser or multiple brands of them. In most cases, all popular browsers, such as Internet Explorer, Opera, Chrome, Firefox and Safari may be affected, although this may change (due to Surf and Keep updating and modifying its capabilities automatically).

Surf and Keep's advertisements may be formatted as sponsored 'search result' links, as separate pop-ups (or pop-under windows), as injected banners, as product/price comparison thumbnails or as keyword links to topical advertisements. Since Surf and Keep doesn't try to select corrupted advertisements intentionally, malware researchers don't consider Surf and Keep a threat, but Surf and Keep's advertisements still may be typical and difficult-to-avoid sources of attacks against your computer, or its users.

Keeping a Healthy Distance Away from the Latest Adware

Surf and Keep may endanger your PC by exposing it to advertisements meant to mislead you into installing harmful software, or to advertisements that use exploits to install their payloads. Even if you have sufficient anti-malware protection for your PC, no amount of security software can improve the performance problems that an advertisement-infested browser can face, or prevent you from giving personal information to the phishing scams so common in adware advertisements. For all of these reasons, deleting Surf and Keep always is considered the best choice by malware researchers, particularly considering its lack of a verifiable business history to authenticate its choices in advertising partners.

Surf and Keep and other adware programs may make browser changes that they will not remove, if you delete them by normal channels. Anti-malware programs with good histories against unwanted browser add-ons should be able to delete these settings changes along with deleting Surf and Keep. Along similar lines, they also can detect many of the free software bundles that are most likely to install Surf and Keep, whether you're downloading them from torrent networks, freeware sites or other sources of less than pristine safety.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:

C:\Program Files (x86)\YoutubeAdblocker\K.X64.DLL.mal

File name: K.X64.DLL.mal
Size: 473.6 KB (473600 bytes)
MD5: a968629900781adf57bbee275e58889d
Detection count: 40
Mime Type: unknown/mal
Path: C:\Program Files (x86)\YoutubeAdblocker\K.X64.DLL.mal
Group: Malware file
Last Updated: December 13, 2024

Registry Modifications

The following newly produced Registry Values are:

HKEY..\..\..\..{RegistryKeys}SOFTWARE\Classes\andSOFTWARE\Classes\ANNdSOFTWARE\Classes\Download,SOFTWARE\Classes\keePSOFTWARE\Classes\keeP.2.19SOFTWARE\Classes\keep.2.2SOFTWARE\Classes\keep.2.3SOFTWARE\Classes\keep.suarfSOFTWARE\Classes\keeP.surfSOFTWARE\Classes\keep.suurfSOFTWARE\Classes\keeppSOFTWARE\Classes\keepp.2.3SOFTWARE\Classes\keepp.sUrfSOFTWARE\Classes\suarfSOFTWARE\Classes\sUrfSOFTWARE\Classes\surfuSOFTWARE\Classes\suurfSoftware\Microsoft\Internet Explorer\Approved Extensions\{1DCBF54A-0CE7-8678-D0EB-F74148E70306}Software\Microsoft\Internet Explorer\Approved Extensions\{CE850C84-F2FF-EB6D-409C-43D7E01B3D3C}SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{0650A372-1420-8A01-16FF-07591313CECF}SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{06B89C38-F3B8-3D85-0B48-19E7AF24AA53}SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{1DCBF54A-0CE7-8678-D0EB-F74148E70306}SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{57EBF228-1FD4-9019-70C1-40540E5C545C}SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{A2F2DF27-96AC-778C-E65E-BCF387C9C956}SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{BA244416-A4B6-8DF8-B225-70C996B4ABD4}SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{CE850C84-F2FF-EB6D-409C-43D7E01B3D3C}HKEY_LOCAL_MACHINE\Software\[APPLICATION]\Microsoft\Windows\CurrentVersion\Uninstall..{Uninstaller}{A35CA8FF-CB7D-8361-1CB9-83219CD11C78}

Additional Information

The following directories were created:

%ALLUSERSPROFILE%\sourfa andd! kkeep%ALLUSERSPROFILE%\surfe and keep%ALLUSERSPROFILE%\surrf and okEep%AllUsersProfile%\saurrf aand! kkeep%AllUsersProfile%\siurf and keep%AllUsersProfile%\suerf aNdd kkEep%AllUsersProfile%\surf eandu keep%AllUsersProfile%\surf! aand keep%PROGRAMFILES%\Suurf and keep%PROGRAMFILES%\sourfa andd! kkeep%PROGRAMFILES%\surfe and keep%PROGRAMFILES%\surrf aand Keep%PROGRAMFILES(x86)%\Suurf and keep%PROGRAMFILES(x86)%\sourfa andd! kkeep%PROGRAMFILES(x86)%\surf and, kEep%PROGRAMFILES(x86)%\surfe and keep%PROGRAMFILES(x86)%\surff and keep%ProgramFiles%\saurrf aand! kkeep%ProgramFiles%\siurf and keep%ProgramFiles%\suRf and keeep%ProgramFiles%\suerf aNdd kkEep%ProgramFiles%\surf and kkeEp%ProgramFiles%\surf eandu keep%ProgramFiles(x86)%\saurrf aand! kkeep%ProgramFiles(x86)%\siurf and keep%ProgramFiles(x86)%\suRf and keeep%ProgramFiles(x86)%\suerf aNdd kkEep%ProgramFiles(x86)%\surf and kkeEp%ProgramFiles(x86)%\surf eandu keep