A real troublemaker: AppToPort.dll

OK, now I'm really mad!

In the last couple of days I've noticed that my both IE 7 and Firefox 2.0 (all recently updated) browsers are crashing randomly. Sometimes it's when I'm clicking an image, sometimes it's when I open a new tab, and in the other time it's just crash without any logical reason. BOTH IE 7 and Firefox 2.0 (did I already mention that?).

So, a red light was turned on. What, in the name of the holy Anthony Parker, was happend now!? Wasn't I good enough to my computer?
Alright alright, relax and think! The first blame is automatically ascribed to Microsoft - it's easy, you know, to get mad of them, not always because of their products but (most of the time) because of their endless funds... jealousy. Human nature. Linux users nature.

Googling for a good reason, I found two repetitive symptoms:

• A problematic windows update (a.k.a as KBxxxxxx)
• A malware

...Of course! those windows updates! I've just update my computer with recent windows fixes - it must be one of them! And regard a malware - no chance. My computer is fortified like a 17th century british castle: Anti spyware (AVG anti spyware 7.5), antivirus (NOD32), firewall (Netlimiter 2).

So, turning to my best psychologist, the "add/remove programs" window, I started remove the latest windows updates, one by one - in order to find the troublemaker. Restarting etc... and at last - Nothing. Both browsers remains on their own crashing behavior. Damn.
So, turning back all updates (restarting bla bla bla), I switched to option no.2: a possible malware.

A malware? in my precious computer?! how could it be??

I started scanning my computer with all my weapons: full antivirus system scan (twice! - took all night), full anti spyware scan, using registry fix tools, monitoring the firewall again and again. Nothing. Except of standard tracking cookies I found nothing.
Thus, to my great sorrow, I turned to google for some more help.

One system tool attracted my attention: HijackThis, produced by Mergin.org (download here). This freeware is scanning all active processes (hidden and unconcealed) and gives a general expertise for each found process - is it evil or a good one.

A screenshot of HijackThis 2.00

I passed all the results one by one - and of all entries I found one suspect: some dll file named "AppToPort.dll" which lays down in the folder "C:\Program Files\bulletproofsoft.com\BPS Spyware & Adware Remover\". Hmm, interesting. In one of the last days I remember I downloaded and installed an evaluation copy of an anti spyware tool named "BPS SpyWare/Adware Remover" from here (I DON'T recommend you to download it now, unless you want to get mad for next two days as I was...). A web advertisement said that this anti spyware tool is one of the best, so I gave it a try. A few hours later I concluded it is not good enough for me, so I uninstalled it tidily.

So I thought...

Googling once again for the "AppToPort.dll" file, I couldn't absolutely conclude that this is a kind of troublemaker, but since 90% of the results was in the context of spyware and malware problems, it strengthened my suspicion.
Continue googling I found a free anti spyware software called "Spybot S&D" (download here). I heared of it before, but never had any experience with. The installation is very simple, and after a short software update I started to scan my computer once again. This software is awesome! 10 minutes passed and the bell ring wasn't late: "BPS SpyWare/Adware Remover" was found as (quote) "a software that pretends to be an anti spyware but actually is a trojan". What the hell?

A screenshot of Spybot S&D 1.4

Moreover, the Spybot couldn't delete all the remains of the "BPS spyware" (and as I said, I unistalled it tidily) becasue our friend, "AppToPort.dll", was in the use of the system. So I tried to remove this file on a Safe Mode, but it didn't go. It still was in the use of the system.
Again, googling, I found what I was looking for: a little application called "LSP-Fix" produced by cexx.org. It seems that the "AppToPort.dll" is a type of "Layered Service Provider" (read more here) and it cannot be removed elegantly. So I downloaded this little application from here, and did as follows:

1. When LSPFix has started, put a checkmark in "I know what I am doing".
2. In the Keep column, select all apptoport.dll entries and click the arrow to move them into the remove column.
3. Click the Finish button to remove them.
4. Boot into Safe Mode
5. Delete the following folder: "C:\Program Files\bulletproofsoft.com"
6. Restart as usual.

A screenshot of LSP-Fix v1.1

At last, my saga was ended. The IE 7 and Firefox 2.0 was once again a stable and pleasant place to browse on.
(And I truly regret about the previous slurs regard Microsoft's updates... They are just great!).

And for all of you, be aware: DON'T USE "BPS SpyWare/Adware Remover"!
IT'S AN UGLY TORJAN!!!