Adware.Bloson is a potentially unwanted program (PUP) that infiltrates Windows systems to inject advertisements into web browsers and track user activity for revenue generation. Part of a broader family of adware variants that emerged in the mid-2010s, Bloson typically arrives bundled with free software installers and immediately begins modifying browser settings to deliver intrusive pop-ups, banners, and sponsored search results. While not as destructive as ransomware or banking trojans, this adware degrades system performance, compromises browsing privacy, and creates security vulnerabilities by exposing users to potentially malicious advertising networks.
Computer Repair Roswell regularly encounters Adware.Bloson infections on both home and small business machines in the Atlanta metro area. The threat is particularly persistent due to its multi-component architecture—removing the visible browser extension often leaves behind system-level processes that reinstall the adware within hours. Complete remediation requires addressing registry modifications, scheduled tasks, and residual files across multiple Windows directories.
Threat Profile
| Attribute | Details |
|---|---|
| Threat Type | Adware / Potentially Unwanted Program (PUP) |
| Family | Adware.Bloson (multiple variants) |
| Aliases | PUP.Optional.Bloson, Adware/Bloson, BrowserModifier:Win32/Bloson |
| Platform | Windows 7/8/8.1/10/11 (32-bit and 64-bit) |
| Target Browsers | Google Chrome, Mozilla Firefox, Microsoft Edge, Internet Explorer |
| Distribution Method | Software bundling, fake updates, misleading installers |
| Persistence Mechanisms | Registry Run keys, scheduled tasks, browser extension policies, system services |
| Primary Capabilities | Ad injection, browser hijacking, search redirection, user tracking, affiliate fraud |
| Data Collection | Browsing history, search queries, clicked links, IP addresses, system information |
| Common Artifacts | Random-named executables in %APPDATA% and %LOCALAPPDATA%, modified browser shortcuts, unfamiliar extensions |
| Network Behavior | Frequent connections to advertising domains, affiliate networks, and tracking servers |
| Removal Difficulty | Moderate to High (due to multiple components and self-repair mechanisms) |
How It Spreads
Adware.Bloson primarily spreads through deceptive software bundling—a distribution technique where the adware is packaged with legitimate free applications. Users download what appears to be a useful utility like a PDF converter, video player, or system optimizer, but the installer includes Bloson as an "optional offer" buried in dense terms-of-service text or pre-checked boxes during installation. Many users click through setup wizards quickly using "Express" or "Recommended" settings, unknowingly authorizing the adware installation.
The threat also propagates through fake software update notifications. Users encounter pop-ups claiming their Flash Player, Java, or media codec is outdated and needs immediate updating. Clicking the update button downloads an installer that contains Bloson rather than the legitimate software. These fake update pages often mimic the visual design of authentic vendor sites to appear trustworthy.
Common distribution vectors for Adware.Bloson include:
- Freeware and shareware installers from third-party download sites that monetize through adware bundling
- Fake system optimization tools advertised through malvertising campaigns on legitimate websites
- Trojanized software cracks and key generators for commercial applications
- Misleading "Update Required" pop-ups on compromised or low-quality websites
- Malicious browser extensions promoted through social engineering on tech support scam pages
- Email attachments disguised as invoice PDFs or shipping notifications that actually launch installers
- Peer-to-peer file sharing networks where malicious actors upload infected versions of popular software
What It Does On Your Machine
Once installed, Adware.Bloson establishes multiple persistence mechanisms to ensure it survives basic removal attempts and restarts. The infection typically consists of a main executable with a randomized name stored in Windows application data directories, along with supporting files that handle browser modification and ad injection. The adware creates scheduled tasks that run at system startup and periodically throughout the day to verify its components remain active and reinstall any that have been deleted.
The most visible symptom is aggressive advertisement injection across all web browsers. Users encounter pop-up windows advertising dubious products, banner ads overlaying legitimate website content, in-text advertising where random words become hyperlinks, and full-page interstitial ads that appear before actual website content loads. These advertisements generate revenue for Bloson's operators through affiliate marketing programs—every click and impression earns payment from advertising networks. The ads frequently promote questionable products like fake antivirus software, work-from-home schemes, and "PC optimization" tools that are themselves potentially unwanted programs.
Beyond visible advertisements, Bloson actively tracks user behavior to build detailed profiles for targeted advertising. The adware monitors which websites you visit, what search terms you enter, which links you click, and how long you spend on specific pages. This data is transmitted to remote servers operated by the adware's distributors and sold to advertising networks. While Bloson typically doesn't target banking credentials or passwords directly, the tracking represents a significant privacy violation and the collected data could be exposed in a breach of the advertising network's servers.
System performance degradation is inevitable with Bloson infections. The constant background processes consume CPU cycles and memory, web pages load slowly due to dozens of additional advertising elements downloading, and browser crashes become more frequent. Some variants also modify Windows security settings to disable built-in protections, making the system more vulnerable to additional malware infections. In business environments, the constant ad distractions reduce employee productivity and the privacy violations may create compliance issues with regulations like GDPR or HIPAA.
Manual Removal — Step by Step
Disconnect from the Internet
Unplug your ethernet cable or disable WiFi before beginning removal. This prevents the adware from downloading additional components, receiving updated instructions from its command servers, or transmitting collected data during the cleanup process.
Boot into Safe Mode with Networking
Restart your computer and press F8 repeatedly during boot (or use the Shift+Restart method in Windows 10/11 through Settings > Update & Security > Recovery). Select "Safe Mode with Networking" from the boot options menu. This loads Windows with minimal drivers and prevents most adware components from launching automatically, making removal significantly easier.
Uninstall Suspicious Programs
Open Control Panel > Programs and Features (or Settings > Apps in Windows 10/11). Sort by "Installed On" date to identify recently added software. Look for programs you don't remember installing with names that sound generic like "System Optimizer," "PC Helper," or entries with random characters. Uninstall anything related to Bloson or installed around the time problems began. Some adware uninstallers are deliberately unhelpful—if one opens a browser to a survey or tries to convince you to keep the program, close it and proceed to the next step.
Remove Browser Extensions and Reset Settings
Open each browser and navigate to the extensions/add-ons manager. Remove any extensions you didn't intentionally install, especially those with vague names or lacking recognizable developers. In Chrome, check Settings > Search Engine and Settings > On Startup to restore your preferred search engine and homepage. In Firefox, visit about:config and search for any modified preferences containing "bloson" or unfamiliar domains. Consider using the browser's built-in reset function to restore defaults, but note this removes all extensions and settings.
Delete Adware Files and Folders
Open File Explorer and navigate to C:\Users\[YourUsername]\AppData\Local\ and \AppData\Roaming\. Look for folders with random GUID names (long strings of letters and numbers in braces) or folders containing "Bloson" in the name. Delete these entire folders. Also check C:\Program Files\ and C:\Program Files (x86)\ for any Bloson-related directories. You may need to enable "Show hidden files" in File Explorer's View options to see the AppData folder.
Clean Registry Persistence Keys
Press Windows+R, type "regedit" and press Enter to open the Registry Editor. Navigate to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\ and look for entries pointing to files you deleted in the previous step. Delete these entries. Repeat for HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\. Use Ctrl+F to search the entire registry for "bloson" and delete any keys that appear. Be extremely careful in the registry—only delete entries you're confident are related to the infection.
Remove Scheduled Tasks
Press Windows+R, type "taskschd.msc" and press Enter to open Task Scheduler. Expand Task Scheduler Library in the left panel and look through the list for tasks with names related to Bloson or with suspicious random names. Right-click any suspicious tasks and select Delete. Check both the root library and the Microsoft\Windows subfolder where adware often hides tasks among legitimate Windows maintenance jobs.
Run Malwarebytes or Similar Scanner
Reconnect to the internet and download Malwarebytes Free (from malwarebytes.com only—avoid third-party download sites). Install and run a full system scan. Malwarebytes excels at detecting adware components that manual removal might miss, including browser policies, Windows services, and layered service providers. Quarantine or delete all detected items. Restart the computer after the scan completes.
Verify Browser Behavior
Open each browser and visit several different websites to confirm ads are no longer appearing. Test that your default search engine functions correctly and the homepage loads as expected. If problems persist, you may need to completely uninstall and reinstall the affected browsers. Before reinstalling, manually delete the browser's data folder from AppData to ensure no remnants remain.
Change Important Passwords
While Bloson primarily tracks browsing activity rather than stealing credentials, some variants include data-harvesting capabilities. From a known-clean device or after verifying your computer is fully cleaned, change passwords for critical accounts including email, banking, and any sites where you've entered payment information. Enable two-factor authentication where available for an additional security layer.
Prevention
- Always use Custom/Advanced installation options when installing free software, and carefully read each screen to uncheck bundled offers before proceeding. Never click through installers using "Express" or "Recommended" settings without reviewing what's actually being installed.
- Download software only from official vendor websites or the Microsoft Store. Avoid third-party download sites like download.com, softonic.com, or similar aggregators that profit from bundling adware with legitimate applications.
- Keep legitimate software updated so you recognize fake update notifications. Real vendors like Adobe and Microsoft deliver updates through the application itself or Windows Update—they don't trigger browser pop-ups telling you to download updates from random websites.
- Use a reputable ad-blocker extension like uBlock Origin in your browser. This prevents malicious advertising (malvertising) from displaying and blocks many of the deceptive download buttons on sketchy websites. Ad-blockers also improve page load times and reduce tracking.
- Maintain current antivirus software with real-time protection enabled. Windows Defender (built into Windows 10/11) provides adequate protection for most users when kept updated. Consider supplementing with periodic Malwarebytes scans.
- Enable browser security features including pop-up blocking and phishing/malware protection. Both Chrome and Firefox have these enabled by default, but verify they haven't been disabled by previous infections or well-meaning but uninformed tech help.
- Be skeptical of "your computer is infected" warnings that appear in web browsers. Legitimate antivirus software installed on your computer generates these alerts—websites cannot actually scan your system. These browser-based warnings are always scams designed to install adware or worse.
- Create standard user accounts for daily computing rather than using an administrator account for routine tasks. This prevents many types of malware from installing system-level components without your explicit permission through a UAC prompt.
Bring It In
While the manual removal steps above work for straightforward Adware.Bloson infections, many variants include rootkit components, browser-level policies that resist manual changes, or connections to additional malware families that require specialized tools to fully remove. If you're uncomfortable editing the Windows registry, can't access Safe Mode, or continue seeing symptoms after attempted removal, professional help is the faster and safer option.
Computer Repair Roswell has been cleaning adware infections from Roswell and North Fulton County computers since 2009. We maintain a comprehensive malware removal toolkit with commercial-grade utilities not available to consumers, and our technicians stay current on the latest adware persistence techniques. Most adware removals take 2-4 hours, and we can often accommodate same-day or next-day service. Call (770) 667-9824 or stop by our shop at 1150 Alpharetta Street in Roswell. We'll diagnose the infection, provide an upfront price quote, and have your computer running clean before the day is out.