PUP.GameServerB is a potentially unwanted program (PUP) that typically arrives bundled with free gaming software, third-party download managers, or cracked game installers. While technically not a virus in the traditional sense, this software exhibits behavior that most users would find unwelcome: it installs without clear consent, modifies browser settings, displays intrusive advertisements, and can degrade system performance. GameServerB often masquerades as a legitimate gaming utility or "optimization" tool while serving primarily to generate advertising revenue for its operators through affiliate marketing schemes and pay-per-click advertising networks.
This PUP commonly targets gamers seeking free software downloads or performance enhancements for their gaming experience. Once installed, it establishes persistence mechanisms that make it resistant to standard uninstallation procedures, and it may reinstall itself even after users believe they've removed it. The software's bundled nature means many victims don't realize they've agreed to install it alongside a program they actually wanted.
Threat Profile
| Attribute | Details |
|---|---|
| Threat Type | Potentially Unwanted Program (PUP), Adware |
| Family | GameServer family (potentially related to gaming-themed PUP variants) |
| Aliases | Adware.GameServerB, PUP.Optional.GameServer, GameServerB Unwanted Application |
| Platform | Windows 7, 8, 8.1, 10, 11 (all editions) |
| Discovery Period | Active distribution observed in mid-2010s through present |
| Distribution | Software bundlers, free gaming utilities, cracked software, misleading advertisements |
| Persistence Methods | Registry Run keys, scheduled tasks, browser extensions, shell integrations |
| Primary Capabilities | Advertisement injection, browser hijacking, data collection (browsing habits), affiliate link redirection |
| Typical IoCs | Unfamiliar processes in Task Manager, browser extensions not installed by user, modified homepage/search settings |
| Network Behavior | Frequent connections to ad-serving domains, affiliate tracking servers; may download additional PUP components |
| Data at Risk | Browsing history, search queries, clicked links, system specifications (for targeted advertising) |
| Removal Difficulty | Moderate (requires multiple steps; uses persistence mechanisms to survive simple uninstallation) |
How It Spreads
PUP.GameServerB relies heavily on deceptive distribution tactics that exploit users' trust and inattention during software installation. The most common infection vector is bundled installation packages, where GameServerB is included as an "optional" component alongside legitimate software. These bundles frequently use confusing installation wizards that pre-check consent boxes or bury the disclosure of additional software in lengthy terms-of-service agreements that few users read completely.
Gaming communities are particularly targeted because the operators understand that gamers frequently seek free utilities, mods, performance boosters, and cracked versions of paid software. When users download what appears to be a helpful gaming tool from a third-party site, they may unknowingly agree to install GameServerB through an "express" or "recommended" installation option that doesn't clearly disclose all bundled components.
Common distribution methods include:
- Software bundlers and download managers: Third-party download sites that wrap legitimate software in custom installers containing additional PUPs
- Misleading advertisements: Fake "Download" buttons on software repositories, file-sharing sites, or video streaming platforms
- Cracked or pirated software: Illegal downloads of games and applications that include PUPs as "payment" to the distributors
- Fake system optimization tools: Programs claiming to boost gaming performance, clean registries, or update drivers
- Torrents and peer-to-peer networks: Game installers and utilities shared through P2P networks with bundled unwanted software
- Compromised or malicious websites: Sites that automatically trigger downloads or use social engineering ("Your Flash Player is out of date") to convince users to run installers
- Email attachments or links: Less common for this particular PUP, but may arrive via phishing emails disguised as gaming-related content
What It Does On Your Machine
Once installed, PUP.GameServerB establishes itself across multiple system locations to ensure it survives casual removal attempts. The software typically creates one or more executable files in user-specific folders, often with randomized or system-sounding names designed to blend in with legitimate processes. It then registers these executables to launch automatically at system startup through Windows Registry modifications and, in some variants, through scheduled tasks that can reinstall components even if the main files are deleted.
The primary observable behavior involves browser manipulation. GameServerB commonly installs browser extensions or helper objects (BHOs) across all installed browsers—Chrome, Firefox, Edge, and others. These extensions inject advertisements into web pages you visit, replacing legitimate ads with the PUP's own revenue-generating versions, or adding new ad placements where none existed before. You might notice banner ads appearing in unusual locations, pop-under windows opening when you click anywhere on a page, or video advertisements auto-playing without your interaction.
Beyond advertising injection, the software typically modifies your browser's default settings. Your homepage might change to an unfamiliar search portal, your default search engine may redirect to a custom search page (which delivers results from legitimate search engines but tracks your queries and injects sponsored links at the top), and your new tab page might display a grid of sponsored links disguised as "quick access" shortcuts. These modifications persist even if you manually change them back because the PUP's background process monitors these settings and re-applies its changes.
Performance degradation is another common symptom. The constant advertisement loading, background tracking, and communication with remote servers consume system resources. You may notice increased memory usage, higher CPU utilization (especially noticeable on older machines), slower browser response times, and increased network activity even when you're not actively browsing. Some variants of GameServerB also collect and transmit information about your system specifications, installed software, and browsing habits to remote servers, ostensibly for "personalized" advertising but representing a privacy concern.
Manual Removal — Step by Step
Disconnect from the Internet
Before beginning removal, disconnect your computer from the internet either by unplugging the ethernet cable or disabling Wi-Fi. This prevents GameServerB from communicating with its command servers, downloading additional components, or reporting your removal attempts. It also stops the continuous ad injection while you work.
Boot into Safe Mode with Networking
Restart your computer and boot into Safe Mode with Networking. On Windows 10/11, hold Shift while clicking Restart, then navigate to Troubleshoot > Advanced Options > Startup Settings > Restart, and select option 5. Safe Mode loads only essential drivers and services, preventing GameServerB from launching its protection mechanisms that might interfere with removal.
End Malicious Processes
Open Task Manager (Ctrl+Shift+Esc) and look for suspicious processes, particularly those with random names, high memory usage, or no publisher information. Common GameServerB process names include variations of "gsb," "gameserver," or generic names like "svc_host" (note the underscore—the legitimate Windows process is "svchost" without punctuation). Right-click suspicious processes and select "End Task." Note the file location from the process details before ending it—you'll need to delete these files later.
Uninstall via Programs and Features
Open Control Panel > Programs > Programs and Features (or Settings > Apps on Windows 10/11). Look for any recently installed programs you don't recognize, particularly those with names related to "GameServer," gaming utilities you didn't intentionally install, or entries with no publisher or a suspicious publisher name. Uninstall these programs. Be cautious: the uninstaller itself may try to trick you into keeping components or installing additional software through misleading dialog boxes.
Remove Browser Extensions
Open each web browser you use and remove suspicious extensions. In Chrome: menu > Extensions > Manage Extensions—remove anything unfamiliar. In Firefox: menu > Add-ons > Extensions—remove unknowns. In Edge: menu > Extensions—remove unfamiliar items. GameServerB extensions often have vague names like "Helper," "Optimizer," or gaming-related names. If an extension won't allow removal, you may need to reset the browser completely in a later step.
Delete Registry Persistence Keys
Open Registry Editor (type regedit in Start menu) and navigate to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run and HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run. Look for entries pointing to GameServerB executables (check the paths you noted from Task Manager). Right-click these entries and delete them. Also check HKEY_CURRENT_USER\Software and HKEY_LOCAL_MACHINE\Software for a "GameServerB" or similar folder—delete the entire folder if present. Be cautious editing the registry: only delete items you're confident are related to this PUP.
Remove Scheduled Tasks
Open Task Scheduler (search for it in the Start menu), click "Task Scheduler Library," and review the list of scheduled tasks. Look for any tasks with GameServerB-related names or tasks that reference the file paths you identified earlier. Right-click suspicious tasks and select Delete. Pay particular attention to tasks scheduled to run at startup or at regular intervals, as these are often used by PUPs to reinstall themselves.
Delete Program Files
Navigate to the folder locations you identified in Task Manager (typically C:\Users\[YourName]\AppData\Local or AppData\Roaming). Locate the GameServerB folder and delete it entirely. You may also need to search for other randomly named folders created around the same time as your infection. Check both AppData\Local and AppData\Roaming. If you encounter "file in use" errors, ensure you've ended all related processes or restart and try again in Safe Mode.
Scan with Reputable Anti-Malware Tools
Reconnect to the internet and download a reputable anti-malware scanner such as Malwarebytes (free version is sufficient). Run a full system scan to catch any components you may have missed. These tools have signature databases specifically designed to detect PUP variants including GameServerB. Quarantine or delete all detected threats. Consider running a second scanner like AdwCleaner for thorough PUP removal—different tools catch different remnants.
Reset Browser Settings
If advertisements or redirects persist after extension removal, reset each browser to default settings. In Chrome: Settings > Reset settings > Restore settings to original defaults. In Firefox: Help > More troubleshooting information > Refresh Firefox. In Edge: Settings > Reset settings > Restore settings to their default values. This removes any lingering homepage hijacks, search engine changes, or injected scripts that survived extension removal.
Update Passwords from a Clean Device
While GameServerB primarily focuses on advertising revenue rather than credential theft, some variants collect browsing data that could include login information. As a precaution, change passwords for important accounts (email, banking, social media) from a confirmed clean device or after you're certain the removal was successful. Enable two-factor authentication where available.
Reboot and Verify Removal
Restart your computer normally (not in Safe Mode) and monitor for signs of reinfection. Open Task Manager and check running processes for anything suspicious. Open your browsers and verify that homepages, search engines, and new tab pages are set to your preferences. Browse normally for 10-15 minutes and watch for injected advertisements or pop-ups. If issues return, the PUP may have a component you missed—repeat the process or bring the machine to a professional.
Prevention
- Download software only from official sources. Go directly to developers' websites or use the Microsoft Store. Avoid third-party download sites that bundle software with unwanted extras. If you must use a repository site, choose the "direct download" option rather than their custom downloader.
- Always choose "Custom" or "Advanced" installation. Never click through installations using the "Express" or "Recommended" options. Custom installations reveal bundled software and allow you to decline additional programs. Read each screen carefully and uncheck any pre-selected boxes for software you don't want.
- Keep legitimate security software active and updated. A reputable antivirus with real-time protection can block many PUP installations before they occur. Windows Defender is adequate if kept current, or consider commercial solutions with stronger PUP detection. Ensure real-time protection is enabled—scheduled scans alone aren't sufficient.
- Avoid pirated or cracked software. Illegally distributed games and applications are primary PUP vectors. Beyond the legal and ethical issues, the risk of bundled malware far exceeds any money saved. If software seems too expensive, look for legitimate free alternatives or wait for sales.
- Use an ad-blocker and script-blocker. Browser extensions like uBlock Origin prevent malicious advertisements from loading and reduce exposure to deceptive "Download" buttons. Script blockers like NoScript (Firefox) or ScriptSafe (Chrome) prevent drive-by download attempts, though they require learning which scripts to allow.
- Keep your operating system and all software updated. Software vulnerabilities can allow PUPs to install with reduced warnings or bypass security measures. Enable automatic updates for Windows and all installed applications, particularly browsers, Java, Adobe products, and media players.
- Educate other users on your computer. If family members or employees use your machine, ensure they understand not to install software without verifying it's legitimate. Create separate user accounts with standard (non-administrator) privileges for daily use—this limits what software can install system-wide without your knowledge.
- Regularly review installed programs and browser extensions. Monthly, open Programs and Features and scan for anything unfamiliar. Check browser extensions in all installed browsers. Remove anything you don't actively use or don't remember installing. Many infections persist simply because users don't notice them among legitimate software.
Bring It In
While the manual removal steps above work for technically comfortable users, PUP infections often have components that resist standard removal techniques. GameServerB variants may reinstall themselves from hidden scheduled tasks, registry keys in unexpected locations, or backup copies stored in system restoration points. If you've followed the removal steps but still experience pop-up advertisements, browser redirects, or suspicious system behavior, the infection likely has persistence mechanisms that require professional tools and experience to fully eliminate.
Computer Repair Roswell has handled hundreds of PUP infections, including GameServerB and related adware families. We use professional-grade tools not available to consumers, and our technicians stay current on the latest persistence techniques these programs employ. We'll thoroughly clean your system, verify complete removal with multiple scanning passes, optimize your computer to restore the performance you lost to the infection, and show you exactly what to watch for to avoid reinfection. Call us at (770) 695-6932 or stop by our Roswell location—most malware removals are completed same-day, and we'll explain everything we find in plain English, not tech jargon. Your computer should work for you, not for advertisers.