Belonard Trojan

Also Known As: Belonard virus
Type: Trojan
Distribution: Moderate
Damage level: Medium

Belonard virus removal guide

What is Belonard?

Belonard is a trojan-type virus that targets Counter Strike 1.6 players. This malware infiltrates computers by exploiting remote code execution (RCE) vulnerabilities in the game client. After successful infiltration, Belonard modifies the game client in order to promote various servers, delivers ads, and so forth.

Belonard malware

One of the main Belonard's purposes is to promote various Counter Strike 1.6 servers. Any server owner could pay Belonard's developers a certain fee and the malware will start promoting the server. Belonard achieves this by modifying the infected client so that the server list would prioritize servers promoted via Belonard. Now it is also worth mentioning that the infected machine is also used to spread Belonard even further. Cyber criminals spread Belonard by using proxy servers in order to exploit the aforementioned RCE vulnerabilities. Proxies are meant to redirect users with high response time (ping) to game servers in different geo-locations or hosts. This is being done in order to "smoothen" the connection and gain faster response time. However, cyber criminals use these proxies to redirect users to game servers that execute malicious code and inject Belonard into the system. It is also worth mentioning that this malware runs a proxy server on each infected machine, which also redirects to the same servers designed to execute malicious code. Another distribution method is changing player's nickname. Belonard is designed to assign player's nickname to a URL which is a download link of an already infected Counter Strike 1.6 client. In summary, Belonard itself is not a very high-risk trojan, at least not yet. As mentioned above, its main purpose is to help developers generate revenue by promoting Counter Strike 1.6 game servers. We should also mention that the entire Belonard's network has been shut down. However, it doesn't necessary mean that crooks will not start another infection campaign and continue to promote servers. At this current moment Belonard does not pose any huge threat (its functionality does not include other malware promotion, information stealing, or other similar malicious actions). Therefore, unless cyber criminals will modify this malware, victims will notice only two things: system's performance will decrease (due to running proxy server) and the list of game servers will be modified. One way or another, we highly recommend to eliminate this malware by scanning the system with a reputable anti-virus/anti-spyware suite and removing all detected threats. You should also reinstall the game client. However, be sure to download it only from trustworthy/official sources.

Belonard is a rather uncommon trojan and, thus, it barely shares any similarities with other infections of this type. In most cases, trojan-type infections are designed to record sensitive data (logins/passwords, credit card information, keystrokes, etc.) and inject additional malware into the system. Infections of this type pose huge threat - their presence might lead to serious privacy issues (financial losses, identity theft, etc.), permanent data losses and a variety of other problems. Here are few examples of trojans that pose such threats: AZORult, Adwind, TrickBot, FormBook, Hancitor, Emotet.

How did Belonard infiltrate my computer?

As mentioned above, Belonard is mainly distributed using proxy servers. Therefore, unlike in most of computer infections, Belonard's infiltration is most likely not user's fault. It usually infiltrates whenever user is attempting to connect a server and gets redirected to a malicious websites. However, as said before, Belonard is designed to set victim's in-game nickname to a infected game client download link. This means that developers also proliferate already infected game clients and, thus, Belonard's infection might've occurred because users downloaded the Counter Strike 1.6 game client from an unreliable source. It is worth mentioning that in most cases the main reasons for computer infections are poor knowledge and reckless behavior.

How to avoid installation of malware?

Trojan-type infections are usually proliferated using email spam campaigns (malicious attachments), fake software updaters, cracking tools, third party software download sources (peer-to-peer [P2P] networks, freeware download websites, free file hosting sites, etc.), and other trojans (chain infections). Therefore, to prevent computer infections users must be very cautious when browsing the Internet and downloading/installing/updating software. Always be sure to carefully analyze every single email attachment received. If the file/link is irrelevant and/or the sender looks suspicious, then do not open anything. Download applications only from official sources (via direct download links) and avoid using third party downloaders/installers, since they often include rogue apps. It is important to keep installed applications (as well as operating system) up-to-date. Yet this should be achieved only through implemented functions or tools provided by the official developer. We recommend to never use any software cracking tools, since software piracy is considered a cyber crime and, on top of that, the risk of infections is extremely high. Lastly, always be sure to have a legitimate anti-virus/anti-spyware suite installed and running. These tools will help you protect the system, because they're more than likely to detect and eliminate malware before the system is damaged. If you believe that your computer is already infected, we recommend running a scan with Spyhunter for Windows to automatically eliminate infiltrated malware.

Instant automatic removal of Belonard virus: Manual threat removal might be a lengthy and complicated process that requires advanced computer skills. Spyhunter is a professional automatic malware removal tool that is recommended to get rid of Belonard virus. Download it by clicking the button below:
▼ DOWNLOAD Spyhunter By downloading any software listed on this website you agree to our Privacy Policy and Terms of Use. Free scanner checks if your computer is infected. To remove malware, you have to purchase the full version of Spyhunter.

Quick menu:

How to remove malware manually?

Manual malware removal is a complicated task, usually it's better to let antivirus or anti-malware programs do it automatically. To remove this malware we recommend using  Spyhunter for Windows. If you wish to remove malware manually, the first step is to identify the name of the malware that you are trying to remove. Here's an example of a suspicious program running on user's computer:

malicious process running on user's computer sample

If you checked the list of programs running on your computer, for example using task manager and identified a program that looks suspicious you should continue with these steps:

manual malware removal step 1 Download a program called Autoruns. This program shows auto-start applications, Registry and file system locations:

screenshot of autoruns application

manual malware removal step 2Restart your computer into Safe Mode:

Windows XP and Windows 7 users: Start your computer in Safe Mode. Click Start, click Shut Down, click Restart, click OK. During your computer start process, press the F8 key on your keyboard multiple times until you see the Windows Advanced Option menu, and then select Safe Mode with Networking from the list.

Safe Mode with Networking

Video showing how to start Windows 7 in "Safe Mode with Networking":

Windows 8 users: Start Windows 8 is Safe Mode with Networking - Go to Windows 8 Start Screen, type Advanced, in the search results select Settings. Click Advanced startup options, in the opened "General PC Settings" window, select Advanced startup. Click the "Restart now" button. Your computer will now restart into the "Advanced Startup options menu". Click the "Troubleshoot" button, and then click the "Advanced options" button. In the advanced option screen, click "Startup settings". Click the "Restart" button. Your PC will restart into the Startup Settings screen. Press F5 to boot in Safe Mode with Networking.

Windows 8 Safe Mode with networking

Video showing how to start Windows 8 in "Safe Mode with Networking":

Windows 10 users: Click the Windows logo and select the Power icon. In the opened menu click "Restart" while holding "Shift" button on your keyboard. In the "choose an option" window click on the "Troubleshoot", next select "Advanced options". In the advanced options menu select "Startup Settings" and click on the "Restart" button. In the following window you should click the "F5" button on your keyboard. This will restart your operating system in safe mode with networking.

windows 10 safe mode with networking

Video showing how to start Windows 10 in "Safe Mode with Networking":


manual malware removal step 3Extract the downloaded archive and run Autoruns.exe file.

extract and run autoruns.exe

manual malware removal step 4In the Autoruns application click "Options" at the top and uncheck "Hide Empty Locations" and "Hide Windows Entries" options. After this procedure click the "Refresh" icon.

Click 'Options' at the top and uncheck 'Hide Empty Locations' and 'Hide Windows Entries' options

manual malware removal step 5Check the list provided by Autoruns application and locate the malware file that you want to eliminate.

You should write down it full path and name. Note that some malware hides their process names under legitimate Windows process names. At this stage it's very important to avoid removing system files. After you locate he suspicious program you want to remove right click your mouse over it's name and choose "Delete"

locate the malware file you want to remove

After removing the malware through Autoruns application (this ensures that the malware won't run automatically on the next system startup) you should search for the malware name on your computer. Be sure to enable hidden files and folders before proceeding. If you find the file of the malware be sure to remove it.

searching for malware file on your computer

Reboot your computer in normal mode. Following these steps should help remove any malware from your computer. Note that manual threat removal requires advanced computer skills, it's recommended to leave malware removal to antivirus and anti-malware programs. These steps might not work with advanced malware infections. As always it's better to avoid getting infected that try to remove malware afterwards. To keep your computer safe be sure to install latest operating system updates and use antivirus software.

To be sure your computer is free of malware infections we recommend scanning it with Spyhunter for Windows.