WinSurf (also known as Trojan.Win32.SystemCrash) is a clone of the infamous Zlob trojan, and, like the Zlob, WinSurf has the function to promote rogue anti-spyware programs - fake spyware removers, which use scare tactics to intimidate the user into buying their "licensed versions". One rogue in particular has been advertised by this malicious parasite - MalwareBell. WinSurf disguises itself as a video codec and thus infiltrates the system, at which point it will display popups and fake system notifications claiming the user is "infected".
