internetinspiration.co.uk
Privacy and Security
Browser helper objects (BHO) & Browser hijackers
Browser helper objects, or BHO are small applications that add a specific feature to your browser. Most are
useful features to carry out a specific task
by clicking a button which is added to your tool bar, or a specific search engine.The fact that BHO's can be installed without your knowledge and are capable of doing almost anything to your computer, including change or delete settings or parts of your hard drive, they are another area for concern and worth mentioning.
When your browser loads it will check the registry and add any BHO's it finds. This ensures they are loaded every time you access the internet making them an attractive avenue for abuse.
BHO's can literally take control of your browser and what web sites you see, advertisements, pop ups (including pornographic ones) can appear to be connected to a web page, when actually they are being generated by un-associated servers.
Their connections out of your computer are also hidden from firewalls, as their programmes are worked into the browser, you will receive a request from your browser not the BHO to access the internet, in a seemingly harmless manner, or worse still will add themselves to your firewalls trusted sites to avoid the access request.
They are usually fuelled by someone determined to get their commission earning advertisements in your computer and can do things like
- supply an endless stream of pop up advertisements
- redirect search enquiries and error pages
- add or change advertisements on web pages, which in effect rip off webmasters as their pages are being used, without permission, fees or commissions.
A BHO cannot install itself. They will be carried into your computer by a trojan or spyware application as one of their programmed functions. The BHO component of a malware application is a .dll file (Dynamic Link Library), which allow many separate programs to access or share a single application. In this case, the .dll file gives the Malware access to Internet Explorer.
. There is an excellent free tool by Definitive solutions which can show you all the BHO's that have been installed in your computer, and offers details like who put it there, so you can decide whether to allow or block it. Get BHO DEMON.
The list at the bottom of the page might also help you filter out the unwanted by naming applications that use BHO's in a way that compromises your privacy and security.
Spyware Guard is a free download that will go some way to preventing them installing in the first place.
Browser hijackers.
Unfortunately, an ever increasing number of companies are prepared to use underhand methods of getting visitors to their sites, or view their commission earning advertisements, and of course, there is an increasing number of people prepared to create new ways of providing this service.They employ a variety of methods to trick you into allowing them to do this, or even worse, devise ways of secretly taking over your internet browsing.
Some pose more of a threat than just your PC privacy, some of them are fuelled by pornography, even that which surpasses what is considered to be moral or legal in most countries.
They change your home page, (the page which first opens when you connect to the internet) if you try to reset it (see our section on browsers) it will either not change, or be there again the next time you connect to the net.
They can also add web sites to your favourites and redirect your search enquiries to their own pages which contain a list of their advertisers rather than search results from the web, some are even made to look like genuine Google or Yahoo results.
Some of these things can be detected and removed manually if you are familiar with editing your registry, if not, use the programmes below.
Ad-Aware SE( Spyware scanner that has many hijackers in its database -Free version available)
BHO DEMON (Lists all Browser helper objects installed, allows user to disable - free)
Ewidow Detects and removes malware, including hijackers. Free trial reverts to free version after 14 days.
CWS shredder (Dedicated scanner for most of the older variations of the Cool web search hijacker - Free)
Pest Patrol large list of hijackers in its database - $39.95-approx £23).
Spybot S&D (Comprehensive scanner that has many hijackers in its database - Free)
SpywareBlaster (Adds large list of web sites that install spyware/malware to a browsers block list, preventing installation - free)
Spyware Guard (From the same company, and works in conjunction with SpywareBlaster, prevents hijackers - Free).
Download X-Cleaner (free trial)
2006 has seen an explosion in Browsers and desktops being hijacked by an ever expanding list of CoolWebSearch trojans which display a variety of fake warnings to frighten you into thinking you have spyware, viruses or critical system errors. Links then take you to their own software to remove these non-existent problems. Commercial security software has had difficulty cleaning these infections.
We have developed a removal tool to help with the detection and removal of the files and registry keys of the installing/accompanying trojans. Roguefix
There is also a free application called Hijack This, which will produce a log file of particular areas of your registry and hard drive, you then either learn how to interpret the results or post the log file on a forum and lots of clever people will look at it for you and tell you what to delete.
Or you can copy and paste your log file Here for an automated analysis. You will be able to detect and remove any sort of malware, as well as some viruses and Trojans.
Whilst all this is supplied Free to you, they do rely on donations from users to keep them going. if it solves your problems, please consider making a small donation to them.
Below is a list of known BHO's and hijackers, whist we do not pretend it contains all of them, we will update it regularly and keep you as informed as we can.
| Programme | Details | detection tools |
| 123search | Hijacks browsers to deliver their advertisers as search results | X-Cleaner Pest Patrol |
| A | A B C D E F G H I J K L M N O P Q R S U V W Y Z | |
| Actual names | Targets popular browsers Internet explorer, AOL and Netscape. Directs search enquiries to their clients/advertisers | X-Cleaner Spybot S&D |
| Adbreak | Delivers pop up adverts and changes your homepage | Ad-Aware SE
Spybot S&D Pest Patrol |
| Adgoblin | delivers pop up adverts and and has regular contact with its server. | Pest Patrol
Spybot S&D |
| AdRoar | Delivers pop up advertisements. Rated as a trojan with some security companies | Pest Patrol X-Cleaner |
| Alexa toolbar | There has been much debate as to whether Alexa constitutes spyware. It is a search engine powered by Amazon, that uses a unique ranking system, which shows how many times a particular site is visited. To collate this information, they monitor uses surfing activities. There appears to be no malicious intent, but the monitoring usually means it is classified as spyware. | Pest Patrol Ad-Aware SE Spybot S&D |
| Athoc toolbar | Browser hijacker | Pest Patrol
Spybot S&D |
| Aurate | Listed as a trojan in some parts of the web, and is almost impossible to remove manually | Pest Patrol X-Cleaner |
| Aurora | Difficult to remove Transponder variant from Direct revenue. Their latest 'trading name' is Bestoffers. | Manual removal instructions |
| Autosearch | Re-directs any searches to its own page displaying its own advertisers. It is capable of overcoming subsequent attacks from rival hijackers. | Pest Patrol X-Cleaner |
| B | A B C D E F G H I J K L M N O P Q R S U V W Y Z | |
| Bargain Buddy | Delivers advertisements based on search enquiries and forms. | Pest Patrol X-Cleaner |
| Bookedspace | Delivers pop up advertisements, can also download other software and applications | X-Cleaner
Spybot S&D |
| Bonzibuddy | adserving spyware is installed behind an animated cartoon character. Its own uninstall feature leave components behind, so scan PC with spyware scanner if used. |
Spybot S&D Trend Micro Pest Patrol |
| BrowserAid | Installs various Internet toolbars, usually without your knowledge that will redirect all your search results and make them look like Google results, it will deliver advertising pop ups, install third party software and intermittently hijack your home page | X-Cleaner
Spybot S&D |
| Burnaby AKA Cytron | Is scans web pages viewed for keywords, and delivers pop up ads. Designated a Trojan in some quarters, arrives hidden in a piece of software apparently needed to view e-cards from surprisecards.com |
Spybot S&D Pest Patrol X-Cleaner |
| C | A B C D E F G H I J K L M N O P Q R S U V W Y Z | |
| ClearSearch | A search utility that allows you to access multiple search engines at once, but it actually just reffers you to one of its advertisers that have bought keyword in your search query or injects an affiliate code. It also sneaks into PC's on the back of other (usually unwanted) free software, calls home daily with details of your internet activity. It can detect the presence of, and uninstall many of its competitors. | Pest Patrol Ewidow |
| CleverIEhooker | Search toolbar, browser hijacker and resource hog | X-Cleaner
Spybot S&D |
| Clientman | Early versions redirects searches made on Google and Yahoo, highlights keywords on a webpage with a yellow background and directs to an advertisers site if clicked on, more recent versions redirect search enquiries. It can also gather information from e-mail accounts, Instant messengers and some security software. can tamper with Zone alarm and Norton firewall. | Ad-Aware SE Spybot S&D Pest Patrol |
| Comet cursor | Software that changes your cursor when visiting affiliated sites. It delivers pop up ads and can change advertisements on web pages to their own commission earning ones. | Pest Patrol X-Cleaner Spybot S&D |
| Commonname toolbar | browser Helper object that hijack the browser and delivers advertisements, | WARNING - Improper removal of these files can result in you not being able to connect to the internet, Download LSP Fix first, if you are unable to connect to the net after removing Commonname, run LSPFix Spybot S&D Pest Patrol |
| Coolwebsearch AKA CWS | A very complex and devious hijacker that is constantly releasing new versions which are increasingly difficult to remove. Delivers pop ups, some to borderline legal pornographic sites. It add webs sites to your favourites and your trusted zone. It can also tamper with your security software. The latest version give fake warnings of infections or system errors and download scanners like Spyfalcon, spyaxe, SpySheriff and many others, which you should buy to clean the non-existent infections |
Trojan Remover Ewidow CWS shredder X-Cleaner Spybot S&D Roguefix |
| Customtoolbar | It installs itself automatically, without warning, under pop ups. Some anti virus software detects this as JS.exploit. Ironically. one of the sites involved in its distribution is stopannoyingpopups.com | Pest Patrol This application exploits a vulnerability in Microsoft's java, download a patch from Windows update, |
| D | A B C D E F G H I J K L M N O P Q R S U V W Y Z | |
| E | A B C D E F G H I J K L M N O P Q R S U V W Y Z | |
| Elite toolbar | A stubborn malware from Searchmiracle.com that gets more difficult to remove with each new version. traditional scanners can detect it but cannot remove it. | removal tool |
| EnjoySearch | A new hijacker on the block, early research suggest it could be associated with Cool web search | X-Cleaner |
| Exactsearch | Advertised as mail.com toolbar, delivers advertisements. | Spybot S&D Reg block X-Cleaner |
| ezSearching | Sends pop ups and hijacks search results | Pest Patrol Spybot S&D |
| eZula | Installed with file sharing programmes like KaZzA, it turns normal words on a web page into links which then direct you to their advertisers sites. | Spybot S&D X-Cleaner Pest Patrol Reg block |
| F | A B C D E F G H I J K L M N O P Q R S U V W Y Z | |
| Favourite man | Adds programmes to favourites list, many of the programmes it adds contain spyware, malware or some other parasite. | Ad-Aware SE Reg block Pest Patrol |
| FriendGreeting | Classified as a trojan by some anti virus software, installed with e cards, once installed it will send a e greeting to everyone in the address book in an attempt to infect other computers. | Remove by clicking start>settings>control
panel>Add and remove programmes and delete 'Friends greetings' and 'WinSrv Reg' or use Spybot S&D |
| G | A B C D E F G H I J K L M N O P Q R S U V W Y Z | |
| Go hip | A search protal that shows 'Free' movies. It hijacks your browser and delivers pop up ads | To remove. go to www.gohip.com/remove_ browser_enhancement Spybot S&D X-Cleaner |
| Go!Zilla | File sharing programme that installs other spyware applications. Uninstalling Go!Zilla will leave behind the spyware | Pest Patrol |
| H | A B C D E F G H I J K L M N O P Q R S U V W Y Z | |
| Hit pointer | Usually picked up from porn sites, hijacks the browser and delivers pop ups when pages are viewed that contain JavaScript. Removal can be difficult, sometimes detected by spyware scanners, sometimes not. If scanners do not remove it, look for Qameskan in Add / remove programmes. and empty your IE cache so previously viewed/amended pages cannot pages cannot be recalled. | CWS shredder Ad-Aware SE Spybot S&D. |
| Httper | Known to be installed with Internet Washer, whose makers are ironically
connected to popupblockade.com Delivers pop ups and hijacks error pages | Delete by using the computers Add/Remove facility. Or use Spybot S&D |
| Huntbar | Delivers pop up advertisements, redirects you to its sites when clicking on links and can reset your home page to Websearch.com | Pest Patrol X-Cleaner Spybot S&D |
| I | A B C D E F G H I J K L M N O P Q R S U V W Y Z | |
| Ilookup | Internet explorer toolbar, installed behind pop up adverts. Adds search box, link buttons, adds items to favourites, hijacks homepage. There are different versions which direct your searches to different search engines. | Spybot S&D Pest Patrol X-Cleaner Reg block |
| IEplugin | Hijacks your browser and monitors web sites visited, forms input and local files for any of its programmed keywords, then will deliver advertisements. Known as a Trojan downloader in some parts of the web. | Pest Patrol X-Cleaner Kaspersy Antivirus |
| IEMonit | Moniters search engine queries for sex related words. If one its listed words are used it delivers pop up ads. | Pest Patrol |
| InetSpeak | Adds a line of buttons and links to the standard Internet explorer tool bar, which cannot be removed. Also delivers advertisements. Installed as part of the music magnet file sharing software. | Pest Patrol X-Cleaner Reg block Spybot S&D |
| Internetbillingsolution | Software that delivers advertisements to your computer | Pest Patrol |
| J | A B C D E F G H I J K L M N O P Q R S U V W Y Z | |
| K | A B C D E F G H I J K L M N O P Q R S U V W Y Z | |
| KeenValue | Also Known as incredifind, includes a Host file hijacker to redirect search enquiries | Pest Patrol Ewidow Trend Micro Spybot S&D |
| KOOLBAR | Delivers advertising pop ups. It comes complete with a hidden re-installer, just in case you try to delete it. | Pest Patrol Ewidow |
| L | A B C D E F G H I J K L M N O P Q R S U V W Y Z | |
| LinkReplacer | Adds content to the top of every web page you visit. No only does it use web space it is not entitled to, or have permission to, the added code can cause an 'application error' each time a window is closed. The application can also copy cookies stored on your PC and send then to the originators server. | Pest Patrol Spybot S&D X-Cleaner Reg block |
| Look2me | From , a company that produces not only malware that is difficult to remove, it also markets the spy ban spyware scanner. | Kill2meSpecific removal tool, from merijn. Spybot S&D |
| Lop | lop has a wide variety of variants, all from C2 media. Known as a Trojan by some, it hijacks your browser with their home page and search engine, LOP.com (Live online portal). It also puts shortcuts on your desktop and adds sites to your favourites. It comes attached to Mp3search. Some variants can resist removal. | Spybot S&D Pest Patrol Kaspersy Antivirus McAfee Security |
| M | A B C D E F G H I J K L M N O P Q R S U V W Y Z | |
| MARGOC | Delivers advertising pop ups. |
Trojan Remover Ewidow X-Cleaner |
| Meridian | Delivers advertising pop ups, mostly pornographic | Pest Patrol |
| Mulitmedia Speedbar | Homepage Hijacker | Pest Patrol X-Cleaner |
| Mylittlespy | Keyword logger that is difficult to detect and remove. It runs completely hidden. | Pest Patrol |
| Mysearch Mywebsearch | Not a threat in itself, but can appear to be difficult to remove if not uninstalled correctly. Can also be an indication of a malware infection as it can be installed by other parasites | Manual removal instrucions |
| N | A B C D E F G H I J K L M N O P Q R S U V W Y Z | |
| nCase | Delivers targeted pop up ads from 180solutions, even on your desktop when not connected to the internet, and can disable its competitors BHO's. Resists removal. Sometimes classified as a trojan. |
Ewidow X-Cleaner Spybot S&D Pest Patrol McAfee Security Kaspersy Antivirus |
| NetPal | Opens pop up advertisements when instructions are received from its server. It can also record the web addresses and even e-mail addresses to be sold to spam merchants. | Pest Patrol X-Cleaner |
| NewtonKnows | Toolbar with search hijacker. It also displays links in 'speech bubbles' whilst browsing and send personally identifiable data back to its server | Spybot S&D Pest Patrol X-Cleaner Reg block |
| Ntsearch | Variant of the aggressive Coolwebsearch hijacker | CWS shredder X-Cleaner |
| O | A B C D E F G H I J K L M N O P Q R S U V W Y Z | |
| P | A B C D E F G H I J K L M N O P Q R S U V W Y Z | |
| Prositefinder | From 180 solutions, renown for their difficult to remove adware. Monitors internet activities and delivers targetted advertising pop ups. | Ewidow X-Cleaner Pest Patrol |
| Q | A B C D E F G H I J K L M N O P Q R S U V W Y Z | |
| R | A B C D E F G H I J K L M N O P Q R S U V W Y Z | |
| Radiate | Formerly called Aurate from adsoftware.com . Listed as a Trojan in some parts of the web, and is almost impossible to remove manually. It is installed secretly with hundreds of shareware programmes, and has been estimated to be in 30 million pc's worldwide. Delivers banner advertisements and reports back to server with your surfing habits. | Spybot S&D Pest Patrol |
| S | A B C D E F G H I J K L M N O P Q R S U V W Y Z | |
| Scbar | Delivers pop up advertisements based on your search enquiries | Pest Patrol X-Cleaner |
| SearchSquire | This is installed automatically when a web site containing its pop up advertisements is viewed. It will show paid for links in a side bar when search enquiries are made. | Spybot S&D X-Cleaner |
| Searchex | homepage and search hijacker. This application is detected as a trojan-Adwaredropper.A by some anti virus software. Installs with an anonymous Valentines message or with Netspeed software | Pest Patrol X-Cleaner |
| T | A B C D E F G H I J K L M N O P Q R S U V W Y Z | |
| Transponder | Records search and form entries, some variants can also deliver pop up advertisements. Some variants can avoid detection and resist removal |
Ewidow Pest Patrol X-Cleaner |
| U | A B C D E F G H I J K L M N O P Q R S U V W Y Z | |
| UCmore | Displays links, which appear to be connected to the site being viewed. (Version 4 is not considered to be a threat) | Pest Patrol X-Cleaner Spybot S&D |
| V | A B C D E F G H I J K L M N O P Q R S U V W Y Z | |
| VX2 | Delivers pop ups, adds items to desktop. Difficult to remove. A variation of the transponder adware from Direct revenue. | Vx2 cleaner (Plug in for the
Ad-Aware SE scanner) Kill2me (Direct download) Trojan Remover |
| W | A B C D E F G H I J K L M N O P Q R S U V W Y Z | |
| Webhancer | delivers pop up ads and sends out internet usage information,
in addition to being the cause of slow internet performance, as the outgoing information
hogs your
system, many boot up problems, and 'illegal operations' messages for 'whagent'. If you delete the file hoping it will just go away, it will prevent you connecting to the internet, or cause endless crashes. If this happens, you will have to reinstall the webhancer software, and try again. |
Spybot S&D Adware SE Pest Patrol X-Cleaner |
| Whazit | Hijacks homepage, search results and error messages | Spybot S&D Pest Patrol X-Cleaner |
| Winfix Winfix 05 Winfix2005 winfixer winfixer 2005 | Is installed by a variety of other Malware, the latest being the Vundo trojan. Difficult to remove. | Manual removal instructions |
| Winshow | When specific words are included in a viewed web page, targeted pop up ads are delivered. It is also classified a Trojan | Pest Patrol X-Cleaner Kaspersy Antivirus AVG |
| Wurldmedia | Redirects links through its own servers to steal referral and commission fees. | Spybot S&D Pest Patrol X-Cleaner |
| X | A B C D E F G H I J K L M N O P Q R S U V W Y Z | |
| xxxtoolbar | BHO that installs a search utility to specifically search for adult material | Spybot S&D Pest Patrol BHO DEMON |
| Xupiter | Redirects links through a third party server to steal webmaster and affiliate fees. It can also hijack home pages and deliver pop up ads. | Pest Patrol X-Cleaner McAfee Security |
| Y | A B C D E F G H I J K L M N O P Q R S U V W Y Z | |
| Z | A B C D E F G H I J K L M N O P Q R S U V W Y Z | |
| Zango | Previously known as n-case. Delivers targeted pop up ads from 180solutions, even on your desktop when not connected to the internet, and can disable its competitors BHO's. Resists removal. Sometimes classified as a trojan. |
Ewidow X-Cleaner Spybot S&D Pest Patrol McAfee Security Kaspersy Antivirus |
The next page looks at the latest way how these, and other parasites are getting into your computer system, by using 'drive by downloads'
Information
Viruses
hackers, crackers & firewalls
Trojans
Spyware
Keyloggers
Cookies
BHO's & Hijackers
Drive by downloads
diallers
Scams & Hoaxes
Hijack this-
automatic analysis
Free pest scan
Unwanted processes
How to-Tutorials
Clean up/repair after malware infection
Prevent malware installing
Install Hijackthis
Start in Safe mode
Show hidden files/folders
enable/disable Active X controls
Disable Messenger service pop-ups
Use the Host file
Roguefix -
Removal tool for Rogue spyware removers & Fake Warnings
removal tool
Kill E2Give
Kill MySearch
Kill Sdbot-ADD / lockx.exe
Kill seeve.exe / mediamotors pop ups
Kill Winfixer2005
Kill SysProtect
News/Articles
New Winfixer infection displays fake Blackworm warning
The real cost of Free security software
About us Contact us FAQ Links Privacy Statement Site Map WebmastersClick here to add this page to your favorites
©Internet Inspiration, 2003. All registered trademarks are observed and respected.