Parasite: Enconfidence

This record last updated Tue Sep 20 2005 00:34:15

PLEASE NOTE: Due to the overwhelming extent of this problem and the unbelievable volume of email we have received, we regret that we cannot respond to questions about browser parasites at this time. If you have attempted to contact us about this parasite please accept our apology for not responding. "Thank you's" are always appreciated ;-)

Description

Enconfidence is pop-up-opening adware contained in an application that downloads and displays horoscopes, controlled by enconfidence.com.

Also known as

MyDailyHoroscope, the name of the application itself. TEAM, described as the source of the pop-ups.

Distribution

Installed by the FavoriteMan, Roimoi and ILookup/Begin2Search parasites. Also suspected to be distributed by ActiveX drive-by downloads in pop-up ads sourced from trafficmp.com.

What it does

Advertising

Yes. Opens periodic pop-up advertising during web browser use, as directed by its controlling server www.mydailyhoroscope.net. Ads are often shown from ad.trafficmp.com (Traffic Marketplace) or ads.vendaregroup.com (Vendare Group, which owns both Enconfidence and Traffic Marketplace).

Privacy violation

Yes. Passes the (trivially encoded) full URL of the page being viewed together with a trackable user ID with every advert request.

Security issues

None known.

Stability problems

None known.

Removal

There is a ‘MyDailyHoroscope’ entry in the Control Panel’s Add/Remove Programs function that should remove the software, though it will open one last pop-up whilst doing so.

Manual removal

Open the registry (click ‘Start’, choose ‘Run’, enter ‘regedit’) and select the key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run. On the right-hand side, right-click-and-delete the ‘MyDailyHoroscope’ entry.

Restart the computer and you should be able to delete the ‘MyDailyHoroscope’ folder inside Program Files. You can also delete the registry keys HKEY_CURRENT_USER\Software\Enconfidence and HKEY_LOCAL_MACHINE\Software\Enconfidence to clean up.

* Parasite information and detection script by Andrew Clover - www.doxdesk.com, used with permission.

For more information about Scumware, Spyware and Parasites, their sources and their cure, visit our About Parasites page and related Tech Links.

Visit our new services portal at Allen One for a completely new parasite database format, comming November 2005!