Parasite: IETray

This record last updated Tue Sep 20 2005 00:34:15

PLEASE NOTE: Due to the overwhelming extent of this problem and the unbelievable volume of email we have received, we regret that we cannot respond to questions about browser parasites at this time. If you have attempted to contact us about this parasite please accept our apology for not responding. "Thank you's" are always appreciated ;-)

Description

IETray is a search sidebar hijacker pointed at search-aide.com, implemented as an Internet Explorer Browser Helper object.

When other search engines are used, it occasionally opens a pop-up alert window encouraging one to use the (now hijacked) search sidebar instead. (“For faster web searches press F9”)

Distribution

It is currently unknown where IETray comes from.

What it does

Advertising

No.

Privacy violation

No.

Security issues

No.

Stability problems

No.

Removal

Open a DOS command prompt window (from Start->Programs->Accessories), and enter the following commands:

cd "%WinDir%\System"
regsvr32 /u IEMsg.dll

Next, open the registry (click ‘Start’, choose ‘Run’, enter ‘regedit’) and find the key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run. Delete the entry ‘CSRSS’ pointing at ‘csrss.exe’. You can also open the key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt and delete the entries ‘&Define’ and ‘&Search the Web’.

Restart the computer and you should be able to delete the file ‘csrss.exe’ from the Windows folder, and ‘IEMsg.dll’ from the System folder (which is inside the Windows folder, called ‘System32’ on Windows NT/2000/XP). You can also delete ‘ERS_DEF.HTM’ and ‘ERS_SRC.HTM’ from the Web folder (insid the Windows folder).

* Parasite information and detection script by Andrew Clover - www.doxdesk.com, used with permission.

For more information about Scumware, Spyware and Parasites, their sources and their cure, visit our About Parasites page and related Tech Links.

Visit our new services portal at Allen One for a completely new parasite database format, comming November 2005!