Parasite: SearchWWW

This record last updated Tue Sep 20 2005 03:34:15

PLEASE NOTE: Due to the overwhelming extent of this problem and the unbelievable volume of email we have received, we regret that we cannot respond to questions about browser parasites at this time. If you have attempted to contact us about this parasite please accept our apology for not responding. "Thank you's" are always appreciated ;-)

Description

SearchWWW is an Internet Explorer toolbar and homepage hijacker pointed at www.searchwww.com. The toolbar is pretty harmless and the home page setting can be reset without it taking over again.

SearchWWW is based on toolbar code by vones.net. Other toolbars by VONeS are not known to be unsolicited commercial software.

Distribution

Installed by ActiveX drive-by download on the subdomain-not-found site of the cjb.net URL redirection service. CJB also operates searchwww.com.

What it does

Advertising

No.

Privacy violation

No.

Security issues

No.

Stability problems

No serious problems known, but may cause a Microsoft Installer window to flicker open and closed every time you open a new Internet Explorer process.

Removal

Manual removal

From ‘Downloaded Program Files’ in the Windows folder, right-click the ‘{FFFFFFFFFFFF-FFFF-FFFF-FFFFFFFF}’ entry entry and remove it.

This does not actually get rid of the software, so open a DOS command prompt window (from Start->Programs->Accessories) and enter the following commands:

cd "%WinDir%\System"
regsvr32.exe /u ietoolbar.dll

After restarting the computer, you should be able to delete ietoolbar.dll, ietoolbar.htm and popup.wav from the System32 folder.