Parasite: Sidesearch

This record last updated Tue Sep 20 2005 00:34:15

PLEASE NOTE: Due to the overwhelming extent of this problem and the unbelievable volume of email we have received, we regret that we cannot respond to questions about browser parasites at this time. If you have attempted to contact us about this parasite please accept our apology for not responding. "Thank you's" are always appreciated ;-)

Description

Sidesearch is a sidebar that appears when using search engines and shopping sites, showing competitor results from its controllers Lycos.

Distribution

Is installed without notice by other parasites, such as FavoriteMan, BookedSpace and IEPlugin, and in unrequested drive-by downloads from imbum.com.

What it does

Advertising

Yes. Depending on the search term, some, many or all of the search results in the sidebar may be advertiser’s paid-for-placement links. When searching on a shopping site, product links that appear in the sidebar are Lycos affiliate links.

Privacy violation

Possible. The search results server client.sidesearch.lycos.com may sometimes set a unique ID cookie for preferences. If this happens your usage of search engines becomes trackable by Lycos.

Security issues

Yes. Sidesearch has a built-in silent self-update function which can be used to execute arbitrary unsigned code from the controlling server. This has been used to install the ClearSearch parasite.

Stability problems

None known.

Removal

The ‘Lycos Sidesearch’ entry in the Control Panel ‘Add/Remove Programs’ item should remove the software (aside from a harmless registry key, see below).

Manual removal

Open the Program Files folder, ‘Lycos’ then ‘Sidesearch’. There should be a DLL file with the name ‘sidesearch1234.dll’, where 1234 is some version number. In the earlist variants there is no version number.

Open a command prompt window (from the Accessories submenu in the Programs menu from the Start button). Enter the following commands:

cd "%WinDir%\System"
regsvr32 /u "\Program Files\Lycos\Sidesearch\sidesearch1234.dll"

(Replace the 1234 in this command with the real version number you found.)

Restart the computer and you should be able to delete the ‘Lycos’ folder in Program Files.

You can also open the registry (click ‘Start’, choose ‘Run’, enter ‘regedit’) and delete the key HKEY_LOCAL_MACHINE\SOFTWARE\Lycos to clean up, if you wish.

* Parasite information and detection script by Andrew Clover - www.doxdesk.com, used with permission.

For more information about Scumware, Spyware and Parasites, their sources and their cure, visit our About Parasites page and related Tech Links.

Visit our new services portal at Allen One for a completely new parasite database format, comming November 2005!