Parasite: TopText

This record last updated Tue Sep 20 2005 00:34:15

PLEASE NOTE: Due to the overwhelming extent of this problem and the unbelievable volume of email we have received, we regret that we cannot respond to questions about browser parasites at this time. If you have attempted to contact us about this parasite please accept our apology for not responding. "Thank you's" are always appreciated ;-)

Description

When installed, TopText will alter all pages viewed in IE, adding extra links to words and phrases targeted by advertisers. These links are unauthorised by the operators of the sites being viewed.

Also known as

iLookup, HotText, ContextPro. eZula, after the company that created it.

Distribution

One of many parasites included in the file-sharing programs KaZaA and iMesh. Also an optional install on many other free applications, eg. GoZilla.

Around March 2003, installed by the FavoriteMan parasite. During 2004, installed by the WildMedia parasite.

What it does

Advertising

Yes. TopText’s characteristic ugly orange-yellow links lead to advertisers’ sites.

Privacy violation

Unconfirmed. TopText keeps in contact with a third party server but it is not known what information is exchanged.

Security issues

Yes. TopText has an update feature which the licence states may be used to install third-party software. It also includes a downloader/installer which can be triggered by web pages to redownload TopText.

Stability problems

Unconfirmed. Some reports of crashes/reboots.

Removal

Ad-Aware can remove eZula TopText.

Removing TopText using the Add/Remove Programs item in the Windows Control Panel leaves the downloader/installer intact.

Manual removal

After using ‘Add/Remove Programs’, the System directory contains a ‘stub.exe’ file which is responsible for this. Before you can delete it you may need to use the command:

"%WinDir%\SYSTEM\stub.exe -UnregServer"

For Windows NT/2000/XP, the command is simply:

stub.exe -UnregServer