BrowserAid

· Overview ·
· Origins ·
· Distribution ·
· Operation ·
· Risks ·
· Detection and Removal ·
· Research ·

Overview

Summary:

 An IE toolbar object which comes with various other components that act as adware and spyware.

Vendor Notes:

 "BrowserAid provides a unique solution for complex e-marketing objectives. By integrating focal areas of your website into a downloadable browser toolbar, BrowserAid creates a continuous, interactive relationship between you and your customers. Fully customizable for the specific requirements of your Web site, the BrowserAid solution: > Reinforces brand awareness > Improves customer loyalty and retention > Facilitates targeted direct e-marketing > Enables unprecedented communication with customers Ranging from basic toolbars with static buttons to highly complex toolbars with integrated search engines, real-time news feeds, streaming tickers, dynamic buttons, and browser graphics, BrowserAid will create the optimal solution for your specific objectives." -- http://browseraid.com/sub-sites/solution.htm

Alias:

 BrowserAid Toolbar, Cash Toolbar, LetsSearch

Category:

Browser Helper Object: (BHO). A component that Internet Explorer will load whenever it starts, shares IE's memory context, can perform any action on the available windows and modules. A BHO can detect events, create windows to display additional information on a viewed page, monitor messages and actions. Microsoft calls it "a spy we send to infiltrate the browser's land." BHOs are not stopped by personal firewalls, because they are seen by the firewall as your browser itself. Some exploits of this technology search all pages you view in IE and replace banner advertisements with other ads. Some monitor and report on your actions. Some change your home page.

Adware: Software that displays popup/popunder ads when the primary user interface is not visible or which do not appear to be assocaited with the product.

Hijacker: Any software that resets your browser's settings to point to other sites. Hijacks may reroute your info and address requests through an unseen site, capturing that info. In such hijacks, your browser may behave normally, but be slower.

Toolbar: A group of buttons which perform common tasks. A toolbar for Internet Explorer is nomally located below the menu bar at the top of the form. Toolbars may be created by Browser Helper Objects.

Variants:
  • BrowserAid.ABCSearch
  • BrowserAid.BrowserPal
  • BrowserAid.CashToolbar
  • BrowserAid.Featured-Results
  • BrowserAid.FindIt-Quick
  • BrowserAid.LetsSearch
  • BrowserAid.Quicklaunch
  • BrowserAid.RunDLL16
  • BrowserAid.SearchandClick
  • BrowserAid.Startium
  • BrowserAid.X
  • BrowserAid/Featured-Results
  • BrowserAid/Quicklaunch
  • BrowserAid/RunDLL16
  • BrowserAid/Startium
  • FeaturedResults
    		•

    Similar Pests:

    		 Browser Helper Object · Adware · Hijacker · Toolbar

    Origins

    Group:

    		 Cash Toolbar

    By This Group:

    		 BrowserAid Toolbar ·

    Mailing Address:

    		 Infinite Innovations, Inc. PO Box 2117 Belize City, Belize 36151 BZ

    Phone:

    		 +501.4138321598

    EMail:

    		 info@browseraid.com

    URL:

    		 http://www.cashtoolbar.com or http://browseraid.com/index2.htm

    Date of Origin:

    		 Variants from April, 2003 to August, 2004

    Distribution

    Distribution:

    		 Can be downloaded and installed from the manufacturer's site, but it is more likely to come as an affiliate's drive-by-download (ActiveX install). For instance, a simple visit to LetsSearch.com will automatically install it.

    Prevalence:
  • BrowserAid: 0.2%
  • BrowserAid.ABCSearch: < 0.00005%
  • BrowserAid.Featured-Results: < 0.00005%
  • BrowserAid.FindIt-Quick: < 0.00005%
  • BrowserAid.Quicklaunch: < 0.00005%
  • BrowserAid.RunDLL16: 0.0%
  • BrowserAid.SearchandClick: < 0.00005%
  • BrowserAid.Startium: 0.0%
  • BrowserAid/Startium: < 0.00005%
  • FeaturedResults: < 0.00005%
    • More Info

    Clot Factor:
  • BrowserAid: 8

    • The "Clot Factor" is a measure of how much a pest "gums up" a machine by adding registry entries, files, and directories. As more objects are placed in a machine, manual removal becomes more difficult and more error-prone.

    Growth:
  • BrowserAid: Insufficient data to report growth
  • BrowserAid.RunDLL16: Insufficient data to report growth
  • BrowserAid.SearchandClick: Insufficient data to report growth
  • BrowserAid.Startium: Insufficient data to report growth
    		•

    Operation

    Advertising:

    		 Yes. Opens pop-up advertisements.

    Storage Required:
  • BrowserAid: at least 293 KB
  • BrowserAid.Featured-Results: at least 201 KB
  • BrowserAid.Quicklaunch: at least 461 KB
  • BrowserAid.RunDLL16: at least 181 KB
  • BrowserAid.SearchandClick: at least 121 KB
  • BrowserAid.Startium: at least 1013 KB
    		•

    Browser Performance:

    		 Likely to slow performance of Internet Explorer.

    Risks

    Privacy Issues:

    		 Unknown

    Privacy Policy:

    		 See http://www.cashtoolbar.com/privacypolicy.php

    Security Issues:

    		 Yes. BrowserAidToolbar downloads and installs updates to all its components silently, without code-signing.

    Stability Issues:

    		 Unknown

    Detection and Removal

    Automatic Removal:

    PestPatrol detects this.

    PestPatrol removes this.

    Manual Removal:

    		 Follow these steps to remove BrowserAid from your machine. Begin by backing up your registry and your system, and/or setting a Restore Point, to prevent trouble if you make a mistake.
    Stop Running Processes:

    Kill these running processes with Task Manager:

    Remove AutoRun Reference:

    Go To the key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run.
    If you find the value HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\{2cf0b992-5eeb-4143-99c0-5297ef71f444}, delete it and reboot the machine immediately.
    If you find the value HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\{2cf0b992-5eeb-4143-99c2-5297ef71f44b}, delete it and reboot the machine immediately.
    If you find the value HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\mcinst, delete it and reboot the machine immediately.
    If you find the value HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\rundll16, delete it and reboot the machine immediately.
    If you find the value HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\rundll32_7, delete it and reboot the machine immediately.
    If you find the value HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\runwindowsupdate, delete it and reboot the machine immediately.
    If you find the value HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\taskman, delete it and reboot the machine immediately.
    If you find the value HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\windowsupdate, delete it and reboot the machine immediately.
    If you find the value HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runwindowsupdate, delete it and reboot the machine immediately.



    Unregister DLLs:

    Unregister these DLLs with Regsvr32, then reboot:

    Clean Registry:

    Remove these registry items (if present) with RegEdit:

    Remove Files:

    Remove these files (if present) with Windows Explorer:

    Remove Directories:

    Remove these directories (if present) with Windows Explorer:

    Restore Settings:

    After following the instructions above, you will still need to restore your original settings and prevent this from happening again. Here''s how.

    Research

    File Analyses:

    More Info:
  • AllTheWeb, AltaVista, AOL Search, Ask Jeeves, Google, HotBot, Lycos, LookSmart, MSN, Yahoo!
    		•

    Research By:
  • PestPatrol's Pest Research Center
    		•

    Last Revised:

    		 April 15, 2005