ClickTheButton

· Overview ·
· Origins ·
· Distribution ·
· Operation ·
· Risks ·
· Detection and Removal ·
· Research ·

Overview

Summary:

 ClickTheButton is described as a price comparison service. It detects when you are visitng a known shopping site and provides sponsored links to competitor sites. It runs as a process on startup (ctbclick.exe) and installs a number of extra DLLs.

Category:

Adware: Software that displays popup/popunder ads when the primary user interface is not visible or which do not appear to be assocaited with the product.

Similar Pests:

 Adware

Origins

Group:

 ClickTheButton

URL:

 http://ClickTheButton.com (site is down)

Date of Origin:

 December, 2002

Distribution

Distribution:

 ClickTheButton has had "legitimate" distribution channels, but is now being silently installed with other applications (eg. some releases of KaZaA). The FavoriteMan pest has also installed it.

Prevalence:
  • ClickTheButton: < 0.00005%
    • More Info

    Clot Factor:
  • ClickTheButton: 1

    • The "Clot Factor" is a measure of how much a pest "gums up" a machine by adding registry entries, files, and directories. As more objects are placed in a machine, manual removal becomes more difficult and more error-prone.

    Growth:
  • ClickTheButton: Insufficient data to report growth
    		•

    Operation

    Advertising:

    		 Yes. ClickTheButton downloads parts of advertising pages when you visit a new web site. When a complete advertisement has arrived, it will be displayed, usually as a pop-up or pop-under window.

    Risks

    Privacy Issues:

    		 Yes. ClickTheButton monitors visits of known shopping sites.

    Security Issues:

    		 Unknown.

    Stability Issues:

    		 None known.

    Detection and Removal

    Automatic Removal:

    PestPatrol detects this.

    PestPatrol removes this.

    Manual Removal:

    Open the Task Manager, and kill the 'ctbclick' process. Delete 'CTB3_Shared' from the Windows directory. Delete 'CTBHooks.dll' from the System directory (WINDOWS\SYSTEM or WINNT\System32). Load regedit and delete the value HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ClickTheButton.

    If you like, you can also remove the registry key HKLM\SOFTWARE\CTB_BrandedClient, and every class in HKEY_CLASSES_ROOT that begins with 'CtbClient', 'CtbSession', 'CtbShopper' or 'CtbXML'. There are a lot.

    Clean Registry:

    Remove these registry items (if present) with RegEdit:

    Research

    More Info:
  • AllTheWeb, AltaVista, AOL Search, Ask Jeeves, Google, HotBot, Lycos, LookSmart, MSN, Yahoo!
    		•

    Research By:
  • Andrew Clover
  • PestPatrol's Pest Research Center
    		•

    Last Revised:

    		 April 15, 2005