Web3000

· Overview ·
· Origins ·
· Distribution ·
· Operation ·
· Detection and Removal ·
· Research ·

Overview

Summary:

 No installation disclosure. Displays ads. Causes browser popups. Tracks web usage. Collects personal info. Still live.

Alias:

 eZula TopText

See Also:

 NetSonic

Category:

Spyware: Any product that employs a user's Internet connection in the background without their knowledge, and gathers/transmits info on the user or their behavior. Many spyware products will collect referrer info (information from your web browser which reveals what URL you linked from), your IP address (a number that is used by computers on the network to identify your computer), system information (such as time of visit, type of browser used, the operating system and platform, and CPU speed.) Spyware products sometimes wrap other commercial products, and are introduced to machines when those commercial products are installed. See also Adware.

Similar Pests:

 Spyware

Origins

Group:

 Web3000

Vendor:

 A product of Web3000.com

By This Group:

 NetSonic ·

URL:

 www.web3000.com/

Date of Origin:

 January, 2001

Distribution

Prevalence:
  • Web3000: 0.0%
    • More Info

    Clot Factor:
  • Web3000: 2

    • The "Clot Factor" is a measure of how much a pest "gums up" a machine by adding registry entries, files, and directories. As more objects are placed in a machine, manual removal becomes more difficult and more error-prone.

    Growth:
  • Web3000: Insufficient data to report growth
    		•

    Operation

    Storage Required:
  • Web3000: at least 2469 KB
    		•

    ScreenShot:

    No interface. When the product associated with Web 3000 installs, you will see screens such as those shown below. After providing such information, no further screens are shown.

    Detection and Removal

    Automatic Removal:

    PestPatrol detects this.

    PestPatrol removes this.

    Manual Removal:

    When installed, creates four registry keys

    • HKEY_USERS\.default\software\web3000.com\
    • HKEY_CURRENT_USER\software\web3000.com\
    • HKEY_LOCAL_MACHINE\software\web3000.com\
    • HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\w3knetwork "RunDll32.exe w3knet.dll,DLLInitRun"

    The following five executable files are also installed:

    • C:\Windows\instnetmgr.dll
    • C:\Windows\w3knet.dll
    • C:\Windows\W3KNet.w3k
    • C:\Windows\W3KNET_W3l.DLL
    • C:\Program Files\[application directory]\W3kSelfInst.exe

    Web 3000 has no user interface.

    De-installation of the products we tested did not fully remove Web 3000.
    Stop Running Processes:

    Kill these running processes with Task Manager:

    Remove AutoRun Reference:

    Go To the key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run.
    If you find the value HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run\msbb, delete it and reboot the machine immediately.
    If you find the value HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\w3knetwork, delete it and reboot the machine immediately.



    Unregister DLLs:

    Unregister these DLLs with Regsvr32, then reboot:

    Clean Registry:

    Remove these registry items (if present) with RegEdit:

    Remove Files:

    Remove these files (if present) with Windows Explorer:

    Remove Directories:

    Remove these directories (if present) with Windows Explorer:

    Research

    File Analyses:

    More Info:
  • AllTheWeb, AltaVista, AOL Search, Ask Jeeves, Google, HotBot, Lycos, LookSmart, MSN, Yahoo!
    		•

    Research By:
  • PestPatrol's Pest Research Center
    		•

    Last Revised:

    		 April 07, 2005