Spyware Detail

Summary

IGetNet is a keyword-search service implemented as an IE Browser Helper Object and a process run at Windows start-up (WinStart.exe or WinStart001.exe) which writes to the Hosts file. Once this modification has occurred, every time you try to contact MSN or Netscape's search sites you are re-routed though IGetNet's servers. The IGetNet server checks to see whether your search includes a keyword they have sold to one of their advertisers, and if so, redirects you to that site. If not they forward you to the real MSN or Netscape Search so you shouldn't notice the difference.

Your IE address bar will change as shown below.

Without IGetNet (normal)

 

IGetNet is running

In addition, if IGetNet is running, and you enter auto.search.msn.com, search.netscape.com, or ieautosearch in the Address field, you will find yourself at http://www.igetnet.com

IGetNet/v4: original variant, installs files 'BHO.DLL', 'rsp.dll' and 'Winstart.exe' into the 'System' folder in the Windows folder. 'Winstart.exe', run at start-up, writes entries to the Hosts file to redirect all access to MSN or Netscape search sites through to IGetNet's servers instead. (ignkeywords.com, rspsearch.com.)
IGetNet/v5: works the same as v4, but the files are now called 'BHO001.DLL', 'rsp001.dll' and 'Winstart001.exe' and they use new class IDs internally. You can tell if you have v5 as new IE windows will show the text 'Enter Keyword or Web Address here' in the address bar.
IGetNet/v6: same as v5 but has extra files.

"IGetNet/ClearSearch" is actually misnamed, and there is no business connection between IGetNet and ClearSearch.

Alias

Adware/IGetnet[Panda]
security risk or a "backdoor" program[F-Prot]
INetSpeak

See Also

ClearSearch

Category

Adware:  Software that displays pop-up/pop-under advertisements when the primary user interface is not visible, or which do not appear to be associated with the product.

Browser Helper Object:  (BHO). A component that Internet Explorer will load whenever it starts, shares IE's memory context, can perform any action on the available windows and modules. A BHO can detect events, create windows to display additional information on a viewed page, monitor messages and actions. Microsoft calls it "a spy we send to infiltrate the browser's land." BHOs are not stopped by personal firewalls, because they are seen by the firewall as your browser itself. Some exploits of this technology search all pages you view in IE and replace banner advertisements with other ads. Some monitor and report on your actions. Some change your home page.

Hijacker:  Any software that resets your browser's settings to point to other sites. Hijacks may reroute your info and address requests through an unseen site, capturing that info. In such hijacks, your browser may behave normally, but be slower.



Variants

iGetNet.Natural Language Navigation · IGetNet v4 · IGetNet v5 · IGetNet v6 · IGetNet.Keywords ·

View Full Details