Spyware Detail

1. Close all browser windows (Internet Explorer, etc) and do not open until complete removal procedures have been followed. (you may need to copy and paste these instructions into a document, so that you can read them while Internet Explorer is closed).
2. Update PestPatrol to the latest DAT files (detection databases).
3. Do a complete scan using PestPatrol.
4. Quarantine/remove WebSearch Toolbar.
5. Reboot. DO NOT OPEN your browser.
6. Do a second complete scan using PestPatrol.
7. Remove WebSearch Toolbar (if found).
8. Reboot.
9. WebSearch Toolbar should be removed on reboot.

Note: if you are having trouble removing WebSearch after completing these steps, disconnect from the internet (unplug the cable or disable the wireless connection), and repeat steps above

According to Ibis, 'If at anytime you wish to remove the Service, you can remove it through the Add/Remove Programs menu in your Microsoft Windows control panel. To uninstall your Search Toolbar, please do the following:

1. Click on the Start button and select Settings and then Control Panel. If you are running Microsoft XP, you can go directly to the Control Panel from the Microsoft Windows Start button.
2. When the Control panel window opens, double-click on the Add/Remove Programs Icon.
3. When the Add/Remove Programs Properties window opens, locate the listing for 'Search Toolbar' that you would like to uninstall from the list of installed programs.
4. Click once on the program to be uninstalled and then click on the Add/Remove button and follow the instructions.' -- http://www.websearch.com/legal/Terms.aspx


Alias

Bubba.wintools
Adware/WinTools[Panda]
Trojan Horse[Panda]

Vendor Description

'Our mission is to become the one convenient location you will use to search for information of any kind. If you can’t find it through Web Search, chances are you can’t find it anywhere else! Web Search gives you the option of multiple choices. Get accurate results, fast! Web Search features one-click access to the search results of fifteen (15) of the best search providers on the Internet! Now, you can search for relevant web results, images, audio, news and much more from one convenient location! Web Search is your best "search friendly" tool on the web, saving you time and effort. Unlike other search engines, Web Search results are designed to bring accurate results you are looking for -- fast! That’s why we removed all banners, pop-ups, and other advertising that might slow you down.

Key Features:

Search twice as fast by using multiple engines at once
Pop-Up Blocker allows you to take control
Check ranking and website information
Vote for the website you like the best
Highlight and find search terms on any page
Optional Search button, Address and DNS Error Search Assistant
' -- http://www.websearch.com/legal/about.aspx

According to Ibis, "By installing the Service you understand and agree that the following changes may be made to your Internet Explorer browser and that the following functions may be performed by the Service: install a Search Toolbar in your browser which may (i) block certain pop-up ads and pages; (ii) display links to related websites and keywords based on the information you view and the websites you visit; (iii) store non-personally identifiable statistics of the websites you have visited; (iv) redirect certain URL's including your browser default address bar search, DNS error page and Search Button page to or through the Service and; (v) automatically update the Service and install added features or functionality conveniently without your input or interaction unless you have chose to be notified of such update in advance." -- http://www.websearch.com/legal/Terms.aspx

See Also

WinToolsHuntBar

Category

Browser Helper Object:  (BHO). A component that Internet Explorer will load whenever it starts, shares IE's memory context, can perform any action on the available windows and modules. A BHO can detect events, create windows to display additional information on a viewed page, monitor messages and actions. Microsoft calls it "a spy we send to infiltrate the browser's land." BHOs are not stopped by personal firewalls, because they are seen by the firewall as your browser itself. Some exploits of this technology search all pages you view in IE and replace banner advertisements with other ads. Some monitor and report on your actions. Some change your home page.

Downloader:  A program that downloads and may execute or install software without user permission.

Hijacker:  Any software that resets your browser's settings to point to other sites. Hijacks may reroute your info and address requests through an unseen site, capturing that info. In such hijacks, your browser may behave normally, but be slower.

Trojan:  Any program with a hidden intent. Trojans are one of the leading causes of breaking into machines. If you pull down a program from a chat room, new group, or even from unsolicited e-mail, then the program is likely trojaned with some subversive purpose. The word Trojan can be used as a verb: To trojan a program is to add subversive functionality to an existing program. For example, a trojaned login program might be programmed to accept a certain password for any user's account that the hacker can use to log back into the system at any time. Rootkits often contain a suite of such trojaned programs.



Reasons For Retention

Based on eTrust PestPatrol® Spyware Scorecard v2.0, WebSearch violates the following criteria: First, Installs without providing explicit opt-out option from any site or other application. Second, Changes browser settings, for example the default search provider, home or error page(s) etc., without user permission at time of change. Third, Installs or updates without user permission or knowledge at time of installation.

On 07.13.05 a variety of software, including 180SearchAssistant, WebSearch Toolbar, InternetOptimizer and more was installed as bundle from trufkz.html (careful, do not click this link). The user was led into installing this software under the pretense that it was necessary for use of the site: ('Please install Media Tickets to support this website'). Subsequently, the user's browser settings are change and popup ads shown.

In the past, Websearch was observered doing the following violation: Silently tracks sites visited along with identification of the user/machine by IP address, GUID for that machine, email address, name, SSN#, phone number, credit card info, or other identifier without user permission.

View Full Details