internetinspiration logo internetinspiration.co.uk
Home Internet Guides Privacy & Security Must have software Internet Shopping Earn Money Fun & Games Freebies

Privacy and Security
Browser helper objects (BHO) & Browser hijackers

Browser helper objects, or BHO are small applications that add a specific feature to your browser. Most are useful features to carry out a specific task by clicking a button which is added to your tool bar, or a specific search engine.

The fact that BHO's can be installed without your knowledge and are capable of doing almost anything to your computer, including change or delete settings or parts of your hard drive, they are another area for concern and worth mentioning.

When your browser loads it will check the registry and add any BHO's it finds. This ensures they are loaded every time you access the internet making them an attractive avenue for abuse.
BHO's can literally take control of your browser and what web sites you see, advertisements, pop ups (including pornographic ones) can appear to be connected to a web page, when actually they are being generated by un-associated servers.

Their connections out of your computer are also hidden from firewalls, as their programmes are worked into the browser, you will receive a request from your browser not the BHO to access the internet, in a seemingly harmless manner, or worse still will add themselves to your firewalls trusted sites to avoid the access request.

They are usually fuelled by someone determined to get their commission earning advertisements in your computer and can do things like
- supply an endless stream of pop up advertisements
- redirect search enquiries and error pages
- add or change advertisements on web pages, which in effect rip off webmasters as their pages are being used, without permission, fees or commissions.

A BHO cannot install itself. They will be carried into your computer by a trojan or spyware application as one of their programmed functions. The BHO component of a malware application is a .dll file (Dynamic Link Library), which allow many separate programs to access or share a single application. In this case, the .dll file gives the Malware access to Internet Explorer.

. There is an excellent free tool by Definitive solutions which can show you all the BHO's that have been installed in your computer, and offers details like who put it there, so you can decide whether to allow or block it. Get BHO DEMON.
The list at the bottom of the page might also help you filter out the unwanted by naming applications that use BHO's in a way that compromises your privacy and security.

Spyware Guard is a free download that will go some way to preventing them installing in the first place.

Browser hijackers.

Unfortunately, an ever increasing number of companies are prepared to use underhand methods of getting visitors to their sites, or view their commission earning advertisements, and of course, there is an increasing number of people prepared to create new ways of providing this service.

They employ a variety of methods to trick you into allowing them to do this, or even worse, devise ways of secretly taking over your internet browsing.

Some pose more of a threat than just your PC privacy, some of them are fuelled by pornography, even that which surpasses what is considered to be moral or legal in most countries.

They change your home page, (the page which first opens when you connect to the internet) if you try to reset it (see our section on browsers) it will either not change, or be there again the next time you connect to the net.

They can also add web sites to your favourites and redirect your search enquiries to their own pages which contain a list of their advertisers rather than search results from the web, some are even made to look like genuine Google or Yahoo results.

Some of these things can be detected and removed manually if you are familiar with editing your registry, if not, use the programmes below.
Ad-Aware SE( Spyware scanner that has many hijackers in its database -Free version available)
BHO DEMON (Lists all Browser helper objects installed, allows user to disable - free)
Ewidow Detects and removes malware, including hijackers. Free trial reverts to free version after 14 days.
CWS shredder (Dedicated scanner for most of the older variations of the Cool web search hijacker - Free)
Pest Patrol large list of hijackers in its database - $39.95-approx £23).
Spybot S&D (Comprehensive scanner that has many hijackers in its database - Free)
SpywareBlaster (Adds large list of web sites that install spyware/malware to a browsers block list, preventing installation - free)
Spyware Guard (From the same company, and works in conjunction with SpywareBlaster, prevents hijackers - Free).
Download X-Cleaner (free trial)

2006 has seen an explosion in Browsers and desktops being hijacked by an ever expanding list of CoolWebSearch trojans which display a variety of fake warnings to frighten you into thinking you have spyware, viruses or critical system errors. Links then take you to their own software to remove these non-existent problems. Commercial security software has had difficulty cleaning these infections.
We have developed a removal tool to help with the detection and removal of the files and registry keys of the installing/accompanying trojans. Roguefix

There is also a free application called Hijack This, which will produce a log file of particular areas of your registry and hard drive, you then either learn how to interpret the results or post the log file on a forum and lots of clever people will look at it for you and tell you what to delete.
Or you can copy and paste your log file Here for an automated analysis. You will be able to detect and remove any sort of malware, as well as some viruses and Trojans.
Whilst all this is supplied Free to you, they do rely on donations from users to keep them going. if it solves your problems, please consider making a small donation to them.

Below is a list of known BHO's and hijackers, whist we do not pretend it contains all of them, we will update it regularly and keep you as informed as we can.

Programme Details detection tools
123search Hijacks browsers to deliver their advertisers as search results X-Cleaner
Pest Patrol
A A B C D E F G H I J K L M N O P Q R S U V W Y Z
Actual names Targets popular browsers Internet explorer, AOL and Netscape. Directs search enquiries to their clients/advertisers X-Cleaner
Spybot S&D
Adbreak Delivers pop up adverts and changes your homepage Ad-Aware SE
Spybot S&D
Pest Patrol
Adgoblin delivers pop up adverts and and has regular contact with its server. Pest Patrol
Spybot S&D
AdRoar Delivers pop up advertisements. Rated as a trojan with some security companies Pest Patrol
X-Cleaner
Alexa toolbar There has been much debate as to whether Alexa constitutes spyware. It is a search engine powered by Amazon, that uses a unique ranking system, which shows how many times a particular site is visited. To collate this information, they monitor uses surfing activities. There appears to be no malicious intent, but the monitoring usually means it is classified as spyware. Pest Patrol
Ad-Aware SE
Spybot S&D
Athoc toolbar Browser hijacker Pest Patrol
Spybot S&D
Aurate Listed as a trojan in some parts of the web, and is almost impossible to remove manually Pest Patrol
X-Cleaner
Aurora Difficult to remove Transponder variant from Direct revenue. Their latest 'trading name' is Bestoffers. Manual removal instructions
Autosearch Re-directs any searches to its own page displaying its own advertisers. It is capable of overcoming subsequent attacks from rival hijackers. Pest Patrol
X-Cleaner
B A B C D E F G H I J K L M N O P Q R S U V W Y Z
Bargain Buddy Delivers advertisements based on search enquiries and forms. Pest Patrol
X-Cleaner
Bookedspace Delivers pop up advertisements, can also download other software and applications X-Cleaner
Spybot S&D
Bonzibuddy adserving spyware is installed behind an animated cartoon character. Its own uninstall feature leave components behind, so scan PC with spyware scanner if used.
Spybot S&D
Trend Micro
Pest Patrol
BrowserAid Installs various Internet toolbars, usually without your knowledge that will redirect all your search results and make them look like Google results, it will deliver advertising pop ups, install third party software and intermittently hijack your home page X-Cleaner
Spybot S&D
Burnaby
AKA Cytron
Is scans web pages viewed for keywords, and delivers pop up ads. Designated a Trojan in some quarters, arrives hidden in a piece of software apparently needed to view e-cards from surprisecards.com
Spybot S&D
Pest Patrol
X-Cleaner
C A B C D E F G H I J K L M N O P Q R S U V W Y Z
ClearSearch A search utility that allows you to access multiple search engines at once, but it actually just reffers you to one of its advertisers that have bought keyword in your search query or injects an affiliate code. It also sneaks into PC's on the back of other (usually unwanted) free software, calls home daily with details of your internet activity. It can detect the presence of, and uninstall many of its competitors. Pest Patrol
Ewidow
CleverIEhooker Search toolbar, browser hijacker and resource hog X-Cleaner
Spybot S&D
Clientman Early versions redirects searches made on Google and Yahoo, highlights keywords on a webpage with a yellow background and directs to an advertisers site if clicked on, more recent versions redirect search enquiries. It can also gather information from e-mail accounts, Instant messengers and some security software. can tamper with Zone alarm and Norton firewall. Ad-Aware SE
Spybot S&D
Pest Patrol
Comet cursor Software that changes your cursor when visiting affiliated sites. It delivers pop up ads and can change advertisements on web pages to their own commission earning ones. Pest Patrol
X-Cleaner
Spybot S&D
Commonname toolbar browser Helper object that hijack the browser and delivers advertisements, WARNING - Improper removal of these files can result in you not being able to connect to the internet, Download LSP Fix first, if you are unable to connect to the net after removing Commonname, run LSPFix

Spybot S&D
Pest Patrol
Coolwebsearch
AKA CWS
A very complex and devious hijacker that is constantly releasing new versions which are increasingly difficult to remove. Delivers pop ups, some to borderline legal pornographic sites. It add webs sites to your favourites and your trusted zone. It can also tamper with your security software.
The latest version give fake warnings of infections or system errors and download scanners like Spyfalcon, spyaxe, SpySheriff and many others, which you should buy to clean the non-existent infections
Trojan Remover
Ewidow
CWS shredder
X-Cleaner
Spybot S&D
Roguefix
Customtoolbar It installs itself automatically, without warning, under pop ups. Some anti virus software detects this as JS.exploit. Ironically. one of the sites involved in its distribution is stopannoyingpopups.com Pest Patrol
This application exploits a vulnerability in Microsoft's java, download a patch from Windows update,
D A B C D E F G H I J K L M N O P Q R S U V W Y Z
E A B C D E F G H I J K L M N O P Q R S U V W Y Z
Elite toolbar A stubborn malware from Searchmiracle.com that gets more difficult to remove with each new version. traditional scanners can detect it but cannot remove it. removal tool
EnjoySearch A new hijacker on the block, early research suggest it could be associated with Cool web search X-Cleaner
Exactsearch Advertised as mail.com toolbar, delivers advertisements.
Spybot S&D
Reg block
X-Cleaner
ezSearching Sends pop ups and hijacks search results Pest Patrol
Spybot S&D
eZula Installed with file sharing programmes like KaZzA, it turns normal words on a web page into links which then direct you to their advertisers sites.
Spybot S&D
X-Cleaner
Pest Patrol
Reg block
F A B C D E F G H I J K L M N O P Q R S U V W Y Z
Favourite man Adds programmes to favourites list, many of the programmes it adds contain spyware, malware or some other parasite. Ad-Aware SE
Reg block
Pest Patrol
FriendGreeting Classified as a trojan by some anti virus software, installed with e cards, once installed it will send a e greeting to everyone in the address book in an attempt to infect other computers. Remove by clicking start>settings>control panel>Add and remove programmes and delete 'Friends greetings' and 'WinSrv Reg' or use
Spybot S&D
G A B C D E F G H I J K L M N O P Q R S U V W Y Z
Go hip A search protal that shows 'Free' movies. It hijacks your browser and delivers pop up ads To remove. go to www.gohip.com/remove_
browser_enhancement

Spybot S&D
X-Cleaner
Go!Zilla File sharing programme that installs other spyware applications. Uninstalling Go!Zilla will leave behind the spyware Pest Patrol
H A B C D E F G H I J K L M N O P Q R S U V W Y Z
Hit pointer Usually picked up from porn sites, hijacks the browser and delivers pop ups when pages are viewed that contain JavaScript. Removal can be difficult, sometimes detected by spyware scanners, sometimes not. If scanners do not remove it, look for Qameskan in Add / remove programmes. and empty your IE cache so previously viewed/amended pages cannot pages cannot be recalled. CWS shredder
Ad-Aware SE
Spybot S&D.
Httper Known to be installed with Internet Washer, whose makers are ironically connected to popupblockade.com
Delivers pop ups and hijacks error pages
Delete by using the computers Add/Remove facility. Or use
Spybot S&D
Huntbar Delivers pop up advertisements, redirects you to its sites when clicking on links and can reset your home page to Websearch.com Pest Patrol
X-Cleaner
Spybot S&D
I A B C D E F G H I J K L M N O P Q R S U V W Y Z
Ilookup Internet explorer toolbar, installed behind pop up adverts. Adds search box, link buttons, adds items to favourites, hijacks homepage. There are different versions which direct your searches to different search engines.
Spybot S&D
Pest Patrol
X-Cleaner
Reg block
IEplugin Hijacks your browser and monitors web sites visited, forms input and local files for any of its programmed keywords, then will deliver advertisements. Known as a Trojan downloader in some parts of the web. Pest Patrol
X-Cleaner
Kaspersy Antivirus
IEMonit Moniters search engine queries for sex related words. If one its listed words are used it delivers pop up ads. Pest Patrol
InetSpeak Adds a line of buttons and links to the standard Internet explorer tool bar, which cannot be removed. Also delivers advertisements. Installed as part of the music magnet file sharing software. Pest Patrol
X-Cleaner
Reg block
Spybot S&D
Internetbillingsolution Software that delivers advertisements to your computer Pest Patrol
J A B C D E F G H I J K L M N O P Q R S U V W Y Z
K A B C D E F G H I J K L M N O P Q R S U V W Y Z
KeenValue Also Known as incredifind, includes a Host file hijacker to redirect search enquiries Pest Patrol
Ewidow
Trend Micro
Spybot S&D
KOOLBAR Delivers advertising pop ups. It comes complete with a hidden re-installer, just in case you try to delete it. Pest Patrol
Ewidow
L A B C D E F G H I J K L M N O P Q R S U V W Y Z
LinkReplacer Adds content to the top of every web page you visit. No only does it use web space it is not entitled to, or have permission to, the added code can cause an 'application error' each time a window is closed. The application can also copy cookies stored on your PC and send then to the originators server. Pest Patrol
Spybot S&D
X-Cleaner
Reg block
Look2me From , a company that produces not only malware that is difficult to remove, it also markets the spy ban spyware scanner. Kill2meSpecific removal tool, from merijn.
Spybot S&D
Lop lop has a wide variety of variants, all from C2 media. Known as a Trojan by some, it hijacks your browser with their home page and search engine, LOP.com (Live online portal). It also puts shortcuts on your desktop and adds sites to your favourites. It comes attached to Mp3search. Some variants can resist removal.
Spybot S&D
Pest Patrol
Kaspersy Antivirus
McAfee Security
M A B C D E F G H I J K L M N O P Q R S U V W Y Z
MARGOC Delivers advertising pop ups. Trojan Remover
Ewidow
X-Cleaner
Meridian Delivers advertising pop ups, mostly pornographic Pest Patrol
Mulitmedia Speedbar Homepage Hijacker Pest Patrol
X-Cleaner
Mylittlespy Keyword logger that is difficult to detect and remove. It runs completely hidden. Pest Patrol
Mysearch
Mywebsearch
Not a threat in itself, but can appear to be difficult to remove if not uninstalled correctly. Can also be an indication of a malware infection as it can be installed by other parasites Manual removal instrucions
N A B C D E F G H I J K L M N O P Q R S U V W Y Z
nCase Delivers targeted pop up ads from 180solutions, even on your desktop when not connected to the internet, and can disable its competitors BHO's. Resists removal. Sometimes classified as a trojan. Ewidow
X-Cleaner
Spybot S&D
Pest Patrol
McAfee Security
Kaspersy Antivirus
NetPal Opens pop up advertisements when instructions are received from its server. It can also record the web addresses and even e-mail addresses to be sold to spam merchants. Pest Patrol
X-Cleaner
NewtonKnows Toolbar with search hijacker. It also displays links in 'speech bubbles' whilst browsing and send personally identifiable data back to its server
Spybot S&D
Pest Patrol
X-Cleaner
Reg block
Ntsearch Variant of the aggressive Coolwebsearch hijacker CWS shredder
X-Cleaner
O A B C D E F G H I J K L M N O P Q R S U V W Y Z
P A B C D E F G H I J K L M N O P Q R S U V W Y Z
Prositefinder From 180 solutions, renown for their difficult to remove adware. Monitors internet activities and delivers targetted advertising pop ups. Ewidow
X-Cleaner
Pest Patrol
Q A B C D E F G H I J K L M N O P Q R S U V W Y Z
R A B C D E F G H I J K L M N O P Q R S U V W Y Z
Radiate Formerly called Aurate from adsoftware.com . Listed as a Trojan in some parts of the web, and is almost impossible to remove manually. It is installed secretly with hundreds of shareware programmes, and has been estimated to be in 30 million pc's worldwide. Delivers banner advertisements and reports back to server with your surfing habits.
Spybot S&D
Pest Patrol
S A B C D E F G H I J K L M N O P Q R S U V W Y Z
Scbar Delivers pop up advertisements based on your search enquiries Pest Patrol
X-Cleaner
SearchSquire This is installed automatically when a web site containing its pop up advertisements is viewed. It will show paid for links in a side bar when search enquiries are made.
Spybot S&D
X-Cleaner
Searchex homepage and search hijacker. This application is detected as a trojan-Adwaredropper.A by some anti virus software. Installs with an anonymous Valentines message or with Netspeed software Pest Patrol
X-Cleaner
T A B C D E F G H I J K L M N O P Q R S U V W Y Z
Transponder Records search and form entries, some variants can also deliver pop up advertisements. Some variants can avoid detection and resist removal Ewidow
Pest Patrol
X-Cleaner
U A B C D E F G H I J K L M N O P Q R S U V W Y Z
UCmore Displays links, which appear to be connected to the site being viewed. (Version 4 is not considered to be a threat) Pest Patrol
X-Cleaner
Spybot S&D
V A B C D E F G H I J K L M N O P Q R S U V W Y Z
VX2 Delivers pop ups, adds items to desktop. Difficult to remove. A variation of the transponder adware from Direct revenue. Vx2 cleaner (Plug in for the Ad-Aware SE scanner)

Kill2me (Direct download)
Trojan Remover
W A B C D E F G H I J K L M N O P Q R S U V W Y Z
Webhancer delivers pop up ads and sends out internet usage information, in addition to being the cause of slow internet performance, as the outgoing information hogs your system, many boot up problems, and 'illegal operations' messages for 'whagent'.
If you delete the file hoping it will just go away, it will prevent you connecting to the internet, or cause endless crashes. If this happens, you will have to reinstall the webhancer software, and try again.
Spybot S&D
Adware SE
Pest Patrol
X-Cleaner
Whazit Hijacks homepage, search results and error messages
Spybot S&D
Pest Patrol
X-Cleaner
Winfix
Winfix 05
Winfix2005
winfixer
winfixer 2005
Is installed by a variety of other Malware, the latest being the Vundo trojan. Difficult to remove. Manual removal instructions
Winshow When specific words are included in a viewed web page, targeted pop up ads are delivered. It is also classified a Trojan Pest Patrol
X-Cleaner
Kaspersy Antivirus
AVG
Wurldmedia Redirects links through its own servers to steal referral and commission fees.
Spybot S&D
Pest Patrol
X-Cleaner
X A B C D E F G H I J K L M N O P Q R S U V W Y Z
xxxtoolbar BHO that installs a search utility to specifically search for adult material
Spybot S&D
Pest Patrol
BHO DEMON
Xupiter Redirects links through a third party server to steal webmaster and affiliate fees. It can also hijack home pages and deliver pop up ads. Pest Patrol
X-Cleaner
McAfee Security
Y A B C D E F G H I J K L M N O P Q R S U V W Y Z
Z A B C D E F G H I J K L M N O P Q R S U V W Y Z
Zango Previously known as n-case. Delivers targeted pop up ads from 180solutions, even on your desktop when not connected to the internet, and can disable its competitors BHO's. Resists  removal. Sometimes classified as a trojan. Ewidow
X-Cleaner
Spybot S&D
Pest Patrol
McAfee Security
Kaspersy Antivirus

The next page looks at the latest way how these, and other parasites are getting into your computer system, by using 'drive by downloads'
Privacy & Security

Information

E-mail

Viruses

hackers, crackers & firewalls

Trojans

Spyware

Keyloggers

Cookies

BHO's & Hijackers

Drive by downloads

diallers

Scams & Hoaxes

Hijack this-
automatic analysis


Free pest scan

Unwanted processes

How to-Tutorials

Clean up/repair after malware infection

Prevent malware installing

Install Hijackthis

Start in Safe mode

Show hidden files/folders

enable/disable Active X controls

Disable Messenger service pop-ups

Use the Host file

Roguefix -
Removal tool for Rogue spyware removers & Fake Warnings
removal tool


Kill E2Give

Kill MySearch

Kill Sdbot-ADD / lockx.exe

Kill seeve.exe / mediamotors pop ups

Kill Winfixer2005

Kill SysProtect

News/Articles

New Winfixer infection displays fake Blackworm warning

The real cost of Free security software

Wintask5



Cookies Brive by downloads About us Contact us FAQ Links Privacy Statement Site Map Webmasters
Click here to add this page to your favorites
©Internet Inspiration, 2003.      All registered trademarks are observed and respected.
If you receive advertising pop ups whilst viewing this site, you are infected with an ad-serving parasite, because we don't use pop ups. See our Privacy & security section for help with detection and removal.