Parasite: Gratisware

This record last updated Tue Sep 20 2005 00:34:15

PLEASE NOTE: Due to the overwhelming extent of this problem and the unbelievable volume of email we have received, we regret that we cannot respond to questions about browser parasites at this time. If you have attempted to contact us about this parasite please accept our apology for not responding. "Thank you's" are always appreciated ;-)

Description

Gratisware is an Internet Explorer Browser Helper Object. Whilst browsing with IE, it occasionally pops up advertising.

Also known as

Targit, after the company that makes it; CRS after the file and object name used; FirstPop, under which name it was previously marketed.

Distribution

Included in software downloaded from gratisware.com. This site operates by taking third parties’ shareware and repackaging them in an installer that includes Gratisware’s adware.

There may be other methods of distribution; Targit Interactive’s site claims the software may be installed by ‘e-mail providers’.

What it does

Advertising

Yes. At regular intervals whilst browsing it contacts it controlling servers at firstpop.com which may return a pop-up advert to display.

Privacy violation

Yes. The URL of the page currently being viewed is passed to the ad server on each contact, along with what looks like an ID number to allow tracking.

If you enter a valid e-mail address when registering the installed software, Targit will also and sell this for advertising.

Security issues

Suspected. Gratisware seems to connect to an updates server, which may be used to download and install new code.

Stability problems

None known.

Removal

There is no uninstall feature, but there is an uninstaller executable available (though hidden) at Gratisware (not tested). Ad-Aware and Spybot S&D can also remove Gratisware.

The EULA shown with Gratisware installs claims that removing the adware will stop the third-party shareware from working; I did not find this to be the case with the software I tested (though using the official uninstall might work differently).

Manual removal

Before you can delete the program files you must deregister the Gratisware BHO. Open a DOS command prompt window (Start->Programs->Accessories) and enter:

cd "%WinDir%\System"
regsvr32 /u CRS32.dll

Restart the computer and you should be able to delete the files ‘CRS32.DLL’, ‘CRS.EXE’, ‘CRS32.REG’ and either ‘CRS.OLD’ or ‘NEXT.DL_’ from your System folder (inside the Windows folder, called ‘System’ on Windows 95/98/Me or ‘System32’ on Windows NT/2000/XP). You can also delete the Gratisware folder inside Program Files and the registry key HKEY_LOCAL_MACHINE\Software\Gratisware to clean up.