Parasite: InternetWasher

This record last updated Tue Sep 20 2005 00:34:15

PLEASE NOTE: Due to the overwhelming extent of this problem and the unbelievable volume of email we have received, we regret that we cannot respond to questions about browser parasites at this time. If you have attempted to contact us about this parasite please accept our apology for not responding. "Thank you's" are always appreciated ;-)

Description

InternetWasher is a commercial application that removes usage tracks from web browsers and various other applications.

A ‘trial’ Internet Washer Pro seems to have been widely stealth-installed from March 2003. This also installs other third-party software, including the Httper and ZipClix parasites.

Distribution

ActiveX drive-by-download on pop-up adverts. Aggressive - refusing the download generates another download prompt.

It can also be downloaded as a normal executable. The script at this site will not detect InternetWasher when it is installed this way.

What it does

Advertising

No.

Privacy violation

No.

Security issues

Yes. Can silently download and execute arbitrary code from its controlling server, as a self-update feature. This has also been used to install other parasites.

Stability problems

No.

Removal

A full installation should leave an entry for ‘Internet Washer Pro’ in the Control Panel’s Add/Remove Programs feature. Use this to remove the software, then restart and delete the ‘Internet Washer Pro’ folder in Program files.

Then open Downloaded Program Files in the Windows folder and delete the entry {421A63BA-4632-43E0-A942-3B4AB645BE51}.

A partial installation can result if the ActiveX installation gets started but does not complete. In this case there will likely be only the Downloaded Program Files entry to get rid of.

Manual removal

Open the registry (Start->Run->regedit) and find the key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run. Delete the ‘Internet Washer Pro’ entry. Restart the machine and you should be able to delete the ‘Internet Washer Pro’ folder in Program Files.

Then remove the Downloaded Program Files entry.