Limited Time!
Totally FREE Web Design!
Click here!

Parasite: Keywords

This record last updated Tue Sep 20 2005 00:34:15

PLEASE NOTE: Due to the overwhelming extent of this problem and the unbelievable volume of email we have received, we regret that we cannot respond to questions about browser parasites at this time. If you have attempted to contact us about this parasite please accept our apology for not responding. "Thank you's" are always appreciated ;-)

Description

Keywords is an address bar search and search results hijacker controlled by Queen Bee Technologies (queenbeetechnologies.com, queenb2b.com).

It is easily spotted by the text ‘Enter Keyword’ that appears in the address bars of newly-opened Internet Explorer windows.

Variants

Keywords/12: initial variant, not widespread. Stored as Program Files\Keywords, LLC\KeywordPlugin\Keywords12.dll. Controlling server www.keywordnavigator.com.

Keywords/001: most common variant. Stored as Keywords001.dll in the Downloaded Program Files folder or an installing application’s folder. Controlling server www.search-climbers.net.

Keywords/003: update, not widespread. Stored as Program Files\Windowpositions\ieplugin003.dll. Controlling server www.windowposition.com.

Also known as

KeywordNavigator (12 variant), SyedIEHlprObj (001 variant), EsploriIEHlprObj (003 variant).

Also known by the many company names under which Keywords is promoted by telemarketing: Keywords LLC, SearchClimbers (searchclimbers.com/.net, search-climbers.com/.net), Keyword Navigator (keywordnavigator.com, keywordnavigator.net), Rocket Positions (rocketposition.com), Key Windows (keywindows.com), Window Positions (windowpositions.com, windowpositions.net), Inside Position (insideposition.com, insidepositions.com), Common Search Solutions (commonsearchsolutions.com, commonnamesolutions.com, cnsusa.net), Keywords for You (keywordsforyou.com), Winspeed Technologies (winspeedtech.com), I Opportuinity Inc [sic], Monument Consulting and Aldaco Inc.

Distribution

An earlier version of this page, describing ‘KeywordNavigator’, stated that it had not been seen to install in an unsolicited manner. This was true of the Keywords/12 variant. However, the 001 variant has since been bundled with the Kazaamate application.

What it does

Advertising

Yes. When it detects a search engine being used, Keywords contacts its controlling server with the term being searched for. If a match is found, an advertiser site is inserted in an iframe at the top of the search results page.

Privacy violation

No. No unique ID or cookie is passed to the controlling server, so a user’s search engine usage cannot be tracked.

Security issues

No.

Stability problems

None known.

Removal

Keywords/12 may be removed from the Control Panel’s Add/Remove Programs list, under the name ‘KeywordPlugin’. The other variants have to be removed manually.

Manual Removal

Open a Command Prompt window (from the Accessories submenu of the [All] Programs menu on the Start button; called ‘DOS Prompt’ under Windows 95/98/Me) and enter the following commands, for the 12 variant:

cd %WinDir%\System
regsvr32 /u "\Program Files\Keywords, LLC\KeywordPlugin\Keywords12.dll"

For the 001 variant, check if Keywords001.dll is to be found in a bundling application’s own Program Files folder, typically Kazaamate. If so use the following commands:

cd %WinDir%\System
regsvr32 /u "\Program Files\Kazaamate\Keywords001.dll"

Otherwise:

cd %WinDir%\System
regsvr32 /u "..\Downloaded Program Files\Keywords001.dll"

For the 003 variant, use the commands:

cd %WinDir%\System
regsvr32 /u "\Program Files\Windowpositions\ieplugin003.dll"

Restart the computer and you should be able to delete the whole ‘Keywords, LLC’ (12 variant) or ‘Windowpositions’ folder inside Program Files, or the Keywords001.dll file inside Kazaamate (or similar) in the 001 variant. If the 001 variant was stored in the Downloaded Program Files folder, deleting it can be done from the Command Prompt with the command:

del "%WinDir%\Downloaded Program Files\Keywords001.dll"