Parasite: LinkReplacer

This record last updated Tue Sep 20 2005 00:34:15

PLEASE NOTE: Due to the overwhelming extent of this problem and the unbelievable volume of email we have received, we regret that we cannot respond to questions about browser parasites at this time. If you have attempted to contact us about this parasite please accept our apology for not responding. "Thank you's" are always appreciated ;-)

Description

LinkReplacer is an Internet Explorer Browser Helper Object that adds content to the start of every web page viewed.

This content is (currently) a script that reads all your cookies and sends them to LinkReplacer’s controlling server wcft.net.

Distribution

As yet unknown.

What it does

Advertising

No.

Privacy violation

Yes. Cookies set by web sites (and sent by LinkReplacer) may contain personally identifying information.

Cookies are also often used for authorising access to web sites. LinkReplacer’s owners will often be able to gain access to your accounts on web sites you have accessed with it loaded.

Security issues

Yes. LinkReplacer can download and execute arbitrary code as an update feature.

On opening a new IE window, LinkReplacer contacts its controlling server to download the script to be added, and a new copy of itself if it has not updated for a while.

Stability problems

Yes. On closing an IE window you may receive an ‘Application Error’ crash in IEXPLORE.EXE.

Adding the script to the very start of each page can cause web pages that rely on a standards-compliant document type to render badly in IE6.

Removal

Open a DOS command prompt window (Start->Programs->Accessories) and enter:

cd "%WinDir%\System"
regsvr32 /u iehelper.dll

Restart the computer and you should be able to delete the file ‘iehelper.dll’ inside the System folder (inside the Windows folder; called ‘System32’ under Windows NT/2000/XP or ‘System’ under Windows 95/98/Me).

You might also want to change the passwords on web site accounts you have that LinkReplacer may have compromised.

* Parasite information and detection script by Andrew Clover - www.doxdesk.com, used with permission.

For more information about Scumware, Spyware and Parasites, their sources and their cure, visit our About Parasites page and related Tech Links.

Visit our new services portal at Allen One for a completely new parasite database format, comming November 2005!