Parasite: eStart

This record last updated Tue Sep 20 2005 00:34:15

PLEASE NOTE: Due to the overwhelming extent of this problem and the unbelievable volume of email we have received, we regret that we cannot respond to questions about browser parasites at this time. If you have attempted to contact us about this parasite please accept our apology for not responding. "Thank you's" are always appreciated ;-)

Description

eStart is an Internet Explorer toolbar that replaces the normal ‘Links’ toolbar and bookmarks with ones pointed at a directory site called ‘TopSites’.

The HTML used for the toolbar may also place a links bar across the bottom of the screen, floating above where the toolbar normally goes.

Also known as

BandObjects by Spybot S&D, after the name of the Browser Helper Object used.

Distribution

Bundled with the installer for ‘Go MP3’, a copied LimeWire by ‘Go Software’ who seem to be the same people as TopSites. eStart gets installed even if the main program install is cancelled.

What it does

Advertising

Yes. The software opens a sidebar with ‘related’ links when a targeted keyword is spotted in a link clicked or terms entered into a form. (This functionality does not seem to be working at the time of writing.)

Privacy violation

Yes. eStart tries to work out your e-mail address by looking at details stored in the registry (at least for Outlook Express, possibly other mailers). It then send this to its controlling servers with your full name.

Security issues

Yes. eStart can download and execute arbitrary code as an update feature. The terms of use at TopSites states this may also be used to installed other third-party software. It also states that future updates may include features for which you will be billed!

Stability problems

No, except that it seems to slow down new Internet Explorer windows.

Removal

Go to the Add/Remove programs feature (Start->Settings->Control Panel) and remove the entry ‘Go’. Restart the computer.

Delete the files ‘EStartLog.txt’ and ‘EStartLogBHo.txt’ in the root of the C: drive, and ‘GoUpdate.exe’ from the root of the drive with the Windows folder in, if you have it. Open the System folder (inside the Windows folder; called ‘System32’ on Windows NT/2000/XP or just ‘System’ on Windows 95/98/Me), and delete EStartTemp.ini, BandObjs1,0,0,3.dll, Links.dll, and Install.ini, Register.vbs and Uninst.exe if you have them.