WAYS OF INFECTION
Parasitical browser plugins differ from regular viruses. They do not spread by themselves and usually must be installed as any other software with or without user content. There are four major ways unsolicited browser plugins can get into the system.
1. Some vendors of malicious browser plugins deceive users by presenting a particular product as a very needful and absolutely harmless tool, for example, a powerful web search service or reliable pop-up blocker. Users download and install such plugins. However, practically all of them appear to be not only completely useless or ineffective, but also potentially dangerous. Although in most cases users can uninstall these products, malicious components may stay in the system and remain fully functional.
2. Lots of free, advertising-supported or shareware products are bundled with small add-ons needed by the host program to work properly. These add-ons actually are third-party spyware or adware parasites and malicious browser plugins. Uninstalling the host application not always removes bundled threat.
3. Lots of spyware and adware parasites have integrated third-party browser plugins that get silently installed during the host parasite’s installation process. Removing a particular spyware or adware doesn’t affect a browser plugin.
4. Some unsolicited browser plugins can get into the system using Internet Explorer ActiveX controls or exploiting certain web browser vulnerabilities. Their vendors run insecure web sites filled with malicious code or distribute unsafe advertising pop-ups. Whenever the user visits such a site or clicks on such a pop-up, harmful scripts instantly install a parasite. The user cannot notice anything suspicious, as a threat does not display any setup wizards, dialogs or warnings.
Browser plugins affect mostly Microsoft Internet Explorer web browser. Some less prevalent threats are designed to compromise other popular browsers.
WHAT A BROWSER PLUGIN DOES?
- Installs additional web browser toolbar with particular features like a web search service, search assistant, pop-up blocker, form-filling utility or other similar tool.
- Creates additional web browser buttons, displays numerous links to various Internet resources, adds bookmarks to the web browser’s Favorites list.
- Tracks user’s web browsing habits, gathers information about user’s interests, records addresses of visited web sites, logs taken actions and sends some or all collected data to a remote server.
- Displays pop-ups and shows commercial advertisements in web browser’s windows or within particular toolbars.
- Changes web browser’s default home and search pages to predetermined web sites without asking for user permission.
- Redirects a web browser to a predefined site whenever the user enters invalid address, performs an Internet search or without any obvious reason.
- Modifies essential web browser settings and adds undesirable or insecure resources to the Trusted sites list.
- Degrades overall web browser stability and performance. Some parasites are badly programmed, they waste too much computer resources and conflict with installed applications.
- Provides no fully functional uninstall feature.
EXAMPLES OF BROWSER PLUGINS
There are lots of different parasitical browser plugins. The following examples illustrate how treacherous and harmful these threats can be. DashBar
is one of the most prevalent browser plugins. It installs an additional Internet Explorer toolbar that offers a web search service, form-filling utility, useful navigation buttons such as Weather, Entertainment or News. However, its advertising-supported version silently downloads and installs main components of GAIN adware parasite. SearchWords
is a toolbar for Internet Explorer that modifies web search settings and displays undesirable commercial advertisements. The parasite must be manually installed. However, it provides no functional uninstall feature. SearchWords runs every time a user starts Internet Explorer. zSearch
is a third-party Internet Explorer toolbar that offers an Internet search service. The program records addresses of visited web sites, logs performed web searches and collects information about computer and installed software. Then gathered data is sent to a remote web server. zSearch can update itself via the Internet without user knowledge. The threat runs on every Windows startup. HungryHands
is a parasitic browser plugin designed to redirect the web browser to adult Internet sites without asking for user permission. HungryHands can be installed as a component of some advertising-supported software. It doesn’t have the uninstall feature.
CONSEQUENCES OF INFECTION
Most parasitical browser plugins complicate usual web surfing. They often redirect a web browser to undesirable web sites, display large amount of annoying commercial advertisements, even block access to certain Internet resources. Their search services are able to intercept keywords that the user enters into popular Internet search engines and present own results, which aren’t very precise and reliable. Although such behavior is not harmful, the user may be unable to quickly find required information.
Some browser plugins affect the system and installed software. Parasites cause web browser instability issues, frequent errors and overall performance problems. Some reputable applications and legitimate browser add-ons may be also affected by parasite activity.
Some threats violate user privacy. They disclose user’s personal information to advertisers and even hackers. Malicious persons use parasitical browser plugins to track user activity in the Internet, find out their victim’s name, contact information and even steal priceless identity data, which then can be used for unclear purposes.
HOW TO REMOVE A BROWSER PLUGIN?
As it was said above most browser plugins are quite similar to spyware and adware threats and therefore cannot be removed with the help of popular antivirus products. To remove them special anti-spyware tools (spyware removers) should be used. These programs scan the system in similar way as antivirus software does. However, they have special parasite signature databases, which allow them to detect and eliminate most privacy risks. Powerful spyware removers include real-time monitors that prevent the installation of known risks and unauthorized system modification. The most effective and popular anti-spyware programs are Microsoft AntiSpyware Beta, Spyware Doctor, Spybot - Search & Destroy, Ad-Aware SE, SpyHunter, eTrust PestPatrol. Several products such as HijackThis are designed especially to detect and remove parasites that affect a web browser.
In some cases even a spyware remover can fail to get rid of a particular parasite. That is why there are Internet resources such as 2-Spyware.com, which provide manual malware removal instructions. These instructions allow the user to manually delete all the files, directories, registry entries and other objects that belong to a parasite. However, manual removal requires fair system knowledge and therefore can be a quite difficult task for novices.
Not all browser plugins (even if they track some personal information) are bad and needed to remove immediately.