{"id":757,"date":"2004-03-19T12:01:38","date_gmt":"2004-03-19T20:01:38","guid":{"rendered":"http:\/\/lee.org\/blog\/archives\/2004\/03\/03\/3-19-04\/"},"modified":"2007-03-06T03:34:21","modified_gmt":"2007-03-06T11:34:21","slug":"malware-for-my-trophy-case-2_0_1browserhelper2dll","status":"publish","type":"post","link":"https:\/\/www.lee.org\/blog\/2004\/03\/19\/malware-for-my-trophy-case-2_0_1browserhelper2dll\/","title":{"rendered":"Malware for my trophy case: 2_0_1browserhelper2.dll"},"content":{"rendered":"

The short form:
\n2_0_1browserhelper2.dll is a nasty adware toolbar with no UI. See my 3-19-04 journal article at http:\/\/lee.org\/journal. It took me 2 friggin hours to figure this one out. It mangles Google search results in IE and sticks ads for the “websearch toolbar” in the results.<\/p>\n

Kill it by removing the BHO 2_0_1browserhelper2.dll<\/p>\n

——————
\nI was at a client’s house cleaning off spyware and I came across some particularly insidious malware. I’d do a Google search and the results would take a long time to come back. But more importantly, half of the search results were crap. They were ads for some “websearch toolbar”, directing me to www.websearch.com and such. The worst thing was that the Google results page looked almost<\/strong> normal. It almost looked like Google had sold out to these Websearch people.. allowing them to flop 1\/2 of their content toward Websearch.com<\/a>.<\/p>\n

So I downloaded Netscape and made sure that Google hadn’t sold out. a search for “Prussian medals” on Internet Explorer returned about 50% junk while the same search in Netscape looked just fine. IE was being hijacked.<\/p>\n

Now I just had to find what was doing it…. 2 hours later, bull’s-eye. Here’s the low-down:<\/p>\n

The www.websearch.com<\/a> toolbar is bad news.<\/p>\n

Here’s an excerpt from their Terms of Use:<\/p>\n

By installing the Service you understand and agree that the following changes may be made to your Internet Explorer browser and that the following functions may be performed by the Service: install a Search Toolbar in your browser which may (i) block certain pop-up ads and pages; (ii) display links to related websites and keywords based on the information you view and the websites you visit; (iii) store non-personally identifiable statistics of the websites you have visited; (iv) redirect certain URL’s including your browser default address bar search, DNS error page and Search Button page to or through the Service and; (v) automatically update the Service and install added features or functionality conveniently without your input or interaction unless you have chose to be notified of such update in advance.<\/p><\/blockquote>\n

The Terms of Use also says how to uninstall the software. (“When the Add\/Remove Programs Properties window opens, locate the listing for ‘Search Toolbar’ that you would like to uninstall from the list of installed programs.”) But, like any good malware, the uninstallation instructions didn’t work.<\/p>\n

Spybot Search and Destroy shows this software as a BHO<\/p>\n

Spybot-S&D Browser helper object report, 3\/18\/2004 9:26:07 PM<\/p>\n

{83DE62E0-5805-11D8-9B25-00E04C60FAF2}
\nClass file: 2_0_1browserhelper2.dll
\nPath: C:\\WINDOWS\\<\/p><\/blockquote>\n

One reason it took so long to figure this out was that this BHO, which normally shows up as an IE toolbar has no visible user interface… Jerks.<\/p>\n

All you have to do is disable that BHO in Spybot and you’re good to go. Another way is to rename c:\\windows\\2_0_1browserhelper2.dll. You might have to reboot into Safe mode to rename the file.<\/p>\n

I’ve got another client with the same malware. It’ll take 5 minutes to get rid of her Websearch malbar (to coin a term).<\/p>\n","protected":false},"excerpt":{"rendered":"

The short form: 2_0_1browserhelper2.dll is a nasty adware toolbar with no UI. See my 3-19-04 journal article at http:\/\/lee.org\/journal. It took me 2 friggin hours to figure this one out. It mangles Google search results in IE and sticks ads for the “websearch toolbar” in the results. Kill it by removing the BHO 2_0_1browserhelper2.dll —————— […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-757","post","type-post","status-publish","format-standard","hentry","category-general"],"_links":{"self":[{"href":"https:\/\/www.lee.org\/blog\/wp-json\/wp\/v2\/posts\/757","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.lee.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.lee.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.lee.org\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.lee.org\/blog\/wp-json\/wp\/v2\/comments?post=757"}],"version-history":[{"count":0,"href":"https:\/\/www.lee.org\/blog\/wp-json\/wp\/v2\/posts\/757\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.lee.org\/blog\/wp-json\/wp\/v2\/media?parent=757"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.lee.org\/blog\/wp-json\/wp\/v2\/categories?post=757"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.lee.org\/blog\/wp-json\/wp\/v2\/tags?post=757"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}