Copyright © 1999 - 2006, Sandra Hardmeier, All
Rights Reserved Worldwide
Last updated
20/08/2006
Update: 11 September 2004
I decided it was time to check out the latest version of Intelligent Explorer. Not much has improved. As you may recall, my curiosity was aroused after discovering that http://security.kolla.de/kbase.php?lang=en&sbi=spybots&kbase=ieplugin no longer exists and that http://www.doxdesk.com/parasite/IEPlugin.html has had all information removed while a "legal response to its [ieplugin's] manufacturers" is worked out [there's nothing like a hint of mystery to get the blood moving]. A few other URLs exist, but information is sparse.
There are some small changes since my last test; Lycos Side Search is gone, as is the horrid 'intelligent desktop' that caused so many problems on my system. Apart from that, things are as bad as ever.
Installation
I use Kerio Personal Firewall to monitor and control exactly what happened on my system vis a vis internet access. Everything starts with a file called 'webplugin.cab'. During installation the following programmes requested access to the internet:
wupdt.exe (stored in the hapless user's temporary files)
Search assistant (salm.exe) stored in c:\windows
wildwintracker.exe (via temporary file directory)
winfhp.exe (again via the hapless user's temporary file directory)
bargains.exe
dw.exe
The installation is achieved via activex, and there is a prompt that must be accepted, but it does not advise users about exactly what will be installed. How convenient that the 'name' is cut off with an elipses (I tested with several browers, all had the same problem):
This is the desktop web search toolbar and the mystery 'desktop toolbar' icon:
The web search toolbar remains on top of any other programme that you may open - extremely irritating. A DESKTOP feature should NOT force itself on top of any other programme that runs:
This is the search bar that is installed in IE - a search toolbar that comes back even if you turn it off and then lock IE's toolbars:
This is the result of my AdAware scan after installation of the software. Note that that there were NO COOKIES on the system at the time of scan. Every single file is a malware file.
After installation
Something called 'hopper' requested access to www.smartpops.com, stored in the directory c:\program files\recommended hotfix 421701d\v\v15. The file is rh.exe. After I permitted it access to the internet many popups appeared, including, to my absolute disgust, an advertisement involving McAfee - no company that uses adware pop-up windows to tout their wares deserves our money, nor does any company that allows itself to be associated with adware popup windows. Note that if I denied the programme access, no popups appeared.
Bargains.exe has also tried to access the internet, numerous times.
My home page is unaffected, but IE's search pane has been taken over by search.ieplugin and the 'customize' option in the search pane has also been hijacked, preventing an IE user from choosing another search engine. I note that the search pane is opening spontaneously whenever I try to use IE's 'search from addressbar' or my Vivisimo minibar. Altavista's search toolbar does not seem to trigger ieplugin.
Add/remove programs (Control Panel) reveals that the following malware was installed as part of the 'Intelligent Explorer' install:
Bargain Buddy
Downloadware
MidAddle
Recommended Hotfix - 421701D (how dare they try to hide malware by calling
themselves a hotfix)
Uninstall 180searchassistant
After online uninstall
As happened with my previous experiences with Intelligent Explorer, their 'uninstall' programme doesn't do much at all, apart from removing the search toolbar in IE and the search pane on the desktop (the aberrant desktop icon remained). An online uninstall survey was triggered and I promise that I was *very* honest. Bargains.exe and 'search assistant' continue to try to access the internet. The prompt windows that appear during uninstall are below (how thoughtful of them to offer to install even more malware during their uninstall):
During the uninstall, something called 'Marketscore Internet Accelerator' kept on trying to access www.marketscore.com. The guilty file, ossproxy.exe, was stored in the directory c:\windows\system32\ . How dare they store malware in my system directory!! This behaviour has continued despite several reboots.
After uninstall bargains.exe continues to try to access the internet. The aberrant desktop icon remained, my search pane options were unchanged, and my customise ability is still cripped. I examined add/remove programs and found that the following programmes remained:
Bargain Buddy
Downloadware
midAddle
Recommended Hotfix 421701D
Relevant knowledge
Uninstall 180searchassistant
This is my Adaware scan after running the online uninstall. Note that that there were NO COOKIES on the system at the time of scan. Every single 'object' is malware.
My next step is to use the uninstall programmes available via Control Panel.
After uninstall using Control Panel
Bargain.exe and 'Marketscore Internet Accelerator' continue to demand internet access. The uninstall of 'Bargain Buddy' froze. I had to use Task Manager (ctrl, alt, del) to retrieve the situation (bargain.exe was active in memory and refused to shut down).
Next to be removed is Downloadware (which triggered a Clipgenie uninstall survey). I promise that I was very honest in my reasons for removing the software. It disappeared from Control Panel, but an AdAware scan will reveal if it was 'really' uninstalled.
Next - the mysterious midADdle (Marketscore Internet Accelerator and Search Assistant continue to demand internet access) - the uninstall failed:
Next is 'Recommended Hotfix - 421701D'. Again, how dare malware try to disguise itself as a hotfix. I believe that this is a deliberate attempt to disguise malware as a legitimate critical patch or security patch. Mysterious warnings that IE would no longer work appeared during uninstall, and were ignored. 'Hopper' (a popup generator) tried, numerous times, to access 'www.smartpops.com' as part of the uninstall.
Next is 'Relevant Knowledge'. It disappeared easily enough.
Next is 'Uninstall 180search assistant' - numerous requests to access the internet were received, and permitted. An uninstall web page appeared. I needed to navigate several ' yes I really do want to remove the software' dialogues.
Now for a rescan with AdAware after running all the individual installs....you would expect, after all this messing around, and running all those individual uninstalls, that your computer would be clean, yes? Think again.
After using all manual uninstall programmes that are available via add/remove programmes
A screen shot of AdAware will tell all - again, all cookies were removed from the system before scanning.
*52* objects still recognised, only 2 of which are cookies. Despite deleting all 52 objects, Internet Explorer's search pane and customise options did not work correctly. I had to go to IE tools, internet options, programs, and use the 'reset web settings' option to get things back to normal.
Summary: Intelligent Explorer installs several programmes, but does NOT remove these programmes as part of its uninstall protocol. This is not acceptable. An 'uninstall' should leave your computer in the same state as it was before the original install. It is extremely distrurbing that several programmes that did not exist on my system before the install of Intelligent Explorer, continued to try to access the internet *after* Intelligent Explorer was uninstalled, and after several reboots.