 Description
FreeScratchAndWin is an IE Browser Helper Object that comes
with a web-based 'scratchcards' game. (What exactly is available
to be won, and whether anybody has ever won it, remains unclear.)
Variants
FreeScratchAndWin/Beta: a version of the software
that didn't seem to work fully, but was distributed anyway.
FreeScratchAndWin/v5: most common variant of the
software. Includes a homepage- and search-hijacker pointed
at xzoomy.com.
FreeScratchAndWin/v6: now renamed 'Free Scratch
Cards'. Instead of the xzoomy hijack this now bundles lop/Rnd. Like lop/Rnd, it
uses random filenames for its files, and cannot be detected
by the script at this site.
Also known as
FSW, FSC (v6 variant). CPM Media,
after the company name used to sign the software.
Distribution
Installed by ActiveX drive-by download in affiliate pages
which are redirected to by AdsCPM, the advertising network
company who run FreeScratchAndWin.
What it does
Advertising
Yes. Connects to its controlling servers and downloads and
opens pop-up adverts every few minutes.
Privacy violation
Suspected. The software's terms of use advises that the software
can track users' web usage. However this behaviour has not
actually been observed.
Security issues
Yes. Downloads and installs arbitrary unsigned code as part
of an update feature; it claims that it will prompt you before
installing extra third-party software.
Stability problems
None known. Although it sometimes seems to go crazy and start
connecting to its controlling servers every couple of seconds,
which generates an annoying amount of traffic.
Removal
There are uninstallers available for v5 and v6 from the manufacturers
(not tested, may or may not work).
Manual Removal
Beta variant
Open the registry (Start, Run, regedit) and delete the following
keys:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\FSW
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\
Shutdown\SetupProgramRan
HKEY_CLASSES_ROOT\CLSID\{20A03A4C-9FAF-45D5-A5C2-B6C49774E03C}
HKEY_CLASSES_ROOT\CLSID\{99B0B113-6F25-49C9-8ECF-2FDDD3EDFF6A}
HKEY_CLASSES_ROOT\FSW_beta1.Application
HKEY_CLASSES_ROOT\Fswinst.Application
Reboot Windows and delete the 'FSW' folder inside 'Program
Files'. You can also remove a leftover installer file from
a DOS command prompt window (Start->Programs->Accessories):
cd "%WinDir%\Downloaded Program Files"
del fswinst.ocx
v5 variant
Open the registry (Start, Run, regedit) and delete the following
keys:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\FSW
HKEY_CLASSES_ROOT\CLSID\{47CC4DCD-BBC9-47A3-A677-44DB2559E0D8}
HKEY_CLASSES_ROOT\CLSID\{5DD7B3BE-FDEC-4563-B038-FF80F2345B89}
HKEY_CLASSES_ROOT\FSW.Application
HKEY_CLASSES_ROOT\FSWINST.FswinstCtrl.1
Reboot Windows and delete the 'FSW' folder inside 'Program
Files', along with the files 'support.exe' and 'IdleUI.dll'
in the System folder (inside 'Windows', called 'System32'
under Windows NT/2000/XP). You can also remove a leftover
installer file from a DOS command prompt window (Start->Programs->Accessories):
cd "%WinDir%\Downloaded Program Files"
del fswinst.ocx
Finally, go to Internet Options and reset your home page.
v6 variant
The v6 variant (Free Scratch Cards) uses random eight-letter
filenames in the System folder (in 'Windows', called 'System32'
under Windows NT/2000/XP). Find the key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
and delete the random-looking eight-letter value pointing
to a similarly named EXE in the System folder. (eg. bprplgqf).
This should
Restart the computer and open the System folder. Delete the
file with the same name as you saw in the Run registry entry
along with 'fsc.ini'. There should be some other eight-letter
random files you can delete to clean up if you like:
- An EXE whose internal name (right-click, choose 'Properties'
and click the 'Version' tab then choose 'Internal name')
is 'loader'.
- An EXE with a dollar icon, internal name 'FSC'.
- A DLL, internal name 'runpool'.
- A 7K-long EXE with no version information. (Check the
dates, don't delete a file if you're not sure.)
Make sure you have removed lop as well; unfortunately
this means more random filename finding.
|
