Description

LinkReplacer is an Internet Explorer Browser Helper Object that adds content to the start of every web page viewed.

This content is (currently) a script that reads all your cookies and sends them to LinkReplacer's controlling server wcft.net.

Distribution

As yet unknown.

What it does

Advertising

No.

Privacy violation

Yes. Cookies set by web sites (and sent by LinkReplacer) may contain personally identifying information.

Cookies are also often used for authorising access to web sites. LinkReplacer's owners will often be able to gain access to your accounts on web sites you have accessed with it loaded.

Security issues

Yes. LinkReplacer can download and execute arbitrary code as an update feature.

On opening a new IE window, LinkReplacer contacts its controlling server to download the script to be added, and a new copy of itself if it has not updated for a while.

Stability problems

Yes. On closing an IE window you may receive an 'Application Error' crash in IEXPLORE.EXE.

Adding the script to the very start of each page can cause web pages that rely on a standards-compliant document type to render badly in IE6.

Removal

Open a DOS command prompt window (Start->Programs->Accessories) and enter:

Restart the computer and you should be able to delete the file 'iehelper.dll' inside the System folder (inside the Windows folder; called 'System32' under Windows NT/2000/XP or 'System' under Windows 95/98/Me).

You might also want to change the passwords on web site accounts you have that LinkReplacer may have compromised.