the worst part of kazaa is newdotnet&webhancer,
read the write-up at;
http://www.cexx.org/newnet.htm and
http://www.cexx.org/adware.htm
info from;
http://www.simplythebest.net/info/spyware.html
KaZaa Toptext
Sells targeted traffic based on the content of everyone's web page without having to develop any content of their
own. There is a new file sharing system launched in the wake of the MP3 war called KaZaa. When you install KaZaa
you get a spyware virus installed on your computer. Toptext takes control of your browser and makes changes to
everything you read on the Internet (like Flyswat), which qualifies it as a hacking program as well. It changes the way
you'll browse forever.
NOTE: the latest version of this program also installs the following spyware agents: Cydoor, Webhancer and
Newdotnet.
TopText operates with a browser to highlight words on every web page, inserting a yellow background behind
keywords that have been purchased through their media sales company eZula, Inc. If a web user clicks on one of
those yellow highlighted words on a web page, the user is sent to the site of the company paying the most that day
for each click-through. If a user whose browser is infected with TopText visits your web site, they will be offered links
to competitor's web sites for every keyword they find on your site for which they have a buyer.
This is not much different from the Smart Tags system that Microsoft announced for their Windows XP browser.
Media and webmaster outrage caused Microsoft to cancel the release of that feature, for the time being that is.
Several download web sites are actively helping this kind of virus to spread, as long as it pays, I guess.
SimplytheBest.net does not. We don't like this invasion of privacy and will not in any way assist in spreading the use
of this program. This spyware agent is very hard to get rid of so your best option is to never download it in the first
place. Look for alternatives instead that offer the same functionality without the spyware agent.
You can remove EZula instances from the Registry:
HKEY_CLASSES_ROOT\EZulaBoot.InstallCtrl.1
HKEY_CLASSES_ROOT\EZulaBoot.InstallCtrl.1
HKEY_CLASSES_ROOT\EZulaBootExe.InstallCtrl
HKEY_CLASSES_ROOT\EZulaBootExe.InstallCtrl.1.
HKEY_LOCAL_MACHINE\Software\CLASSES\AppID\eZulaBootExe.EXE
HKEY_LOCAL_MACHINE\Software\CLASSES\AppID\{C0335198-6755-11D4-8A73-0050DA2EE1BE}
HKEY_LOCAL_MACHINE\Software\CLASSES\TypeLib\{3D7247D1-5DB8-11D4-8A72-0050DA2EE1BE}
HKEY_LOCAL_MACHINE\Software\CLASSES\TypeLib\{C0335197-6755-11D4-8A73-0050DA2EE1BE}
HKEY_LOCAL_MACHINE\Software\Microsoft\Code Store Database\Distribution
Units\{3D7247DE-5DB8-11D4-8A72-0050DA2EE1BE}
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded
Program Files/eZulaBoot.dll
And in HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Doc Find Spec MRU you'll
find an entry for EZulaboot.
And from your harddisk:
C:\WINDOWS\Downloaded Program Files\InstallCtrl.class, which mentions two files it depends on ezulaboot.dll and
ezulaboot.inf.
C:\WINDOWS\eZulains.exe
C:\WINDOWS\APPLOG\ezulains.lgc
You can use AD-aware to get rid of Toptext, but it will cause problems with your Internet connection and so forth.
Best way to go is not to download and install ANY spyware. It's getting more difficult to get rid of them and even to
find them. After using AD-aware you can double check the Registry by doing a Find for eZula.
You can also visit the WhirlyWiryWeb.com web site for more information on eZula and Toptext. They also feature a
script which checks if you have Toptext installed and a complete Toptext removal guide.
Users wanting similar functionality are advised to download Morpheus 1.3 (uninstall 1.2 first) instead. Get it here.
NOTE: we are hearing rumors that Morpheus contains spyware agents as well. We'll be investigating this and will
post any findings here as soon as we can confirm the rumors.