Name: webHancer Category: Spyware Alias: Customer Companion, Webhancer Customer Companion, SpeedRank Advice: Remove Risk: Elevated Risk Elevated threats are usually threats that fall into the range of adware in which data about a user's habits are tracked and sent back to a server for analysis without your consent or knowledge. Description: WebHancer is a spyware process started at Windows startup that monitors web sites being viewed and sends performance data on them back to webHancer's servers. This occurs unknown to the user. Tracks Web browsing, watching for customer acquisition, conversion, and retention. Feeds statistics to the vendor. Can disrupt networking, especially if manual removal is attempted. WebHancer provides a traffic measurement service that uses a client agent that is installed on user machines, gathering detailed data about sites visited, their performance and, most important, what the user actually does while there. WebHancer is reportedly on ten million user desktops in 192 countries, placed there by partners such as companies that provide free software on the Web. Download an MP3 player, and you may be offered a chance to play in the measurement game by also loading the WebHancer agent. This model is opt-in, with an explicit license agreement. WebHancer claims that its agent doesn't gather any personal information about end users. Installation is transparent, but incorrect removal procedures will destroy your Internet connection. The majority of users running WebHancer are not aware they are running it, unless they have noticed system side-effects or unusual data transfers from their computer. Webhancer's install is silent, and triggered by the install of other, unrelated software that is bundled with it. In addition, there are reports that if it is removed, other applications in your machine might reinstall it. The WebHancer install will alter critical Registry keys relating to Windows Sockets, causing the system's Internet connection capabilities to break if the user tries uninstalling it. WebHancer's makers claim not to modify system files although they have confirmed that attempting to remove it will break your system. The webhancer process will appear on the Ctrl-Alt-Delete list (Task List) in Windows as Whagent. WebHancer has very widespread bundling, especially with file-sharing software such as AudioGalaxy and Grokster. "The webHancer Customer Companion is a small piece of software which periodically, anonymously, and confidentially relays tiny packets of user-experience data to a central server, where it is aggregated and used to generate reports. These reports allow website owners to fine-tune their sites, to help make your surfing experience better." Signatures: process: whsurvey.exe: MD5 Hash: e0db8715539d42fbf30... process: whcc-grokster.exe: MD5 Hash: ... process: whagent.exe: MD5 Hash: ... process: whinstaller.exe: MD5 Hash: ... process: whagent_update.exe: MD5 Hash: ... process: whinstaller.exe: MD5 Hash: ... process: speedrank_setup.exe: MD5 Hash: 5b2dab775ad52bfd263... process: whcc-webhancer.exe: MD5 Hash: ace7f9ce5dbc9e2913f... process: whagent.exe: MD5 Hash: acdf5940a7d7756c442... process: whsurvey.exe: MD5 Hash: c9d401101d65d929922... process: whspeedrank.exe: MD5 Hash: 277988cd1c8e86c0c6b... process: whagent.exe: MD5 Hash: e1a0b60e5cdcb6d3300... process: whinstaller.exe: MD5 Hash: 264d2471ce022237bba... process: whsurvey.exe: MD5 Hash: 18bae133f414d9b8289... process: whinstaller.exe: MD5 Hash: 1e5a8369b4ea48f7999... process: whcc-1.exe: MD5 Hash: 39fd42813ced5f0c1ab... process: whinstaller.exe: MD5 Hash: 9a9ecabc3508725f4ee... process: Wrapper.exe: MD5 Hash: a986ce0c9ff84675ca5... process: whcc-motor.exe: MD5 Hash: 82ee2dc6923b9506f93... process: whinstaller.exe: MD5 Hash: 7d926ef989dc6b00a22... process: whagent_update.exe: MD5 Hash: 682dad64235c20714c3... process: whagent.exe: MD5 Hash: 33edeebc9bd5203f674... process: whinstaller.exe: MD5 Hash: 9fbbd131a0e48f466eb... process: whinstaller.exe: MD5 Hash: 9fbbd131a0e48f466eb... process: whsurvey.exe: MD5 Hash: 1abe7b9fd549aac5561... process: webhancer_winrar.exe: MD5 Hash: de143d6ab327a9b72ae... process: whAgent.exe: MD5 Hash: d2b665a897c1303b2b5... process: whSurvey.exe: MD5 Hash: 89fc789cf1dcc49d8bc... process: whsurvey.exe: MD5 Hash: ... process: whagent.exe: MD5 Hash: ... process: whcc-giant.exe: MD5 Hash: ... process: whCC-GIANT.exe: MD5 Hash: 7b735a6535ab60981ad... process: webhancer.exe: MD5 Hash: 163a0a8e61b9c62a008... process: whagent.exe: MD5 Hash: 7ff027b71f791aa7fb8... process: whsurvey.exe: MD5 Hash: c746a3a3d782085581e... process: whagent_update.exe: MD5 Hash: 65ffb1f17f973da86e9... process: webhanc.exe: MD5 Hash: 6f3db4cf8c0a36c8ea4... process: whagent.exe: MD5 Hash: d2b665a897c1303b2b5... process: whagent.exe: MD5 Hash: ... process: whinstaller.exe: MD5 Hash: ... process: whsurvey.exe: MD5 Hash: ... process: whinstaller.exe: MD5 Hash: 9df3bc656b9326004b6... process: whinstaller.exe: MD5 Hash: 3046217ed8379ac0f6f... process: whagent.exe: MD5 Hash: 13246af3ee86e54a3aa... process: whsurvey.exe: MD5 Hash: 7c3095632f2e4df491e... process: whsurvey.exe: MD5 Hash: c746a3a3d782085581e... process: whagent.exe: MD5 Hash: 7ff027b71f791aa7fb8... process: whsurvey.exe: MD5 Hash: 2de900e911810776ad8... process: whinstaller.exe: MD5 Hash: 79934ec7d2ce8287a55... process: whagent_update.exe: MD5 Hash: 2d48811f1643b112585... process: wh.exe: MD5 Hash: 74991efce628d59fa8f... process: whagent.exe: MD5 Hash: 6474587eb44fcf41004... process: whinstaller.exe: MD5 Hash: 9238f3ee3d1018b827d... process: whsurvey.exe: MD5 Hash: 54457a07fa4e9901667... process: whcc-giant.exe: MD5 Hash: 7b735a6535ab60981ad... process: wh.exe: MD5 Hash: 7286c4064f326faf629... process: whagent.exe: MD5 Hash: 27cc23844cfadda1321... process: whsurvey.exe: MD5 Hash: 13a3094c74bfb97c24a... process: whagent.exe: MD5 Hash: b4ab1851c0879303680... process: whcc-click.exe: MD5 Hash: 10644356fd2596055e1.. Type: Spyware - Spyware's primary purpose is to collect demographic and usage information from your computer, usually for advertising purposes. Spyware usually that 'sneaks' onto a system or performs other activities hidden to the user. Spyware programs are usually bundled as a hidden component and downloaded from the Internet. These modules are almost always installed on the system secretively and try to run secretively as well.