Printable View
Does anyone know how to rid myself of this smartsearch spyware.
Ive tried highjack this!, now it isnt even workiung to stop it. Ive been thry the registry threads and taken out all the smartsearch material, but keeps coming back. Any ideas on what to do instead of crashing my computer?
This is what i got out of another forum:
Quote:
.)
Merijn (author of HijackThis) has made a tool to get rid of CoolWebSearch and its many variants.
Download CWShredder:
http://www.merijn.org/files/cwshredder.zip
Unzip, run and hit the ->next tab to fix all found problems
Reboot.
2.)
Download 'Hijack This!'. http://www.merijn.org/files/hijackthis.zip
Unzip, doubleclick HijackThis.exe, and hit "Scan".
When the scan is finished, the "Scan" button will change into a "Save Log" button.
Press that, then Ctrl-A to Select All, and copy its contents here. Most of what it lists will be harmless or even essential, don't fix anything yet.
--------------------
Have Hijack This fix the following by placing a check in the appropriate boxes and selecting fix checked. Make sure all browser and all Windows Explorer windows are closed before fixing.
======================
Def. check out these two forums:
http://www.tweakxp.com/forum/forum_p...w.asp?TID=8447
http://www.computing.net/security/ww...orum/8654.html
That should take care of it...Good luck :)
edit:
let me save u some time :) :
This is a definite problem:
C:\Windows\explore.exe
Disable System Restore, make sure Show Hidden Files is enabled, and reboot into safe mode (tap the F8 key on boot).
Open HiJack This and put check marks in the following to fix.
R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://smartsearch.ws/?q=
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://smartsearch.ws/?q=
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://smartsearch.ws/?q=
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://smartsearch.ws
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://smartsearch.ws
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://smartsearch.ws/?q=
R1 - HKLM\Software\Microsoft\Internet Explorer,SearchURL = http://smartsearch.ws/?q=
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://smartsearch.ws
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://smartsearch.ws/?q=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://smartsearch.ws/?q=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://smartsearch.ws
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://smartsearch.ws/?q=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://smartsearch.ws/?q=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://smartsearch.ws/?q=
R1 - HKCU\Software\Microsoft\Internet Explorer,Search = http://smartsearch.ws/?q=
R1 - HKLM\Software\Microsoft\Internet Explorer,Search = http://smartsearch.ws/?q=
O4 - HKLM\..\Run: [SystemEmergency] C:\Windows\explore.exe
O4 - HKCU\..\Run: [SystemEmergency] C:\Windows\explore.exe
O13 - DefaultPrefix: http://smartsearch.ws/?q=
O13 - WWW Prefix: http://smartsearch.ws/?q=
(Make sure you get them all)
Then.... find (search for) and delete:
C:\Windows\explore.exe
----------------
Be careful NOT TO DELETE
C:\WINDOWS\Explorer.EXE
Notice the spelling
----------------
Reboot normally and repost log for review.
Can re-enable System Restore if clean.
Spybot S&D or Ad-Aware should take care of the problem...
spybot and ad-aware are not capable of completely taking care of this one yet .
Open the zip file, execute the attached file and scan with Ad-aware. Remove all traces of Smart Search.