SmartSearch manual removal:
Kill processes:
accesss.exe, directx.exe, explore.exe, funny.exe, helpcvs.exe, internet.exe, systeem.exe, systemcritical.exe, wmplayer.exe, y.exe
Delete registry values:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SystemEmergency
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\Prefixes\www=[site address]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\DefaultPrefix\(Default)=[site address]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Search=[site address]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchURL=[site address]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\Default_Page_URL=[site address]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\Default_Search=[site address]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\Search Bar=[site address]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page=[site address]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page=[site address]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Search\CustomizeSearch=[site address]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Search\SearchAssistant=[site address]
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Search=[site address]
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchURL=[site address]
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Default_Page_URL=[site address]
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Default_Search_URL=[site address]
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Search Page=[site address]
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Start Page=[site address]
Delete files:accesss.exe, directx.exe, explore.exe, funny.exe, helpcvs.exe, internet.exe, systeem.exe, systemcritical.exe, wmplayer.exe, y.exe
Misc:[site address] is an address of a web site on the smartsearch.ws domain.
Exact file location:
accesss.exe - C:\Program Files\Accessories
directx.exe - C:\Program Files\directx
explore.exe - C:\Windows or C:\Winnt
funny.exe, y.exe - C:
helpcvs.exe - C:\Windows\Help or C:\Winnt\Help
internet.exe - C:\Windows\System, C:\Windows\System32 or C:\Winnt\System32
systeem.exe - C:\Program Files\Common Files\System
systemcritical.exe - C:\Games
wmplayer.exe - C:\Windows\Media or C:\Winnt\Media
The SmartSearch is a variant of CoolWebSearch Trojan. I was able to restore my system after running CWShredder.
Post Comment: