so that the application starts when Windows starts.
Adds the registry keys:
HKEY_LOCAL_MACHINE\Software\KeenValue
HKEY_LOCAL_MACHINE\Software\eUniverse
Note:
Removing this adware component from the system will likely cause the
program that installed it to not function as intended. The uninstaller generally
identifies the programs that will not work after uninstallation.
Update the virus definitions.
Uninstall KeenValue using the Add/Remove Programs utility.
Run a full system scan and delete all the files detected as Adware.Keenval.
Delete the values that were added to the registry.
For specific details on each of these steps, read the following instructions.
1. Updating the virus definitions
Symantec Security Response fully tests all the virus definitions for quality
assurance before they are posted to our servers. There are two ways to obtain
the most recent virus definitions:
Running LiveUpdate, which is the easiest way to obtain virus definitions:
These virus definitions are posted to the LiveUpdate servers once each week
(usually on Wednesdays), unless there is a major virus outbreak. To determine
whether definitions for this threat are available by LiveUpdate, refer to the
Virus Definitions (LiveUpdate).
Downloading the definitions using the Intelligent Updater: The Intelligent
Updater virus definitions are posted on U.S. business days (Monday through
Friday). You should download the definitions from the Symantec Security
Response Web site and manually install them. To determine whether definitions
for this threat are available by the Intelligent Updater, refer to the
Virus Definitions (Intelligent Updater).
In the Control Panel window, double-click Add/Remove Programs.
On the Windows Me taskbar:
Click Start > Settings > Control Panel.
In the Control Panel window, double-click Add/Remove Programs.
If you do not see the Add/Remove Programs icon, click "...view all Control
Panel options."
On the Windows 2000 taskbar:
By default, Windows 2000 is set up the same as Windows 98. In that case,
follow the instructions for Windows 98. Otherwise, click Start, point to
Settings, point to Control Panel, and then click Add/Remove Programs.
On the Windows XP taskbar:
Click Start > Control Panel.
In the Control Panel window, double-click Add or Remove Programs.
Click KeenValue.
Note: You may need to use the scroll bar to view the whole list.
Click Add/Remove, Change/Remove, or Remove (this varies with the operating
system). Follow the prompts.
If any files are detected as infected with Adware.Keenval, click Delete.
4. Deleting the value from the registry
WARNING:
Symantec strongly recommends that you back up the registry before making
any changes to it. Incorrect changes to the registry can result in permanent
data loss or corrupted files. Modify the specified keys only. Read the document,
"How
to make a backup of the Windows registry," for instructions.
Note: This is done to
make sure all the keys are removed. They may not be there if the uninstaller
removed them.
Click Start, and then click Run. (The Run dialog box appears.)
a. Delete the Directory C:\Program Files\Common Files\KeenValue and all of its
contents.
Do you have "Spyware" on your system? Parasites or an Unwanted Search
Engine? Don't panic -- this is a learning experience on how some of these
so-called friendly companies treat you as a valued customer! Many of us
are totally amazed (including myself) at just how sneaky and underhanded
some of these companies are.
What is Spyware? A technology that assists in gathering information
about a person or organization without their knowledge. On the Internet, "spyware
is programming that is put in someone's computer to secretly gather
information about the user and relay it to advertisers or other interested
parties." Even in some cases after these programs have been removed from your
system. As such, spyware is cause for public concern about privacy on the
Internet. Also in many cases causes unknown browser
problems.
How did this happen?
When your Security settings are "soft" these sites take advantage of this
and actually install software on your system without your knowledge or
consent. In other cases downloaded software comes bundled with other
"components" (spyware\adware) that you don't realize exists until you start
having problems or discover your browser has been hijacked.
Recommended Minimal Security
Settings
Close all instances of Internet Explorer and Outlook Express
Control Panel | Internet Options | Click on the "Security" tab
Highlight the "Internet" icon, click "Custom Level"
"Download signed ActiveX scripts" = Prompt
"Download unsigned ActiveX scripts = Disable
"Initialize and script ActiveX not marked as safe" = Disable
"Installation of Desktop items" = Prompt
"Launching programs and files in a IFRAME" = Prompt
Click on the "Content" tab, Click the "Publishers" button
Highlight and click "Remove" any unknowns, click Ok
Why is this so important?
[read
this]
Click on the "Advanced" tab
Uncheck: "Install on demand (other)", click Apply\Ok
To test your setup after making the above changes
[click
here]
How To: Prevent this from
happening again?
The first thing you must remember is that adware\spyware tools are
basically for removal after the fact. The trick is "layered
protection" for maximum prevention!
Editors Note: Since HijackThis does not (yet) come with a install
routine, create a folder via Windows Explorer for HijackThis, then move the
zip file to this folder. This way any backups created are saved in a legit
folder. I've seen too many instances where the user runs HijackThis from a
temp folder and any backups are lost if that temp folder is cleaned out. You
should also make sure you are using the latest version each and
every time you run HijackThis, as there are new detection added all the
time.
Unzip, double-click "HijackThis.exe" and Press "Scan".
When the scan is finished, the "Scan" button will change into a "Save
Log" button.
Click: "Save Log" (generates: "hijackthis.log")
HijackThis
Tutorial (recommended read)
Sign in, go to the "Spyware and Hijackware Removal" section.
Press "New Topic", copy and paste hijackthis.log into your new message.
Visiting the
SpywareInfo
Forum or one of the other recommended Forums, to finish cleaning up
your system is highly recommended. As neither Ad-Aware or SpyBot can no
longer completely remove these pests. This is mainly due to new
daily threats and the use of random generated filenames used by these
parasites!
Editors Note: there are now nearly 10,000 Coolwebsearch
affiliates!
They do this as a "Pay-per-Click" scheme, basically getting a few cents for
each user that gets hijacked to Coolwebsearch or one of it's major
affiliates. Nice guys huh? Most of these affiliates are Adult related, so be
careful where you surf and
practice Safe Hex!
Additional Prevention
Both the HOSTS file
and the Restricted Zone
entries target most of the major parasites, hijackers and unwanted
search engines. If you are also having trouble with unwanted pop-ups - [start
here] There are however several severe security risks that still exist
in Internet Explorer. Until Microsoft releases a (hot fix) patch, users can
protect themselves by using Qwik-Fix and several other steps.
[more
info]
RepairDefaultPrefix.reg [right-click and select: Save As]
Repairs the corrupted or altered (spyware) HTTP prefixes Note: HijackThis can also repair the DefaultPrefix entry [more
info]
RepairTabs.reg
[right-click and select: Save As]
1) Restores the missing Tabs in IE (usually spyware related)
2) Unlocks the grayed-out Home Page section
3) Removes the Administrator message in Internet Options Note: HijackThis can also repair the "Missing Tabs" restriction [more
info]
UnlockNoBrowserOptions.reg [right-click and select: Save As]
Removes the Administrator message in Internet Options
SpyBot also has this option in the Immunize section [more
info]
To use: download - right-click and select: Edit to view in
Notepad.
Right-click and select: Merge - to enter the info into the Registry,
and reboot.
Note: always backup the Registry before making any changes. Also be
aware these reg files are intended for stand-alone or home users. Corporate
users are urged to check with their network supervisor before removing
restrictions.
Click open "+MenuExt" (left pane) Locate the desired Menu
Extension (highlight)
Make a note of the corresponding (htm) file (right pane)
Right-click the desired key (Menu Extension) select: Delete Note: always Export before editing the Registry.
Close Regedit, Open Windows Explorer
Locate and delete the "corresponding (htm) file" (if exists)
Repairing your Winsock
Connection
If you have suddenly lost your Internet connection after removing spyware
(such as NewDotNet, and Commonname) the following steps will help restore
your connection.
Editors Note: you may find after removing some of these parasites
especially the ones that install unwanted Toolbars (BHOs) that your existing
Toolbar setup may be corrupt. [more
info]
[
Other Spyware and Parasite related
Sites and Newsgroups