How do i get rid of the smartsearch.ws bug?

Dear elusivesoul,

just above 2 program one after another and they will take care of removing this for u.
and then post the Hijacklog to this if the problem is not solved.

NOTE u have to run both one after another to get rid of everything.

Check these registry entries

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Search Bar
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Search Page
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Start Page
HKCU\Software\Microsoft\Internet Explorer\SearchURL
HKCU\Software\Microsoft\Internet Explorer\Main\Default_Page_URL
HKCU\Software\Microsoft\Internet Explorer\Main\Default_Search_URL
HKCU\Software\Microsoft\Internet Explorer\Search\SearchAssistant
HKCU\Software\Microsoft\Internet Explorer\Search\CustomizeSearch
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Search Bar


and delete smartsearch if you find them

Sunray

Hi Shivsa,
apologies for my late comment. I downloaded the 2 programs as you suggested, and when
I came to open both of them up, they are closed after 5 seconds. Just like all the other anti-spyware programs I tried.
The audacity of such a browser hijacker program is extremely disturbing. And hell annoying as well.

Sunray, when i do delete or modify those regedit entries, the value of smartsearch.ws is restored when i come to leave regedit and return to it.

okie try this.
first delete all the temp files on your system. delete cache /cookie/history folders of the IE.

uninstall any program that is unknown to u, and delete its folder too.

go to start --> run ---> msconfig
go to startup tab and disable all applications

go to start --> run --> %temp%
go to that folder and remove all the contents of the folder
DONOT remove the TEMP folder , just remove all its contents

now reboot and check if it is still coming

DId you also use CWshredder ? if not , use it

Sunray

ok, did all that. And still, when i come to open up the 2 programs, it shuts down after the "magical" 5 second number :)

These are the locations msconfig startup tab will have . you may want to go and check manually

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices
"

Also repair or reinstall IE

Repair IE :
-----------

Start > Run rundll32 setupwbv.dll,IE6Maintenance "C:\Program Files\Internet Explorer\Setup\SETUP.EXE" /g

or

Start > Run rundll32.exe setupapi,InstallHinfSection DefaultInstall 132 C:\windows\inf\ie.inf

Reinstall IE:
-------------

Description of the Internet Explorer Repair Tool
http://support.microsoft.com/default.aspx?scid=http://support.microsoft.com:80/support/kb/articles/Q194/1/77.asp&NoWebContent=1

How to Reinstall or Repair Internet Explorer and Outlook Express in Windows XP
http://support.microsoft.com/?kbid=318378

or

Repair Internet Explorer 6
http://www.theeldergeek.com/repair_ie6.htm

How to Uninstall Internet Explorer 6
http://support.microsoft.com/?kbid=293907

Sunray

ok, did that sunray, and cwshredder is still being closed off after 5 seconds.

my previous post was for the the one you asked before your last one.
uumm, i dont think doingany of those things with ie will work, there is something too sophisticated about this browser hijacker. Even symantecs site does not offer anything along the lines of repairing ie,
http://securityresponse.symantec.com/avcenter/venc/data/adware.smartsearch.html
but the thing is, i cant find HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices

first download shredder and keep it somewhere on your system.

then u just rename these files if found in the system.

File names: C:\y.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Windows\explore.exe
C:\Windows\system32\internet.exe
C:\Windows\system\internet.exe
C:\Program Files\directx\directx.exe
C:\Program Files\Common Files\System\systeem.exe
C:\Windows\Media\wmplayer.exe
C:\Windows\Help\helpcvs.exe
C:\Program Files\Accessories\accesss.exe
C:\Games\systemcritical.exe
C:\funny.exe

and then delete all the regustries related to serach.
could u try this.

u open up registry editor and search for "SystemEmergency", delete all the registry related to this.
search for "smartsearch" and delete registry related to these.

but before save your registry and then try deleting mentioned above.

first of all shivsa, shredder just will not open up for more then 5 seconds. Also the above didnt work.

hey, i just came across this link that discusses the same issue...
http://www.experts-exchange.com/Web/Browser_Issues/Q_20845621.html
I'll try and reboot it in safe mode now shivsa

we know about this post, but in your case since u can not start cwshredder or hijakthis, we have to go hard way.
so u have to end all the processes i listed above.

delete some of the processes which are of no use.
and then do the things.

YESSSS!!!, safe mode did the trick, then i was able to use the 2 programs with no hassles, thanks heaps Shivsa, really appreciated. :)
No I can do a normalsearch instead of a smartsearch ;)