« flames on the side of my face | Main | going down »

January 11, 2004

Ding Dong!

It's fixed. Finally. Here is where I found instructions on getting rid of this monster.

Here are my own instructions (Follow at your own risk!!!!)
1. Download HiJackThis. You can find it here.

2. Boot to safe mode. Start > Shutdown > Restart. As the computer restarts, start clicking F8.

3. Run HiJackThis. Delete all references to SmartSearch.ws and delete:
O4 - HKLM\..\Run: [UserSystem] C:\~~WHATEVER~~
O4 - HKCU\..\Run: [UserSystem] C:\~~WHATEVER~~

4. Exit HiJackThis and find the file C:\~~WHATEVER~~ that was referenced in the O4 lines and delete it. The forums said it was explore.exe or C:\Windows\iExplorer.exe. Mine was Systeem.exe. So it seems like there are many different versions out there.

5. Reboot and your computer should be fine.

If anyone knows how this infected my dad's computer, drop me a line because I am tired of him asking me.

PS I am wearing my poncho and I feel like Tonto.

Posted by donna at January 11, 2004 11:59 AM | TrackBack

Comments

Thanks a tone,

It worked !!!
If it helps, I got this crap from a website without knowing it. (x-cracks.com I think)

Dan

Posted by: Dan at January 17, 2004 07:39 PM

my computer was also infected with smartsearch, i ran a search on yahoo and came across your site. Basically your father's computer was probably infected by visiting a warez or crack site, notably www.x-crack.com. These websites forcefully uploads the virus onto the computer with pop-ups. I'm not claiming your father visited illegal sites. There are probably other sites that does this or your father could be forcefully directed into the site.

Posted by: Pat at January 14, 2004 08:03 PM

For your father...

first, sorry for my english cause i'm french

i think smartsearch.ws install like activeX components

It's the same way than when you install the components wich allows you to read flash animations

you can do nothing a the moment it's ask you if the components can be install
If you answer no, the soft is install
if you answer yes same way...
and if you answer cancel or close the windows...i ll let you guess...

So it's no the user fault, it's the soft which is very well programmed...

Have a nice day, Yann

Posted by: Yann at January 13, 2004 05:42 PM