Adware.IGetNet - Removal

The following instructions pertain to all Symantec antivirus products that support Security Risk detection.

---

Note: Removing this adware component from the system will likely cause the program that installed it to not function as intended.

---

1. Update the definitions.
2. Reverse the changes that the adware made to the registry.
3. Restart the computer in Safe mode or VGA mode.
4. Run a full system scan and delete all the files detected as Adware.IGetNet.
5. Delete the text that was added to the Hosts file.

For specific details on each of these steps, read the following instructions.

1. Updating the definitions
To obtain the most recent definitions, start your Symantec program and run LiveUpdate.


2. Reversing the changes that the adware made to the registry

---

WARNING: Symantec strongly recommends that you back up the registry before making any changes to it. Incorrect changes to the registry can result in permanent data loss or corrupted files. Modify the specified keys only. Read the document, "How to make a backup of the Windows registry," for instructions.

---

1. Click Start, and then click Run.
2. Type regedit
   
   Then click OK.
   
   
3. Browse to and delete the following keys if they exist:
   
   HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\explorer\
   Browser Helper Objects\{730F2451-A3FE-4A72-938C-FC8A74F15978
   HKEY_CLASSES_ROOT\BHO.clsUrlSearch
   HKEY_CLASSES_ROOT\Rsp.BizLgk
   HKEY_CLASSES_ROOT\CLSID\{60E78CAC-E9A7-4302-B9EE-8582EDE22FBF}
   HKEY_CLASSES_ROOT\CLSID\{D5DE8D20-5BB8-11D1-A1E3-00A0C90F2731}
   HKEY_CLASSES_ROOT\CLSID\{730F2451-A3FE-4A72-938C-FC8A74F15978}
   HKEY_CLASSES_ROOT\CLSID\{676058E4-89BD-11D6-8A8C-0050BA8452C0}
   HKEY_CLASSES_ROOT\Interface\{18333387-5082-4710-94DF-9600CF6B2D5B}
   HKEY_CLASSES_ROOT\Interface\{676058E3-89BD-11D6-8A8C-0050BA8452C0}
   HKEY_CLASSES_ROOT\Interface\{F94C0089-9394-4E44-B4EA-58DBA1F7B84E}
   HKEY_CLASSES_ROOT\Interface\{3c8cde30-d013-4093-b00e-adbc74f33315}
   HKEY_CLASSES_ROOT\TypeLib\{676058DB-89BD-11D6-8A8C-0050BA8452C0}
   HKEY_CLASSES_ROOT\TypeLib\{974CC25E-D62C-4278-84E6-A806726E37BC}
   HKEY_CLASSES_ROOT\TypeLib\{ACBA087F-1547-41DE-8E9E-3F0963CE4BEF}
   
   
4. Navigate to the key:
   
   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
   
   
5. In the right pane, delete the value if it exists:
   
   "Winstart001.exe" = "%system%\Winstart001.exe –boot"
   
   
6. Exit the Registry Editor.

3. Restarting the computer in Safe mode or VGA mode
Shut down the computer and turn off the power. Wait for at least 30 seconds, and then restart the computer in Safe mode or VGA mode.

• For Windows 95, 98, Me, 2000, or XP users, restart the computer in Safe mode. For instructions, read the document, "How to start the computer in Safe Mode."
• For Windows NT 4 users, restart the computer in VGA mode.

4. Scanning for and deleting the infected files

1. Start Norton AntiVirus and make sure that it is configured to scan all the files. For more information, read the document, "How to configure Norton AntiVirus to scan all files."
2. Run a full system scan.
3. If any files are detected as Adware.IGetNet, click Delete.

5. Deleting the text that was added to the Hosts file
All the computers will not have this file, and the location can vary. For example, if the file exists in Windows 98, it will usually be in C:\Windows; and in Windows 2000, it is in the C:\WINNT\SYSTEM32\DRIVERS\ETC folder. Also, there may be multiple copies of this file in different locations.

The most efficient way to locate the file is to search for it.

Follow the instructions for your operating system:

• Windows 95/98/Me/NT/2000
  1. Click Start, point to Find or Search, and then click Files or Folders.
  2. Make sure that "Look in" is set to (C:) and that "Include subfolders" is checked.
  3. In the "Named" or "Search for..." box, type:
     
     hosts
     
     
  4. Click Find Now or Search Now.
  5. For each one that you find, right-click it, and then click "Open With."
  6. Deselect the "Always use this program to open this program" check box.
  7. Scroll through the list of programs and double-click Notepad.
  8. Look for the following lines and delete them, if found:
     
     216.177.73.139 auto.search.msn.com
     216.177.73.139 search.netscape.com
     216.177.73.139 Ieautosearch
     
     
  9. Close Notepad and save your changes when prompted.
     
     
• Windows XP
  1. Click Start, and then click Search.
  2. Click All files and folders.
  3. In the "All or part of the file name" box, type:
     
     hosts
     
     
  4. Verify that "Look in" is set to "Local Hard Drives" or to (C:).
  5. Click "More advanced options."
  6. Check "Search system folders."
  7. Check "Search subfolders."
  8. Click Search.
  9. Click Find Now or Search Now.
  10. For each one that you find, right-click it, and then click "Open With."
  11. Deselect the "Always use this program to open this program" check box.
  12. Scroll through the list of programs and double-click Notepad.
  13. Look for the following lines and delete them, if found:
      
      216.177.73.139 auto.search.msn.com
      216.177.73.139 search.netscape.com
      216.177.73.139 Ieautosearch
      
      
  14. Close Notepad and save your changes when prompted.

Technical Details